Merge webkit.org at r50258 : Initial merge by git.

Change-Id: I1a9e1dc4ed654b69174ad52a4f031a07240f37b0

1089 files changed, 48219 insertions, 13606 deletions

diff --git a/JavaScriptCore/API/APICast.h b/JavaScriptCore/API/APICast.h
index b6d1532..b9167a8 100644
--- a/JavaScriptCore/API/APICast.h
+++ b/JavaScriptCore/API/APICast.h
@@ -27,6 +27,7 @@
 #define APICast_h
 
 #include "JSAPIValueWrapper.h"
+#include "JSGlobalObject.h"
 #include "JSValue.h"
 #include <wtf/Platform.h>
 #include <wtf/UnusedParam.h>
@@ -118,6 +119,7 @@ inline JSContextRef toRef(JSC::ExecState* e)
 
 inline JSGlobalContextRef toGlobalRef(JSC::ExecState* e)
 {
+    ASSERT(e == e->lexicalGlobalObject()->globalExec());
     return reinterpret_cast<JSGlobalContextRef>(e);
 }
 
diff --git a/JavaScriptCore/API/JSCallbackConstructor.h b/JavaScriptCore/API/JSCallbackConstructor.h
index 202b119..c4bd7ad 100644
--- a/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/JavaScriptCore/API/JSCallbackConstructor.h
@@ -41,9 +41,12 @@ public:
     
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
+protected:
+    static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
+
 private:
     virtual ConstructType getConstructData(ConstructData&);
     virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/JavaScriptCore/API/JSCallbackFunction.h b/JavaScriptCore/API/JSCallbackFunction.h
index 3a17fa2..0cf25c4 100644
--- a/JavaScriptCore/API/JSCallbackFunction.h
+++ b/JavaScriptCore/API/JSCallbackFunction.h
@@ -41,7 +41,7 @@ public:
     // refactor the code so this override isn't necessary
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
 private:
diff --git a/JavaScriptCore/API/JSCallbackObject.h b/JavaScriptCore/API/JSCallbackObject.h
index 86f2f32..d19890a 100644
--- a/JavaScriptCore/API/JSCallbackObject.h
+++ b/JavaScriptCore/API/JSCallbackObject.h
@@ -50,9 +50,12 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | OverridesHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
 
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | Base::StructureFlags;
+
 private:
     virtual UString className() const;
 
diff --git a/JavaScriptCore/API/JSContextRef.cpp b/JavaScriptCore/API/JSContextRef.cpp
index c358a84..e6626b7 100644
--- a/JavaScriptCore/API/JSContextRef.cpp
+++ b/JavaScriptCore/API/JSContextRef.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "JSContextRef.h"
+#include "JSContextRefPrivate.h"
 
 #include "APICast.h"
 #include "InitializeThreading.h"
@@ -152,3 +153,12 @@ JSContextGroupRef JSContextGetGroup(JSContextRef ctx)
     ExecState* exec = toJS(ctx);
     return toRef(&exec->globalData());
 }
+
+JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
+{
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toGlobalRef(exec->lexicalGlobalObject()->globalExec());
+}
diff --git a/JavaScriptCore/API/JSContextRefPrivate.h b/JavaScriptCore/API/JSContextRefPrivate.h
new file mode 100644
index 0000000..ff014ec
--- /dev/null
+++ b/JavaScriptCore/API/JSContextRefPrivate.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSContextRefPrivate_h
+#define JSContextRefPrivate_h
+
+#include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSValueRef.h>
+#include <JavaScriptCore/WebKitAvailability.h>
+
+#ifndef __cplusplus
+#include <stdbool.h>
+#endif
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+@function
+@abstract Gets the global context of a JavaScript execution context.
+@param ctx The JSContext whose global context you want to get.
+@result ctx's global context.
+*/
+JS_EXPORT JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* JSContextRefPrivate_h */
diff --git a/JavaScriptCore/API/tests/testapi.c b/JavaScriptCore/API/tests/testapi.c
index 1f413e1..152babc 100644
--- a/JavaScriptCore/API/tests/testapi.c
+++ b/JavaScriptCore/API/tests/testapi.c
@@ -25,6 +25,7 @@
 
 #include "JavaScriptCore.h"
 #include "JSBasePrivate.h"
+#include "JSContextRefPrivate.h"
 #include <math.h>
 #define ASSERT_DISABLED 0
 #include <wtf/Assertions.h>
@@ -41,8 +42,8 @@ static double nan(const char*)
 
 #endif
 
-static JSGlobalContextRef context = 0;
-static int failed = 0;
+static JSGlobalContextRef context;
+static int failed;
 static void assertEqualsAsBoolean(JSValueRef value, bool expectedValue)
 {
     if (JSValueToBoolean(context, value) != expectedValue) {
@@ -618,14 +619,16 @@ static JSClassRef Derived_class(JSContextRef context)
     return jsClass;
 }
 
-static JSValueRef print_callAsFunction(JSContextRef context, JSObjectRef functionObject, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static JSValueRef print_callAsFunction(JSContextRef ctx, JSObjectRef functionObject, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     UNUSED_PARAM(functionObject);
     UNUSED_PARAM(thisObject);
     UNUSED_PARAM(exception);
+
+    ASSERT(JSContextGetGlobalContext(ctx) == context);
     
     if (argumentCount > 0) {
-        JSStringRef string = JSValueToStringCopy(context, arguments[0], NULL);
+        JSStringRef string = JSValueToStringCopy(ctx, arguments[0], NULL);
         size_t sizeUTF8 = JSStringGetMaximumUTF8CStringSize(string);
         char* stringUTF8 = (char*)malloc(sizeUTF8);
         JSStringGetUTF8CString(string, stringUTF8, sizeUTF8);
@@ -634,7 +637,7 @@ static JSValueRef print_callAsFunction(JSContextRef context, JSObjectRef functio
         JSStringRelease(string);
     }
     
-    return JSValueMakeUndefined(context);
+    return JSValueMakeUndefined(ctx);
 }
 
 static JSObjectRef myConstructor_callAsConstructor(JSContextRef context, JSObjectRef constructorObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
@@ -760,6 +763,7 @@ int main(int argc, char* argv[])
 
     JSGlobalContextRetain(context);
     JSGlobalContextRelease(context);
+    ASSERT(JSContextGetGlobalContext(context) == context);
     
     JSReportExtraMemoryCost(context, 0);
     JSReportExtraMemoryCost(context, 1);
diff --git a/JavaScriptCore/AllInOneFile.cpp b/JavaScriptCore/AllInOneFile.cpp
index 7b67dbe..e69de29 100644
--- a/JavaScriptCore/AllInOneFile.cpp
+++ b/JavaScriptCore/AllInOneFile.cpp
@@ -1,106 +0,0 @@
-/*
- *  Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
- *
- */
-
-// This file exists to help compile the essential code of
-// JavaScriptCore all as one file, for compilers and build systems
-// that see a significant speed gain from this.
-
-#define KDE_USE_FINAL 1
-#define JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE 1
-#include "config.h"
-
-// these headers are included here to avoid confusion between ::JSType and JSC::JSType
-#include "JSCallbackConstructor.h"
-#include "JSCallbackFunction.h"
-#include "JSCallbackObject.h"
-
-#include "runtime/JSStaticScopeObject.cpp"
-#include "runtime/JSFunction.cpp"
-#include "runtime/Arguments.cpp"
-#include "runtime/JSAPIValueWrapper.cpp"
-#include "runtime/JSGlobalObjectFunctions.cpp"
-#include "runtime/PrototypeFunction.cpp"
-#include "runtime/GlobalEvalFunction.cpp"
-#include "debugger/Debugger.cpp"
-#include "runtime/JSArray.cpp"
-#include "runtime/ArrayConstructor.cpp"
-#include "runtime/ArrayPrototype.cpp"
-#include "runtime/BooleanConstructor.cpp"
-#include "runtime/BooleanObject.cpp"
-#include "runtime/BooleanPrototype.cpp"
-#include "runtime/Collector.cpp"
-#include "runtime/CommonIdentifiers.cpp"
-#include "runtime/DateConstructor.cpp"
-#include "runtime/DateConversion.cpp"
-#include "runtime/DatePrototype.cpp"
-#include "runtime/DateInstance.cpp"
-#include "wtf/dtoa.cpp"
-#include "runtime/ErrorInstance.cpp"
-#include "runtime/ErrorPrototype.cpp"
-#include "runtime/ErrorConstructor.cpp"
-#include "runtime/FunctionConstructor.cpp"
-#include "runtime/FunctionPrototype.cpp"
-#include "Grammar.cpp"
-#include "runtime/Identifier.cpp"
-#include "runtime/JSString.cpp"
-#include "runtime/JSNumberCell.cpp"
-#include "runtime/GetterSetter.cpp"
-#include "runtime/InternalFunction.cpp"
-#include "runtime/Completion.cpp"
-#include "runtime/JSImmediate.cpp"
-#include "runtime/JSLock.cpp"
-#include "runtime/JSWrapperObject.cpp"
-#include "parser/Lexer.cpp"
-#include "runtime/ArgList.cpp"
-#include "runtime/Lookup.cpp"
-#include "runtime/MathObject.cpp"
-#include "runtime/NativeErrorConstructor.cpp"
-#include "runtime/NativeErrorPrototype.cpp"
-#include "runtime/NumberConstructor.cpp"
-#include "runtime/NumberObject.cpp"
-#include "runtime/NumberPrototype.cpp"
-#include "parser/Nodes.cpp"
-#include "runtime/JSObject.cpp"
-#include "runtime/Error.cpp"
-#include "runtime/JSGlobalObject.cpp"
-#include "runtime/ObjectConstructor.cpp"
-#include "runtime/ObjectPrototype.cpp"
-#include "runtime/Operations.cpp"
-#include "parser/Parser.cpp"
-#include "runtime/PropertySlot.cpp"
-#include "runtime/PropertyNameArray.cpp"
-#include "runtime/RegExp.cpp"
-#include "runtime/RegExpConstructor.cpp"
-#include "runtime/RegExpObject.cpp"
-#include "runtime/RegExpPrototype.cpp"
-#include "runtime/ScopeChain.cpp"
-#include "runtime/StringConstructor.cpp"
-#include "runtime/StringObject.cpp"
-#include "runtime/StringPrototype.cpp"
-#include "runtime/UString.cpp"
-#include "runtime/JSValue.cpp"
-#include "runtime/CallData.cpp"
-#include "runtime/ConstructData.cpp"
-#include "runtime/JSCell.cpp"
-#include "runtime/JSVariableObject.cpp"
-#include "wtf/FastMalloc.cpp"
-#include "wtf/TCSystemAlloc.cpp"
-#include "bytecompiler/BytecodeGenerator.cpp"
-#include "interpreter/RegisterFile.cpp"
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 7cf56bd..fb09372 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,1325 @@
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JSC JIT on ARMv7 cannot link jumps >16Mb range
+        https://bugs.webkit.org/show_bug.cgi?id=30891
+
+        Start planing all relative jumps as move-32-bit-immediate-to-register-BX.
+        In the cases where the jump would fall within a relative jump range, use a relative jump.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::~ARMv7Assembler):
+        (JSC::ARMv7Assembler::LinkRecord::LinkRecord):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::executableCopy):
+        (JSC::ARMv7Assembler::linkJump):
+        (JSC::ARMv7Assembler::relinkJump):
+        (JSC::ARMv7Assembler::setInt32):
+        (JSC::ARMv7Assembler::isB):
+        (JSC::ARMv7Assembler::isBX):
+        (JSC::ARMv7Assembler::isMOV_imm_T3):
+        (JSC::ARMv7Assembler::isMOVT):
+        (JSC::ARMv7Assembler::isNOP_T1):
+        (JSC::ARMv7Assembler::isNOP_T2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst):
+        (JSC::ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::twoWordOp5i6Imm4Reg4EncodedImm):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+        * jit/JIT.h:
+        * wtf/Platform.h:
+
+2009-10-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve for..in enumeration performance
+        https://bugs.webkit.org/show_bug.cgi?id=30887
+
+        Improve indexing of an object with a for..in iterator by
+        identifying cases where get_by_val is being used with a iterator
+        as the subscript and replace it with a new get_by_pname
+        bytecode.  get_by_pname then optimizes lookups that directly access
+        the base object.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetByVal):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::pushOptimisedForIn):
+        (JSC::BytecodeGenerator::popOptimisedForIn):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_get_by_pname):
+        (JSC::JIT::emitSlow_op_get_by_pname):
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode):
+        * runtime/JSObject.h:
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::getOffset):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::addAnonymousSlotsTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+          Track the existence (or not) of non-enumerable properties.
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageCapacity):
+        (JSC::Structure::propertyStorageSize):
+        (JSC::Structure::hasNonEnumerableProperties):
+        (JSC::Structure::hasAnonymousSlots):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, attemp to fix Windows build.
+
+        Touch the cpp file to cause recompile.
+
+        * wtf/Threading.cpp:
+        (WTF::threadEntryPoint):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this since Database removes tasks when it is stopped.
+
+        * wtf/MessageQueue.h:
+        (WTF::::removeIf):
+
+2009-10-28  Afonso R. Costa Jr.  <afonso.costa@openbossa.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Enable YARR when YARR_JIT is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30730
+
+        When enabling or disabling JIT using JAVASCRIPTCORE_JIT, the ENABLE_YARR should
+        be toggled also.
+
+        * JavaScriptCore.pri:
+
+2009-10-24  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix strict aliasing warning by switching reinterpret_cast to bitwise_cast.
+
+        strict-aliasing warnings in JSFunction.h
+        https://bugs.webkit.org/show_bug.cgi?id=27869
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::setNativeFunction):
+
+2009-10-28  Jan-Arve Sæther <jan-arve.saether@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build-fix for 64-bit Windows
+
+        * wtf/Platform.h: Make sure to use WTF_USE_JSVALUE64
+
+2009-10-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix!).
+
+        * jit/JIT.h:
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Export fastMalloc, fastCalloc, fastRealloc and fastFree on GCC/Unix
+        https://bugs.webkit.org/show_bug.cgi?id=30769
+
+        When using -fvisibility=hidden to hide all internal symbols by default
+        the malloc symbols will be hidden as well. For memory instrumentation
+        it is needed to provide an instrumented version of these symbols and
+        override the normal routines and by changing the visibility back to
+        default this becomes possible.
+
+        The only other solution would be to use system malloc instead of the
+        TCmalloc implementation but this will not allow to analyze memory
+        behavior with the default allocator.
+
+        * wtf/FastMalloc.h: Define WTF_FAST_MALLOC_EXPORT for GCC and !darwin
+
+2009-10-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Samuel Q. Weinig.
+
+        Make the asserts protecting the offsets in the JIT more descriptive.
+
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::emit_op_put_by_id):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little bit of refactoring in the date code.
+
+        * JavaScriptCore.exp: Don't export this unused symbol.
+
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h: Removed some unused functions. Changed the default
+        constructor to ensure that a DateInstance is always initialized.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype): Pass an initializer to our constructor,
+        since it now requires one.
+
+        * wtf/DateMath.cpp:
+        (WTF::msToGregorianDateTime): Only compute our offset from UTC if our
+        output will require it. Otherwise, our offset is 0.
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Mark DateInstaceCache.h private, so other frameworks can see it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: re-readded this file.
+
+        * runtime/DateInstanceCache.h: Added.
+        (JSC::DateInstanceData::create):
+        (JSC::DateInstanceData::DateInstanceData):
+        (JSC::DateInstanceCache::DateInstanceCache):
+        (JSC::DateInstanceCache::add):
+        (JSC::DateInstanceCache::lookup):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30800
+        Cache recently computed date data.
+        
+        SunSpider reports a ~0.5% speedup, mostly from date-format-tofte.js.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added new file.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        (JSC::DateInstance::getGregorianDateTime): Use the shared cache.
+
+        * runtime/DateInstance.h: Renamed m_cache to m_data, to avoid the confusion
+        of a "cache cache".
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Pass an ExecState to these functions, so they
+        can access the DateInstanceCache.
+
+        * runtime/JSGlobalData.h: Keep a DateInstanceCache.
+
+2009-10-27  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensures that JavaScriptCore/wtf/CurrentTime.cpp is not built in PLATFORM(CHROMIUM) builds.
+
+        Chromium uses a different method to calculate the current time than is used in
+        JavaScriptCore/wtf/CurrentTime.cpp. This can lead to time skew when calls to currentTime() and Chromium's time
+        function are mixed.  In particular, timers can get scheduled in the past which leads to 100% CPU use.
+        See http://code.google.com/p/chromium/issues/detail?id=25892 for an example.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30833
+
+        * JavaScriptCore.gyp/JavaScriptCore.gyp:
+        * wtf/CurrentTime.cpp:
+
+2009-10-27  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Fix typo in RegexInterpreter.cpp and RegexJIT.cpp alterantive to
+        alternative.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::alternativeBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alternativeDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Use
+        winresrc.h because it exists even when MFC is not installed, and is
+        all that's needed here.
+
+2009-10-26  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The thunkReturnAddress is on JITStackFrame on ARM JIT as well
+        https://bugs.webkit.org/show_bug.cgi?id=30782
+
+        Move the thunkReturnAddress from top of the stack into the JITStackFrame
+        structure. This is a requirement for JSValue32_64 support on ARM.
+
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::ret): Return with link register
+        (JSC::MacroAssemblerARM::prepareCall): Store the return address in link register
+        * jit/JIT.h: Remove unused ctiReturnRegister
+        * jit/JITInlineMethods.h: Same as ARMv7
+        (JSC::JIT::restoreArgumentReference): Ditto.
+        (JSC::JIT::restoreArgumentReferenceForTrampoline): Ditto.
+        * jit/JITOpcodes.cpp: Remove ctiReturnRegister related instruction
+        * jit/JITStubs.cpp: Store thunkReturnAddress on JITStackFrame. Use
+        small trampoline functions which handle return addresses for each
+        CTI_STUB_FUNCTION.
+        * jit/JITStubs.h: Store thunkReturnAddress on JITStackFrame
+        (JSC::JITStackFrame::returnAddressSlot): Return with the address of thunkReturnAddress
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter): Remove the unnecessary instruction
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Adds ability to disable ReadWriteLock on platforms (eg Android) that use pthreads but do not support pthread_rwlock.
+        https://bugs.webkit.org/show_bug.cgi?id=30713
+
+        * wtf/Platform.h: Modified. Defines HAVE_PTHREAD_RWLOCK for all platforms currently using pthreads.
+        * wtf/Threading.h: Modified. Use pthread_rwlock_t only when HAVE_PTHREAD_RWLOCK is defined.
+        * wtf/ThreadingPthreads.cpp: Modified. Build ReadWriteLock methods only when HAVE_PTHREAD_RWLOCK is defined.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
+        to jsc.exe.
+
+        * jsc.pro:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Fixes a leak in createThreadInternal on Android.
+        https://bugs.webkit.org/show_bug.cgi?id=30698
+
+        * wtf/ThreadingPthreads.cpp: Modified.
+        (WTF::createThreadInternal): Avoid leaking a ThreadData object on failure.
+
+2009-10-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fixed ASSERT when opening Safari's Caches window while the Web Inspector
+        is open.
+
+        * runtime/Collector.cpp:
+        (JSC::typeName): Added two new types to the type name list in the Collector.
+        These types have been around for a while, but nobody remembered to consider them here.
+
+        * runtime/JSCell.h:
+        (JSC::JSCell::isPropertyNameIterator):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::isPropertyNameIterator): Give the Collector
+        a way to tell if a cell is a JSPropertyNameIterator.
+
+2009-10-22  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30686
+        Remove debug-specific def file.
+        Only Debug_All target uses JavaScriptCore_debug.dll naming, and since
+        that target is only used internally, maintaining two files just to
+        suppress a single link warning isn't worthwhile.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Removed.
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Reviewed by Dan Bernstein.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Export WTF::deleteOwnedPtr(HDC).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Ditto.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated variable name.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Slightly tweaked this #ifdef to match the
+        size of a JSValue because m_jsStrings is an array of JSValues.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed a 64-bit regression caused by the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=30570.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname): Use TimesEight stepping on 64-bit, since
+        64-bit pointers are eight bytes long.
+
+2009-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Refactored DateInstance::msToGregorianDateTime so that a DateInstance's
+        caller doesn't need to supply the DateInstance's own internal value to
+        the DateInstance.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::getGregorianDateTime): Renamed from "msToGregorianDateTime".
+
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear): Also renamed "utc" to "outputIsUTC", for clarity.
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        The op_next_pname should use 4 bytes addressing mode in case of JSValue32
+        https://bugs.webkit.org/show_bug.cgi?id=30570
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_next_pname):
+
+2009-10-20  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Move OverridesMarkChildren flag from DatePrototype to its parent class
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::createStructure):
+        * runtime/DatePrototype.h:
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Tightened up some put_by_id_transition code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30539
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::testPrototype):
+        (JSC::JIT::privateCompilePutByIdTransition): No need to do object type
+        checks or read Structures and prototypes from objects: they're all known
+        constants at compile time.
+
+2009-10-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added a private API for getting a global context from a context, for
+        clients who want to preserve a context for a later callback.
+
+        * API/APICast.h:
+        (toGlobalRef): Added an ASSERT, since this function is used more often
+        than before.
+
+        * API/JSContextRef.cpp:
+        * API/JSContextRefPrivate.h: Added. The new API.
+
+        * API/tests/testapi.c:
+        (print_callAsFunction):
+        (main): Test the new API.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Build and export the new API.
+
+2009-10-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Tightened up some instanceof code generation.
+        https://bugs.webkit.org/show_bug.cgi?id=30488
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof): No need to do object type checks - 
+        cell type checks and ImplementsDefaultHasIntance checks implicitly
+        supersede object type checks.
+
+2009-10-18  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Use _stricmp and _strnicmp instead of deprecated stricmp and strnicmp.
+        https://bugs.webkit.org/show_bug.cgi?id=30474
+
+        stricmp and strnicmp are deprecated beginning in Visual
+        C++ 2005. Use _stricmp and _strnicmp instead in StringExtras.h.
+
+        * wtf/StringExtras.h:
+        (strncasecmp):
+        (strcasecmp):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: apparently we shouldn't export those symbols?
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: export some symbols.
+
+        * JavaScriptCore.exp:
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        structure typeinfo flags should be inherited.
+        https://bugs.webkit.org/show_bug.cgi?id=30468
+
+        Add StructureFlag constant to the various JSC classes and use
+        it for the TypeInfo construction.  This allows us to simply
+        accumulate flags by basing each classes StructureInfo on its parents.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSByteArray.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast for-in enumeration: Cache JSPropertyNameIterator; cache JSStrings
+        in JSPropertyNameIterator; inline more code.
+
+        1.024x as fast on SunSpider (fasta: 1.43x as fast).
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        * bytecompiler/BytecodeGenerator.h: Added a few extra operands to
+        op_get_pnames and op_next_pname so that we can track iteration state
+        in the register file instead of in the JSPropertyNameIterator. (To be
+        cacheable, the JSPropertyNameIterator must be stateless.)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::Interpreter::privateExecute): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames): Updated for in-RegisterFile
+        iteration state tracking.
+
+        (JSC::JIT::emit_op_next_pname): Inlined code generation for op_next_pname.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID): Updated for rename to
+        "normalizePrototypeChain" and removal of "isCacheable". 
+
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::): Added has_property and to_object stubs. Removed op_next_pname
+        stub, since has_property is all we need anymore.
+
+        * parser/Nodes.cpp:
+        (JSC::ForInNode::emitBytecode): Updated for in-RegisterFile
+        iteration state tracking.
+
+        * runtime/JSCell.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames): Don't do caching at this layer
+        anymore, since we don't create a JSPropertyNameIterator at this layer.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create): Do do caching at this layer.
+        (JSC::JSPropertyNameIterator::get):  Updated for in-RegisterFile
+        iteration state tracking.
+        (JSC::JSPropertyNameIterator::markChildren): Mark our JSStrings.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::size):
+        (JSC::JSPropertyNameIterator::setCachedStructure):
+        (JSC::JSPropertyNameIterator::cachedStructure):
+        (JSC::JSPropertyNameIterator::setCachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::cachedPrototypeChain):
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::Structure::setEnumerationCache): Don't store iteration state in
+        a JSPropertyNameIterator. Do cache a JSPropertyNameIterator in a
+        Structure.
+
+        * runtime/JSValue.h:
+        (JSC::asCell):
+        * runtime/MarkStack.h: Make those mischievous #include gods happy.
+
+        * runtime/ObjectConstructor.cpp:
+
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain): Renamed countPrototypeChainEntriesAndCheckForProxies
+        to normalizePrototypeChain, since it changes dictionary prototypes to
+        non-dictionary objects.
+
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end): Simplified some code here to help with
+        current and future refactoring.
+
+        * runtime/Protect.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition): No need to clear
+        the enumeration cache with adding / removing properties without
+        transition. It is an error to add / remove properties without transition
+        once an object has been observed, and we can ASSERT to catch that.
+
+        * runtime/Structure.h:
+        (JSC::Structure::enumerationCache): Changed the enumeration cache to
+        hold a JSPropertyNameIterator.
+
+        * runtime/StructureChain.cpp:
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::head): Removed StructureChain::isCacheable because
+        it was wrong-headed in two ways: (1) It gave up when a prototype was a
+        dictionary, but instead we want un-dictionary heavily accessed
+        prototypes; (2) It folded a test for hasDefaultGetPropertyNames() into
+        a generic test for "cacheable-ness", but hasDefaultGetPropertyNames()
+        is only releavant to for-in caching.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Debug build in makefile should build Debug_All.
+        * JavaScriptCore.vcproj/JavaScriptCore.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Add Debug_All configuration.
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Add Debug_All configuration.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetPropertyNames):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, we can't use the simple hash there because the PlatformModuleVersion 
+        structure differs.
+
+        * wtf/Platform.h:
+
+2009-10-16  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement ExecutableAllocator for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=29946
+
+        Tested with YARR JIT enabled for Symbian; 
+        This patch does not (yet) enable YARR JIT by default.
+
+        * JavaScriptCore.pri:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorSymbian.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSAPIValueWrapper.h:
+        (JSC::JSAPIValueWrapper::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        (JSC::MarkStack::markChildren):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesMarkChildren):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/BooleanObject.h:
+        (JSC::BooleanObject::createStructure):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.h:
+        (JSC::GlobalEvalFunction::createStructure):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::createStructure):
+        * runtime/JSObject.h:
+        (JSC::JSObject::createStructure):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::overridesGetOwnPropertySlot):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::createStructure):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::createStructure):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::createStructure):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+2009-10-14  Darin Adler  <darin@apple.com>
+
+        Additions so fix for https://bugs.webkit.org/show_bug.cgi?id=18994
+        can build on Windows.
+
+        * wtf/MathExtras.h: Added llround and llroundf for Windows.
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Set ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH for plugins while we're still building stubs.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        from the make system into common code.
+
+        * wtf/Platform.h:
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        ARM compiler does not understand reinterpret_cast<void*>
+        https://bugs.webkit.org/show_bug.cgi?id=29034
+
+        Change reinterpret_cast<void*> to regular C style (void*) cast 
+        for the ARM RVCT compiler.
+
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr): 
+        * jit/JITOpcodes.cpp: Cast to FunctionPtr first 
+           instead of directly casting to reinterpret_cast
+        * jit/JITStubCall.h: Ditto + change the type of m_stub
+          from void* to FunctionPtr.
+        (JSC::JITStubCall::JITStubCall): 
+        (JSC::JITStubCall::call):
+        * jit/JITStubs.cpp: Ditto.
+        (JSC::DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)):
+
+2009-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Re-enable the JIT.
+
+        * wtf/Platform.h:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Support for String.trim(), String.trimLeft() and String.trimRight() methods
+        https://bugs.webkit.org/show_bug.cgi?id=26590
+
+        Implement trim, trimLeft, and trimRight
+
+        * runtime/StringPrototype.cpp:
+        (JSC::isTrimWhitespace):
+           Our normal string whitespace function does not include U+200B which
+           is needed for compatibility with mozilla's implementation of trim.
+           U+200B does not appear to be expected according to spec, however I am
+           choosing to be lax, and match mozilla behavior so have added this
+           exception.
+        (JSC::trimString):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Eliminated some legacy bytecode weirdness.
+        
+        Use vPC[x] subscripting instead of ++vPC to access instruction operands.
+        This is simpler, and often more efficient.
+
+        To support this, and to remove use of hard-coded offsets in bytecode and
+        JIT code generation and dumping, calculate jump offsets from the beginning
+        of an instruction, rather than the middle or end.
+        
+        Also, use OPCODE_LENGTH instead of hard-coded constants for the sizes of
+        opcodes.
+        
+        SunSpider reports no change in JIT mode, and a 1.01x speedup in Interpreter
+        mode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::printConditionalJump):
+        (JSC::CodeBlock::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/Label.h:
+        (JSC::Label::setLocation):
+        (JSC::Label::bind):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jnlesseq):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::emitBinaryDoubleOp):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jmp):
+        (JSC::JIT::emit_op_loop):
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emitSlow_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_loop_if_true):
+        (JSC::JIT::emitSlow_op_loop_if_true):
+        (JSC::JIT::emit_op_jfalse):
+        (JSC::JIT::emitSlow_op_jfalse):
+        (JSC::JIT::emit_op_jtrue):
+        (JSC::JIT::emitSlow_op_jtrue):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_jneq_ptr):
+        (JSC::JIT::emit_op_jsr):
+        (JSC::JIT::emit_op_next_pname):
+        (JSC::JIT::emit_op_jmp_scopes):
+
+2009-10-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Migrated some code that didn't belong out of Structure.
+        
+        SunSpider says maybe 1.03x faster.
+
+        * runtime/JSCell.h: Nixed Structure::markAggregate, and made marking of
+        a Structure's prototype the direct responsility of the object using it.
+        (Giving Structure a mark function was misleading because it implied that
+        all live structures get marked during GC, when they don't.)
+        
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::markChildren): Added code to mark prototypes stored
+        on the global object. Maybe this wasn't necessary, but now we don't have
+        to wonder.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::getOwnPropertyNames):
+        (JSC::JSObject::getEnumerableNamesFromClassInfoTable):
+        * runtime/JSObject.h:
+        (JSC::JSObject::markChildrenDirect):
+        * runtime/PropertyNameArray.h:
+        * runtime/Structure.cpp:
+        * runtime/Structure.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache): Moved property name gathering code
+        from Structure to JSObject because having a Structure iterate its JSObject
+        was a layering violation. A JSObject is implemented using a Structure; not
+        the other way around.
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the GTK release build.
+
+        * GNUmakefile.am: Include Grammar.cpp in release builds now that
+        AllInOneFile.cpp is gone.
+
+2009-10-09  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Rubber-stamped by Eric Seidel.
+
+        Add ARM JIT support for Gtk port (disabled by default)
+        https://bugs.webkit.org/show_bug.cgi?id=30228
+
+        * GNUmakefile.am:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: added a few more variable initializations.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncSearch):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: added missing #include.
+
+        * jsc.cpp:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: initialize variable whose initialization the compiler
+        can't otherwise figure out.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: updated exports.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Tiger build fix: fixed file name case.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        At long last, I pronounce the death of AllInOneFile.cpp.
+        
+        SunSpider reports a 1.01x speedup.
+
+        * AllInOneFile.cpp: Removed.
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added missing project files
+        to compilation stages.
+
+        * parser/Grammar.y:
+        * parser/Lexer.cpp:
+        * parser/Lexer.h:
+        (JSC::jscyylex):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/Collector.h:
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::operator new):
+        * runtime/JSCell.h:
+        (JSC::JSCell::operator new):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::operator new):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new):
+        * runtime/JSString.cpp:
+        * runtime/JSString.h:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructorPrivate::RegExpConstructorPrivate):
+        (JSC::RegExpConstructorPrivate::lastOvector):
+        (JSC::RegExpConstructorPrivate::tempOvector):
+        (JSC::RegExpConstructorPrivate::changeLastOvector):
+        (JSC::RegExpConstructor::performMatch):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        * yarr/RegexJIT.cpp:
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::executeRegex): Inlined a few things that Shark said
+        were hot, on the presumption that AllInOneFile.cpp used to inline them
+        automatically.
+
 2009-10-08  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
         Reviewed by Gavin Barraclough.
diff --git a/JavaScriptCore/Configurations/Base.xcconfig b/JavaScriptCore/Configurations/Base.xcconfig
index db89a7b..c338eb7 100644
--- a/JavaScriptCore/Configurations/Base.xcconfig
+++ b/JavaScriptCore/Configurations/Base.xcconfig
@@ -106,3 +106,4 @@ HAVE_DTRACE_macosx_ = $(HAVE_DTRACE_macosx_1040);
 HAVE_DTRACE_macosx_1040 = 0;
 HAVE_DTRACE_macosx_1050 = 0;
 HAVE_DTRACE_macosx_1060 = 1;
+HAVE_DTRACE_macosx_1070 = 1;
diff --git a/JavaScriptCore/Configurations/DebugRelease.xcconfig b/JavaScriptCore/Configurations/DebugRelease.xcconfig
index 3b8651c..cbb0c8b 100644
--- a/JavaScriptCore/Configurations/DebugRelease.xcconfig
+++ b/JavaScriptCore/Configurations/DebugRelease.xcconfig
@@ -31,6 +31,7 @@ ARCHS_macosx_ = $(ARCHS_macosx_1040);
 ARCHS_macosx_1040 = $(NATIVE_ARCH);
 ARCHS_macosx_1050 = $(NATIVE_ARCH);
 ARCHS_macosx_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_macosx_1070 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -39,6 +40,7 @@ MACOSX_DEPLOYMENT_TARGET_ = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
 
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index ed387aa..42aa3cf 100644
--- a/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -31,10 +31,12 @@
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
 ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1070 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
 ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
+ENABLE_3D_RENDERING_1070 = ENABLE_3D_RENDERING;
 
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
diff --git a/JavaScriptCore/Configurations/Version.xcconfig b/JavaScriptCore/Configurations/Version.xcconfig
index 66d574b..fabc009 100644
--- a/JavaScriptCore/Configurations/Version.xcconfig
+++ b/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 2;
+MINOR_VERSION = 4;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -36,6 +36,7 @@ SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_V
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
 SYSTEM_VERSION_PREFIX_1060 = 6;
+SYSTEM_VERSION_PREFIX_1070 = 7;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
diff --git a/JavaScriptCore/GNUmakefile.am b/JavaScriptCore/GNUmakefile.am
index 32e2642..5e50ba7 100644
--- a/JavaScriptCore/GNUmakefile.am
+++ b/JavaScriptCore/GNUmakefile.am
@@ -57,6 +57,7 @@ javascriptcore_sources += \
 	JavaScriptCore/API/JSClassRef.cpp \
 	JavaScriptCore/API/JSClassRef.h \
 	JavaScriptCore/API/JSContextRef.cpp \
+	JavaScriptCore/API/JSContextRefPrivate.h \
 	JavaScriptCore/API/JSObjectRef.cpp \
 	JavaScriptCore/API/JSRetainPtr.h \
 	JavaScriptCore/API/JSStringRef.cpp \
@@ -133,12 +134,17 @@ javascriptcore_sources += \
 	JavaScriptCore/icu/unicode/utf_old.h \
 	JavaScriptCore/icu/unicode/utypes.h \
 	JavaScriptCore/icu/unicode/uversion.h \
+	JavaScriptCore/assembler/ARMAssembler.h \
+	JavaScriptCore/assembler/ARMAssembler.cpp \
 	JavaScriptCore/assembler/X86Assembler.h \
 	JavaScriptCore/assembler/AbstractMacroAssembler.h \
 	JavaScriptCore/assembler/AssemblerBuffer.h \
+	JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
 	JavaScriptCore/assembler/CodeLocation.h \
 	JavaScriptCore/assembler/LinkBuffer.h \
 	JavaScriptCore/assembler/MacroAssembler.h \
+	JavaScriptCore/assembler/MacroAssemblerARM.h \
+	JavaScriptCore/assembler/MacroAssemblerARM.cpp \
 	JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
 	JavaScriptCore/assembler/MacroAssemblerX86.h \
 	JavaScriptCore/assembler/MacroAssemblerX86_64.h \
@@ -331,12 +337,6 @@ javascriptcore_sources += \
 	JavaScriptCore/yarr/RegexParser.h \
 	JavaScriptCore/yarr/RegexPattern.h
 
-# Debug build
-if ENABLE_DEBUG
-javascriptcore_built_sources += \
-	DerivedSources/Grammar.cpp \
-	DerivedSources/Grammar.h
-
 javascriptcore_sources += \
 	JavaScriptCore/interpreter/RegisterFile.cpp \
 	JavaScriptCore/interpreter/RegisterFile.h \
@@ -390,6 +390,7 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/DateConversion.h \
 	JavaScriptCore/runtime/DateInstance.cpp \
 	JavaScriptCore/runtime/DateInstance.h \
+	JavaScriptCore/runtime/DateInstanceCache.h \
 	JavaScriptCore/runtime/DatePrototype.cpp \
 	JavaScriptCore/runtime/DatePrototype.h \
 	JavaScriptCore/runtime/Error.cpp \
@@ -506,17 +507,10 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/dtoa.cpp \
 	JavaScriptCore/wtf/dtoa.h
 
-else
-javascriptcore_built_nosources += \
+javascriptcore_built_sources += \
 	DerivedSources/Grammar.cpp \
 	DerivedSources/Grammar.h
 
-javascriptcore_sources += \
-	JavaScriptCore/AllInOneFile.cpp \
-	JavaScriptCore/parser/ParserArena.cpp \
-	JavaScriptCore/parser/ParserArena.h
-endif # END ENABLE_DEBUG
-
 DerivedSources/Grammar.h: DerivedSources/Grammar.cpp;
 
 DerivedSources/Grammar.cpp: $(srcdir)/JavaScriptCore/parser/Grammar.y
diff --git a/JavaScriptCore/JavaScriptCore.exp b/JavaScriptCore/JavaScriptCore.exp
index 2934655..12c96b3 100644
--- a/JavaScriptCore/JavaScriptCore.exp
+++ b/JavaScriptCore/JavaScriptCore.exp
@@ -2,6 +2,7 @@ _JSCheckScriptSyntax
 _JSClassCreate
 _JSClassRelease
 _JSClassRetain
+_JSContextGetGlobalContext
 _JSContextGetGlobalObject
 _JSContextGetGroup
 _JSContextGroupCreate
@@ -115,6 +116,7 @@ __ZN3JSC12JSGlobalData6createEb
 __ZN3JSC12JSGlobalDataD1Ev
 __ZN3JSC12SamplingTool5setupEv
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
+__ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
 __ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
 __ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
@@ -129,7 +131,6 @@ __ZN3JSC13SamplingFlags4stopEv
 __ZN3JSC13SamplingFlags5startEv
 __ZN3JSC13SamplingFlags7s_flagsE
 __ZN3JSC13StatementNode6setLocEii
-__ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
 __ZN3JSC14JSGlobalObject10globalExecEv
 __ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
 __ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
@@ -144,8 +145,8 @@ __ZN3JSC14SamplingThread4stopEv
 __ZN3JSC14SamplingThread5startEj
 __ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
 __ZN3JSC14TimeoutChecker5resetEv
-__ZN3JSC15createTypeErrorEPNS_9ExecStateEPKc
 __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
+__ZN3JSC15createTypeErrorEPNS_9ExecStateEPKc
 __ZN3JSC15toInt32SlowCaseEdRb
 __ZN3JSC16InternalFunction4infoE
 __ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
@@ -273,7 +274,6 @@ __ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
 __ZN3JSC8Profiler8profilerEv
 __ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_7JSValueE
-__ZN3JSC8jsStringEPNS_12JSGlobalDataERKNS_7UStringE
 __ZN3JSC9CodeBlockD1Ev
 __ZN3JSC9CodeBlockD2Ev
 __ZN3JSC9MarkStack10s_pageSizeE
@@ -347,7 +347,6 @@ __ZN3WTF9ByteArray6createEm
 __ZNK3JSC10JSFunction23isHostFunctionNonInlineEv
 __ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
 __ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE  
-__ZNK3JSC12DateInstance7getTimeERdRi
 __ZNK3JSC14JSGlobalObject14isDynamicScopeEv
 __ZNK3JSC16InternalFunction9classInfoEv
 __ZNK3JSC16JSVariableObject16isVariableObjectEv
diff --git a/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp b/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
index 88fe484..cfad3cf 100644
--- a/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
+++ b/JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp
@@ -121,6 +121,7 @@
         # GLib/GTK, even though its name doesn't really indicate.
         ['exclude', '/(GOwnPtr|glib/.*)\\.(cpp|h)$'],
         ['exclude', '(Default|Gtk|Mac|None|Qt|Win|Wx)\\.(cpp|mm)$'],
+        ['exclude', 'wtf/CurrentTime\\.cpp$'],
       ],
       'direct_dependent_settings': {
         'include_dirs': [
diff --git a/JavaScriptCore/JavaScriptCore.gypi b/JavaScriptCore/JavaScriptCore.gypi
index 15a0c0f..03c23c3 100644
--- a/JavaScriptCore/JavaScriptCore.gypi
+++ b/JavaScriptCore/JavaScriptCore.gypi
@@ -1,7 +1,6 @@
 {
     'variables': {
         'javascriptcore_files': [
-            'AllInOneFile.cpp',
             'API/APICast.h',
             'API/JavaScript.h',
             'API/JavaScriptCore.h',
@@ -19,6 +18,7 @@
             'API/JSClassRef.h',
             'API/JSContextRef.cpp',
             'API/JSContextRef.h',
+            'API/JSContextRefPrivate.h',
             'API/JSObjectRef.cpp',
             'API/JSObjectRef.h',
             'API/JSProfilerPrivate.cpp',
@@ -194,6 +194,7 @@
             'runtime/DateConversion.h',
             'runtime/DateInstance.cpp',
             'runtime/DateInstance.h',
+            'runtime/DateInstanceCache.h',
             'runtime/DatePrototype.cpp',
             'runtime/DatePrototype.h',
             'runtime/Error.cpp',
diff --git a/JavaScriptCore/JavaScriptCore.pri b/JavaScriptCore/JavaScriptCore.pri
index d69bccb..eb26664 100644
--- a/JavaScriptCore/JavaScriptCore.pri
+++ b/JavaScriptCore/JavaScriptCore.pri
@@ -39,10 +39,12 @@ win32-* {
 contains(JAVASCRIPTCORE_JIT,yes) {
     DEFINES+=ENABLE_JIT=1
     DEFINES+=ENABLE_YARR_JIT=1
+    DEFINES+=ENABLE_YARR=1
 }
 contains(JAVASCRIPTCORE_JIT,no) {
     DEFINES+=ENABLE_JIT=0
     DEFINES+=ENABLE_YARR_JIT=0
+    DEFINES+=ENABLE_YARR=0
 }
 
 # In debug mode JIT disabled until crash fixed
@@ -137,7 +139,8 @@ SOURCES += \
     interpreter/RegisterFile.cpp
 
 symbian {
-    SOURCES += runtime/MarkStackSymbian.cpp
+    SOURCES += jit/ExecutableAllocatorSymbian.cpp \
+              runtime/MarkStackSymbian.cpp
 } else {
     win32-*|wince* {
         SOURCES += jit/ExecutableAllocatorWin.cpp \
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
index fbbe23e..806894a 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.make
@@ -1,7 +1,7 @@
 !IF !defined(BUILDSTYLE)
 BUILDSTYLE=Release
 !ELSEIF "$(BUILDSTYLE)"=="DEBUG"
-BUILDSTYLE=Debug_Internal
+BUILDSTYLE=Debug_All
 !ENDIF
 
 install:
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
index 32e7301..69c21bc 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore.sln
@@ -20,6 +20,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "
 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

 		Release_PGOInstrument|Win32 = Release_PGOInstrument|Win32

@@ -27,6 +28,8 @@ Global
 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -37,6 +40,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOOptimize|Win32.Build.0 = Release_PGOOptimize|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -47,6 +52,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -57,26 +64,30 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOInstrument|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOInstrument|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOOptimize|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_PGOOptimize|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = all|Win32

 	EndGlobalSection

 	GlobalSection(SolutionProperties) = preSolution

 		HideSolutionNode = FALSE

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index a580b98..01f84f1 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -11,6 +11,7 @@ EXPORTS
     ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
     ??0Mutex@WTF@@QAE@XZ
     ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V41@ABVArgList@1@@Z@Z
+    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
     ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
     ??0StringObject@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
     ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@@Z
@@ -77,6 +78,7 @@ EXPORTS
     ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
     ?createInterruptedExecutionException@JSC@@YA?AVJSValue@1@PAVJSGlobalData@1@@Z
     ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@XZ
+    ?createSingleCharacterString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@E@Z
     ?createStackOverflowError@JSC@@YA?AVJSValue@1@PAVExecState@1@@Z
     ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
     ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
@@ -94,6 +96,7 @@ EXPORTS
     ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
     ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
     ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z
+    ?deleteOwnedPtr@WTF@@YAXPAUHDC__@@@Z
     ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z
     ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
     ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@I@Z
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
index f2b0dd3..ba59bb8 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc
@@ -1,7 +1,7 @@
 // Microsoft Visual C++ generated resource script.
 //
 #include "autoversion.h"
-#include "winres.h"
+#include "winresrc.h"
 
 #ifdef _WIN32
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index c86ef7c..bf25a85 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -448,6 +448,67 @@
 				Name="VCPostBuildEventTool"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\JavaScriptCoreCommon.vsprops;.\JavaScriptCoreCF.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

@@ -604,6 +665,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\DateInstanceCache.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\DatePrototype.cpp"

 				>

 			</File>

@@ -980,11 +1045,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\PropertyDescriptor.h"

+				RelativePath="..\..\runtime\PropertyDescriptor.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\..\runtime\PropertyDescriptor.cpp"

+				RelativePath="..\..\runtime\PropertyDescriptor.h"

 				>

 			</File>

 			<File

@@ -1209,6 +1274,14 @@
 							DisableSpecificWarnings="4701"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							DisableSpecificWarnings="4701"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\Grammar.h"

@@ -1340,6 +1413,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\API\JSContextRefPrivate.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\API\JSObjectRef.cpp"

 				>

 			</File>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index ba6bbfd..682e01e 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -1,30 +1,30 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioPropertySheet
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="JavaScriptCoreCommon"
-	>
-	<Tool
-		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-		PreprocessorDefinitions="__STD_C"
-	/>
-	<Tool
-		Name="VCLinkerTool"
-		AdditionalDependencies="gdi32.lib oleaut32.lib winmm.lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib WTF$(WebKitConfigSuffix).lib"
-		OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"
-		ModuleDefinitionFile="JavaScriptCore$(WebKitDLLConfigSuffix).def"
-	/>
-	<Tool
-		Name="VCPostBuildEventTool"
-		CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\JavaScriptCore.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-	/>
-	<Tool
-		Name="VCPreBuildEventTool"
-		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-	/>
-	<Tool
-		Name="VCPreLinkEventTool"
-		CommandLine="if not exist &quot;$(WebKitOutputDir)\public\sym&quot; mkdir &quot;$(WebKitOutputDir)\public\sym&quot;"
-	/>
-</VisualStudioPropertySheet>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="JavaScriptCoreCommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../pcre/;../../parser/;../../bytecompiler/;../../jit/;../../runtime/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../wrec/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;../../../icu/include;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+		PreprocessorDefinitions="__STD_C"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="gdi32.lib oleaut32.lib winmm.lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib WTF$(WebKitConfigSuffix).lib"

+		OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

+		ModuleDefinitionFile="JavaScriptCore.def"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\JavaScriptCore.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+	/>

+	<Tool

+		Name="VCPreLinkEventTool"

+		CommandLine="if not exist &quot;$(WebKitOutputDir)\public\sym&quot; mkdir &quot;$(WebKitOutputDir)\public\sym&quot;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
index 0360c4e..7d5ca69 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.vcproj
@@ -16,7 +16,7 @@
 	</ToolFiles>

 	<Configurations>

 		<Configuration

-			Name="Release|Win32"

+			Name="all|Win32"

 			OutputDirectory="$(WebKitOutputDir)\lib"

 			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

 			ConfigurationType="0"

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
deleted file mode 100644
index b91e7b5..0000000
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def
+++ /dev/null
@@ -1,310 +0,0 @@
-LIBRARY    "JavaScriptCore_debug"
-
-EXPORTS
-    ??0Collator@WTF@@QAE@PBD@Z
-    ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
-    ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
-    ??0InternalFunction@JSC@@IAE@PAVJSGlobalData@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVIdentifier@1@@Z
-    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@@Z
-    ??0JSArray@JSC@@QAE@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVArgList@1@@Z
-    ??0JSByteArray@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@PAVByteArray@4@PBUClassInfo@1@@Z
-    ??0JSFunction@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V61@ABVArgList@1@@Z@Z
-    ??0Mutex@WTF@@QAE@XZ
-    ??0PrototypeFunction@JSC@@QAE@PAVExecState@1@HABVIdentifier@1@P6I?AVJSValue@1@0PAVJSObject@1@V41@ABVArgList@1@@Z@Z
-    ??0RefCountedLeakCounter@WTF@@QAE@PBD@Z
-    ??0StringObject@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@ABVUString@1@@Z
-    ??0Structure@JSC@@AAE@VJSValue@1@ABVTypeInfo@1@@Z
-    ??0ThreadCondition@WTF@@QAE@XZ
-    ??0UString@JSC@@QAE@PBD@Z
-    ??0UString@JSC@@QAE@PB_WH@Z
-    ??1CString@JSC@@QAE@XZ
-    ??1ClientData@JSGlobalData@JSC@@UAE@XZ
-    ??1Collator@WTF@@QAE@XZ
-    ??1Debugger@JSC@@UAE@XZ
-    ??1DropAllLocks@JSLock@JSC@@QAE@XZ
-    ??1JSGlobalData@JSC@@QAE@XZ
-    ??1JSGlobalObject@JSC@@UAE@XZ
-    ??1Mutex@WTF@@QAE@XZ
-    ??1RefCountedLeakCounter@WTF@@QAE@XZ
-    ??1Structure@JSC@@QAE@XZ
-    ??1ThreadCondition@WTF@@QAE@XZ
-    ??2JSCell@JSC@@SAPAXIPAVExecState@1@@Z
-    ??2JSGlobalObject@JSC@@SAPAXIPAVJSGlobalData@1@@Z
-    ??4UString@JSC@@QAEAAV01@PBD@Z
-    ??8JSC@@YA_NABVUString@0@0@Z
-    ?UTF8String@UString@JSC@@QBE?AVCString@2@_N@Z
-    ?add@Identifier@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PBD@Z
-    ?add@PropertyNameArray@JSC@@QAEXPAURep@UString@2@@Z
-    ?addPropertyTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyWithoutTransition@Structure@JSC@@QAEIABVIdentifier@2@IPAVJSCell@2@@Z
-    ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVExecState@2@PAURep@UString@2@@Z
-    ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PAVJSGlobalData@2@PAURep@UString@2@@Z
-    ?allocate@Heap@JSC@@QAEPAXI@Z
-    ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
-    ?allocateStack@MarkStack@JSC@@CAPAXI@Z
-    ?append@UString@JSC@@QAEAAV12@ABV12@@Z
-    ?append@UString@JSC@@QAEAAV12@PBD@Z
-    ?ascii@UString@JSC@@QBEPADXZ
-    ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
-    ?broadcast@ThreadCondition@WTF@@QAEXXZ
-    ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
-    ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
-    ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
-    ?changePrototypeTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@VJSValue@2@@Z
-    ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVExecState@2@PAURep@UString@2@@Z
-    ?checkSameIdentifierTable@Identifier@JSC@@CAXPAVJSGlobalData@2@PAURep@UString@2@@Z
-    ?checkSyntax@JSC@@YA?AVCompletion@1@PAVExecState@1@ABVSourceCode@1@@Z
-    ?classInfo@InternalFunction@JSC@@UBEPBUClassInfo@2@XZ
-    ?classInfo@JSCell@JSC@@UBEPBUClassInfo@2@XZ
-    ?className@JSObject@JSC@@UBE?AVUString@2@XZ
-    ?collate@Collator@WTF@@QBE?AW4Result@12@PB_WI0I@Z
-    ?collect@Heap@JSC@@QAE_NXZ
-    ?computeHash@Rep@UString@JSC@@SAIPBDH@Z
-    ?computeHash@Rep@UString@JSC@@SAIPB_WH@Z
-    ?configurable@PropertyDescriptor@JSC@@QBE_NXZ
-    ?construct@JSC@@YAPAVJSObject@1@PAVExecState@1@VJSValue@1@W4ConstructType@1@ABTConstructData@1@ABVArgList@1@@Z
-    ?constructArray@JSC@@YAPAVJSArray@1@PAVExecState@1@ABVArgList@1@@Z
-    ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
-    ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
-    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
-    ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
-    ?create@ByteArray@WTF@@SA?AV?$PassRefPtr@VByteArray@WTF@@@2@I@Z
-    ?create@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@_N@Z
-    ?create@OpaqueJSString@@SA?AV?$PassRefPtr@UOpaqueJSString@@@WTF@@ABVUString@JSC@@@Z
-    ?create@Rep@UString@JSC@@SA?AV?$PassRefPtr@URep@UString@JSC@@@WTF@@PA_WHV?$PassRefPtr@V?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@@5@@Z
-    ?createEmptyString@SmallStrings@JSC@@AAEXPAVJSGlobalData@2@@Z
-    ?createInheritorID@JSObject@JSC@@AAEPAVStructure@2@XZ
-    ?createInterruptedExecutionException@JSC@@YA?AVJSValue@1@PAVJSGlobalData@1@@Z
-    ?createLeaked@JSGlobalData@JSC@@SA?AV?$PassRefPtr@VJSGlobalData@JSC@@@WTF@@XZ
-    ?createStackOverflowError@JSC@@YA?AVJSValue@1@PAVExecState@1@@Z
-    ?createStructure@JSByteArray@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@VJSValue@2@@Z
-    ?createTable@HashTable@JSC@@ABEXPAVJSGlobalData@2@@Z
-    ?createThread@WTF@@YAIP6APAXPAX@Z0@Z
-    ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
-    ?createTypeError@JSC@@YA?AVJSValue@1@PAVExecState@1@PBD@Z
-    ?currentThread@WTF@@YAIXZ
-    ?currentTime@WTF@@YANXZ
-    ?decrement@RefCountedLeakCounter@WTF@@QAEXXZ
-    ?defaultAttributes@PropertyDescriptor@JSC@@0IA
-    ?defaultValue@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
-    ?defineGetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
-    ?defineGetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
-    ?defineOwnProperty@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@_N@Z
-    ?defineSetter@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAVJSObject@2@I@Z
-    ?defineSetter@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@PAV12@I@Z
-    ?deleteOwnedPtr@WTF@@YAXPAUHBITMAP__@@@Z
-    ?deleteOwnedPtr@WTF@@YAXPAUHRGN__@@@Z
-    ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
-    ?deleteProperty@JSCell@JSC@@UAE_NPAVExecState@2@I@Z
-    ?deleteProperty@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
-    ?deleteProperty@JSObject@JSC@@UAE_NPAVExecState@2@I@Z
-    ?deleteProperty@JSVariableObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
-    ?deleteProperty@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@@Z
-    ?deleteTable@HashTable@JSC@@QBEXXZ
-    ?despecifyDictionaryFunction@Structure@JSC@@QAEXABVIdentifier@2@@Z
-    ?despecifyFunctionTransition@Structure@JSC@@SA?AV?$PassRefPtr@VStructure@JSC@@@WTF@@PAV12@ABVIdentifier@2@@Z
-    ?destroy@Heap@JSC@@QAEXXZ
-    ?destroy@Rep@UString@JSC@@QAEXXZ
-    ?destroyJSGlobalObjectData@JSGlobalObject@JSC@@CAXPAX@Z
-    ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
-    ?detachThread@WTF@@YAXI@Z
-    ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
-    ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z
-    ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
-    ?equal@Identifier@JSC@@SA_NPBURep@UString@2@PBD@Z
-    ?equal@JSC@@YA_NPBURep@UString@1@0@Z
-    ?evaluate@DebuggerCallFrame@JSC@@QBE?AVJSValue@2@ABVUString@2@AAV32@@Z
-    ?evaluate@JSC@@YA?AVCompletion@1@PAVExecState@1@AAVScopeChain@1@ABVSourceCode@1@VJSValue@1@@Z
-    ?exclude@Profile@JSC@@QAEXPBVProfileNode@2@@Z
-    ?fastCalloc@WTF@@YAPAXII@Z
-    ?fastFree@WTF@@YAXPAX@Z
-    ?fastMalloc@WTF@@YAPAXI@Z
-    ?fastRealloc@WTF@@YAPAXPAXI@Z
-    ?fastZeroedMalloc@WTF@@YAPAXI@Z
-    ?fillGetterPropertySlot@JSObject@JSC@@QAEXAAVPropertySlot@2@PAVJSValue@2@@Z
-    ?focus@Profile@JSC@@QAEXPBVProfileNode@2@@Z
-    ?from@UString@JSC@@SA?AV12@H@Z
-    ?from@UString@JSC@@SA?AV12@I@Z
-    ?from@UString@JSC@@SA?AV12@N@Z
-    ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
-    ?get@Structure@JSC@@QAEIPBURep@UString@2@AAIAAPAVJSCell@2@@Z
-    ?getCallData@JSCell@JSC@@UAE?AW4CallType@2@AATCallData@2@@Z
-    ?getConstructData@JSCell@JSC@@UAE?AW4ConstructType@2@AATConstructData@2@@Z
-    ?getJSNumber@JSCell@JSC@@UAE?AVJSValue@2@XZ
-    ?getObject@JSCell@JSC@@QAEPAVJSObject@2@XZ
-    ?getOwnPropertyDescriptor@JSObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
-    ?getOwnPropertyDescriptor@JSString@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
-    ?getOwnPropertyDescriptor@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
-    ?getOwnPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getOwnPropertyNames@JSVariableObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getOwnPropertyNames@StringObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
-    ?getOwnPropertySlot@JSCell@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
-    ?getOwnPropertySlot@JSObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
-    ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
-    ?getOwnPropertySlot@JSString@JSC@@EAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
-    ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertySlot@2@@Z
-    ?getOwnPropertySlot@StringObject@JSC@@UAE_NPAVExecState@2@IAAVPropertySlot@2@@Z
-    ?getPrimitiveNumber@JSCell@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
-    ?getPrimitiveNumber@JSObject@JSC@@UAE_NPAVExecState@2@AANAAVJSValue@2@@Z
-    ?getPrimitiveNumber@JSString@JSC@@EAE_NPAVExecState@2@AANAAVJSValue@2@@Z
-    ?getPropertyAttributes@JSObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
-    ?getPropertyAttributes@JSVariableObject@JSC@@UBE_NPAVExecState@2@ABVIdentifier@2@AAI@Z
-    ?getPropertyDescriptor@JSObject@JSC@@QAE_NPAVExecState@2@ABVIdentifier@2@AAVPropertyDescriptor@2@@Z
-    ?getPropertyNames@JSObject@JSC@@UAEXPAVExecState@2@AAVPropertyNameArray@2@@Z
-    ?getSlice@ArgList@JSC@@QBEXHAAV12@@Z
-    ?getString@JSCell@JSC@@QBE?AVUString@2@XZ
-    ?getString@JSCell@JSC@@QBE_NAAVUString@2@@Z
-    ?getUInt32@JSCell@JSC@@UBE_NAAI@Z
-    ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
-    ?globalExec@JSGlobalObject@JSC@@UAEPAVExecState@2@XZ
-    ?globalObjectCount@Heap@JSC@@QAEIXZ
-    ?hasInstance@JSObject@JSC@@UAE_NPAVExecState@2@VJSValue@2@1@Z
-    ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@ABVIdentifier@2@@Z
-    ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
-    ?hasTransition@Structure@JSC@@QAE_NPAURep@UString@2@I@Z
-    ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
-    ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
-    ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z
-    ?initializeMainThread@WTF@@YAXXZ
-    ?initializeThreading@JSC@@YAXXZ
-    ?initializeThreading@WTF@@YAXXZ
-    ?is8Bit@UString@JSC@@QBE_NXZ
-    ?isAccessorDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
-    ?isBusy@Heap@JSC@@QAE_NXZ
-    ?isDataDescriptor@PropertyDescriptor@JSC@@QBE_NXZ
-    ?isDynamicScope@JSGlobalObject@JSC@@UBE_NXZ
-    ?isGetterSetter@JSCell@JSC@@UBE_NXZ
-    ?isHostFunctionNonInline@JSFunction@JSC@@ABE_NXZ
-    ?isMainThread@WTF@@YA_NXZ
-    ?isVariableObject@JSVariableObject@JSC@@UBE_NXZ
-    ?jsNumberCell@JSC@@YA?AVJSValue@1@PAVExecState@1@N@Z
-    ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
-    ?jsRegExpCompile@@YAPAUJSRegExp@@PB_WHW4JSRegExpIgnoreCaseOption@@W4JSRegExpMultilineOption@@PAIPAPBD@Z
-    ?jsRegExpExecute@@YAHPBUJSRegExp@@PB_WHHPAHH@Z
-    ?jsRegExpFree@@YAXPAUJSRegExp@@@Z
-    ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
-    ?lock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
-    ?lock@Mutex@WTF@@QAEXXZ
-    ?lockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
-    ?lookupGetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
-    ?lookupSetter@JSObject@JSC@@UAE?AVJSValue@2@PAVExecState@2@ABVIdentifier@2@@Z
-    ?markChildren@JSGlobalObject@JSC@@UAEXAAVMarkStack@2@@Z
-    ?markChildren@JSObject@JSC@@UAEXAAVMarkStack@2@@Z
-    ?markChildren@JSWrapperObject@JSC@@EAEXAAVMarkStack@2@@Z
-    ?materializePropertyMap@Structure@JSC@@AAEXXZ
-    ?name@InternalFunction@JSC@@QAEABVUString@2@PAVJSGlobalData@2@@Z
-    ?nonInlineNaN@JSC@@YANXZ
-    ?objectCount@Heap@JSC@@QAEIXZ
-    ?objectProtoFuncToString@JSC@@YI?AVJSValue@1@PAVExecState@1@PAVJSObject@1@V21@ABVArgList@1@@Z
-    ?parse@Parser@JSC@@AAEXPAVJSGlobalData@2@PAHPAVUString@2@@Z
-    ?parseDateFromNullTerminatedCharacters@WTF@@YANPBD@Z
-    ?primaryHeapBegin@Heap@JSC@@QAE?AV?$CollectorHeapIterator@$0A@@2@XZ
-    ?primaryHeapEnd@Heap@JSC@@QAE?AV?$CollectorHeapIterator@$0A@@2@XZ
-    ?profiler@Profiler@JSC@@SAPAV12@XZ
-    ?protect@Heap@JSC@@QAEXVJSValue@2@@Z
-    ?protectedGlobalObjectCount@Heap@JSC@@QAEIXZ
-    ?protectedObjectCount@Heap@JSC@@QAEIXZ
-    ?protectedObjectTypeCounts@Heap@JSC@@QAEPAV?$HashCountedSet@PBDU?$PtrHash@PBD@WTF@@U?$HashTraits@PBD@2@@WTF@@XZ
-    ?put@JSCell@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
-    ?put@JSCell@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
-    ?put@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
-    ?put@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
-    ?put@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@@Z
-    ?put@StringObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@AAVPutPropertySlot@2@@Z
-    ?putDirectFunction@JSObject@JSC@@QAEXPAVExecState@2@PAVInternalFunction@2@I@Z
-    ?putWithAttributes@JSGlobalObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
-    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I@Z
-    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@ABVIdentifier@2@VJSValue@2@I_NAAVPutPropertySlot@2@@Z
-    ?putWithAttributes@JSObject@JSC@@UAEXPAVExecState@2@IVJSValue@2@I@Z
-    ?randomNumber@WTF@@YANXZ
-    ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
-    ?recordExtraCost@Heap@JSC@@AAEXI@Z
-    ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
-    ?reset@ParserArena@JSC@@QAEXXZ
-    ?reset@TimeoutChecker@JSC@@QAEXXZ
-    ?restoreAll@Profile@JSC@@QAEXXZ
-    ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVInternalFunction@2@@Z
-    ?retrieveLastCaller@Interpreter@JSC@@QBEXPAVExecState@2@AAH1AAVUString@2@AAVJSValue@2@@Z
-    ?setAccessorDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@0I@Z
-    ?setConfigurable@PropertyDescriptor@JSC@@QAEX_N@Z
-    ?setDescriptor@PropertyDescriptor@JSC@@QAEXVJSValue@2@I@Z
-    ?setDumpsGeneratedCode@BytecodeGenerator@JSC@@SAX_N@Z
-    ?setEnumerable@PropertyDescriptor@JSC@@QAEX_N@Z
-    ?setGetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
-    ?setLength@JSArray@JSC@@QAEXI@Z
-    ?setLoc@StatementNode@JSC@@QAEXHH@Z
-    ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
-    ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
-    ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
-    ?setUndefined@PropertyDescriptor@JSC@@QAEXXZ
-    ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
-    ?setWritable@PropertyDescriptor@JSC@@QAEX_N@Z
-    ?setter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
-    ?sharedBuffer@Rep@UString@JSC@@QAEPAV?$CrossThreadRefCounted@V?$OwnFastMallocPtr@_W@WTF@@@WTF@@XZ
-    ?signal@ThreadCondition@WTF@@QAEXXZ
-    ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
-    ?startIgnoringLeaks@Structure@JSC@@SAXXZ
-    ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
-    ?startSampling@JSGlobalData@JSC@@QAEXXZ
-    ?stopIgnoringLeaks@Structure@JSC@@SAXXZ
-    ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
-    ?stopSampling@JSGlobalData@JSC@@QAEXXZ
-    ?strtod@WTF@@YANPBDPAPAD@Z
-    ?substr@UString@JSC@@QBE?AV12@HH@Z
-    ?symbolTableGet@JSVariableObject@JSC@@IAE_NABVIdentifier@2@AAVPropertyDescriptor@2@@Z
-    ?synthesizePrototype@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-    ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
-    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@@Z
-    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@ABVUString@1@@Z
-    ?throwError@JSC@@YAPAVJSObject@1@PAVExecState@1@W4ErrorType@1@PBD@Z
-    ?timedWait@ThreadCondition@WTF@@QAE_NAAVMutex@2@N@Z
-    ?tlsKeyCount@WTF@@YAAAJXZ
-    ?tlsKeys@WTF@@YAPAKXZ
-    ?toBoolean@JSCell@JSC@@UBE_NPAVExecState@2@@Z
-    ?toBoolean@JSObject@JSC@@UBE_NPAVExecState@2@@Z
-    ?toBoolean@JSString@JSC@@EBE_NPAVExecState@2@@Z
-    ?toInt32SlowCase@JSC@@YAHNAA_N@Z
-    ?toNumber@JSCell@JSC@@UBENPAVExecState@2@@Z
-    ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
-    ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
-    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
-    ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-    ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
-    ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
-    ?toStrictUInt32@UString@JSC@@QBEIPA_N@Z
-    ?toString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
-    ?toString@JSObject@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
-    ?toString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
-    ?toThisJSString@JSCell@JSC@@UAEPAVJSString@2@PAVExecState@2@@Z
-    ?toThisJSString@JSString@JSC@@EAEPAV12@PAVExecState@2@@Z
-    ?toThisObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toThisObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
-    ?toThisObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
-    ?toThisObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
-    ?toThisString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
-    ?toThisString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
-    ?toUInt32@UString@JSC@@QBEIPA_N@Z
-    ?toUInt32@UString@JSC@@QBEIPA_N_N@Z
-    ?toUInt32SlowCase@JSC@@YAINAA_N@Z
-    ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z
-    ?tryFastMalloc@WTF@@YA?AUTryMallocReturnValue@1@I@Z
-    ?tryLock@Mutex@WTF@@QAE_NXZ
-    ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
-    ?unlock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
-    ?unlock@Mutex@WTF@@QAEXXZ
-    ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
-    ?unprotect@Heap@JSC@@QAEXVJSValue@2@@Z
-    ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
-    ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
-    ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
-    ?writable@PropertyDescriptor@JSC@@QBE_NXZ
-    WTFLog
-    WTFLogVerbose
-    WTFReportArgumentAssertionFailure
-    WTFReportAssertionFailure
-    WTFReportAssertionFailureWithMessage
-    WTFReportError
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
index fe3a7ba..142e5bc 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln
@@ -20,6 +20,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "jsc", "jsc\jsc.vcproj", "{C
 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

 		Release_PGOInstrument|Win32 = Release_PGOInstrument|Win32

@@ -27,6 +28,8 @@ Global
 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -37,6 +40,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_PGOOptimize|Win32.Build.0 = Release_PGOOptimize|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -47,16 +52,20 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOInstrument|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_PGOOptimize|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = all|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug|Win32.ActiveCfg = Debug|Win32

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 6ed89e5..67c004c 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -172,6 +172,58 @@
 				Name="VCPostBuildEventTool"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="4"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\WTFCommon.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLibrarianTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index dd18269..76c1550 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -260,6 +260,67 @@
 				Name="VCPostBuildEventTool"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\jscCommon.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
index fbc4672..9581e54 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/testapi/testapi.vcproj
@@ -322,6 +322,67 @@
 				Name="VCPostBuildEventTool"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\testapiCommon.vsprops;..\JavaScriptCore\JavaScriptCoreCF.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

@@ -369,6 +430,14 @@
 					CompileAs="2"

 				/>

 			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_All|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					CompileAs="2"

+				/>

+			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\..\API\tests\testapi.js"

diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index f108b77..48cf396 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -44,11 +44,30 @@
 		0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B4D7E620F319AC800AD7E58 /* TypeTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
+		140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */; };
+		140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85E0255597D01FF60F7 /* JSFunction.cpp */; };
 		140B7D1D0DC69AF7009C42B8 /* JSActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DA818F0D99FD2000B0A4FB /* JSActivation.cpp */; };
 		140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		141211310A48794D00480255 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		141211340A48795800480255 /* minidom.c in Sources */ = {isa = PBXBuildFile; fileRef = 141211020A48780900480255 /* minidom.c */; };
 		1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1421359A0A677F4F00A8195E /* JSBase.cpp */; };
+		14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8580255597D01FF60F7 /* Debugger.cpp */; };
+		1428082D107EC0570013E7B2 /* CallData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFE0E2826230004F30D /* CallData.cpp */; };
+		1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA62DFF0E2826310004F30D /* ConstructData.cpp */; };
+		1428083A107EC0750013E7B2 /* RegisterFile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D85B0ED218E900B89619 /* RegisterFile.cpp */; };
+		14280841107EC0930013E7B2 /* RegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A87D0255597D01FF60F7 /* RegExp.cpp */; };
+		14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BD0E1706A7002C7E82 /* RegExpConstructor.cpp */; };
+		14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A87B0255597D01FF60F7 /* RegExpObject.cpp */; };
+		14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD202BF0E1706A7002C7E82 /* RegExpPrototype.cpp */; };
+		14280850107EC0D70013E7B2 /* Operations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8770255597D01FF60F7 /* Operations.cpp */; };
+		14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B80E184545000F9297 /* GetterSetter.cpp */; };
+		1428085D107EC0F80013E7B2 /* JSNumberCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B90E184580000F9297 /* JSNumberCell.cpp */; };
+		14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952320E15EB5600A898AB /* BooleanConstructor.cpp */; };
+		14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8500255597D01FF60F7 /* BooleanObject.cpp */; };
+		14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */; };
+		14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65C7A1710A8EAACB00FA37EA /* JSWrapperObject.cpp */; };
+		14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65EA4C99092AF9E20093D800 /* JSLock.cpp */; };
 		1429D77C0ED20D7300B89619 /* Interpreter.h in Headers */ = {isa = PBXBuildFile; fileRef = 1429D77B0ED20D7300B89619 /* Interpreter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1429D7D40ED2128200B89619 /* Interpreter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D7D30ED2128200B89619 /* Interpreter.cpp */; settings = {COMPILER_FLAGS = "-fno-var-tracking"; }; };
 		1429D8780ED21ACD00B89619 /* ExceptionHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1429D8770ED21ACD00B89619 /* ExceptionHelpers.cpp */; };
@@ -81,12 +100,64 @@
 		1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8900A508B100005F061 /* JSCallbackFunction.cpp */; };
 		1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440F8AD0A508D200005F061 /* JSCallbackConstructor.cpp */; };
 		1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1440FCE20A51E46B0005F061 /* JSClassRef.cpp */; };
+		14469DD7107EC79E00650446 /* dtoa.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651F6412039D5B5F0078395C /* dtoa.cpp */; };
+		14469DDE107EC7E700650446 /* Lookup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8680255597D01FF60F7 /* Lookup.cpp */; };
+		14469DDF107EC7E700650446 /* MathObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86A0255597D01FF60F7 /* MathObject.cpp */; };
+		14469DE0107EC7E700650446 /* NativeErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */; };
+		14469DE1107EC7E700650446 /* NativeErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */; };
+		14469DE2107EC7E700650446 /* NumberConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */; };
+		14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8700255597D01FF60F7 /* NumberObject.cpp */; };
+		14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C40E16D4E900A06E92 /* NumberPrototype.cpp */; };
+		14469DE5107EC7E700650446 /* ObjectConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C60E16D4E900A06E92 /* ObjectConstructor.cpp */; };
+		14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C80E16D4E900A06E92 /* ObjectPrototype.cpp */; };
+		14469DE7107EC7E700650446 /* PropertyNameArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */; };
+		14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65621E6B089E859700760F35 /* PropertySlot.cpp */; };
+		14469DE9107EC7E700650446 /* PrototypeFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC257DF10E1F53740016B6C9 /* PrototypeFunction.cpp */; };
+		14469DEA107EC7E700650446 /* ScopeChain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9374D3A8038D9D74008635CE /* ScopeChain.cpp */; };
+		14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */; };
+		14469DEC107EC7E700650446 /* StringObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C20E16EE3300B34460 /* StringObject.cpp */; };
+		14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC18C3C50E16EE3300B34460 /* StringPrototype.cpp */; };
+		14469DEE107EC7E700650446 /* UString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8850255597D01FF60F7 /* UString.cpp */; };
 		146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 146AAB370B66A94400E55F16 /* JSStringRefCF.cpp */; };
 		147B83AC0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B83AA0E6DB8C9004775A4 /* BatchedTransitionOptimizer.h */; };
 		147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */ = {isa = PBXBuildFile; fileRef = 147B84620E6DE6B1004775A4 /* PutPropertySlot.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		147F39BD107EC37600427A48 /* ArgList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF605110E203EF800B9A64D /* ArgList.cpp */; };
+		147F39BE107EC37600427A48 /* Arguments.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC257DE50E1F51C50016B6C9 /* Arguments.cpp */; };
+		147F39BF107EC37600427A48 /* ArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7952060E15E8A800A898AB /* ArrayConstructor.cpp */; };
+		147F39C0107EC37600427A48 /* ArrayPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */; };
+		147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */; };
+		147F39C2107EC37600427A48 /* Completion.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A09220ED1E09C00F1F681 /* Completion.cpp */; };
+		147F39C3107EC37600427A48 /* DateConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD203450E17135E002C7E82 /* DateConstructor.cpp */; };
+		147F39C4107EC37600427A48 /* DateConversion.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D21202280AD4310C00ED79B6 /* DateConversion.cpp */; };
+		147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC1166000E1997B1008066DD /* DateInstance.cpp */; };
+		147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD203470E17135E002C7E82 /* DatePrototype.cpp */; };
+		147F39C7107EC37600427A48 /* Error.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC337BEA0E1B00CB0076918A /* Error.cpp */; };
+		147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9040E1839DB000F9297 /* ErrorConstructor.cpp */; };
+		147F39C9107EC37600427A48 /* ErrorInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E98A0E183E38000F9297 /* ErrorInstance.cpp */; };
+		147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9060E1839DB000F9297 /* ErrorPrototype.cpp */; };
+		147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2680C00E16D4E900A06E92 /* FunctionConstructor.cpp */; };
+		147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A85C0255597D01FF60F7 /* FunctionPrototype.cpp */; };
+		147F39CD107EC37600427A48 /* GlobalEvalFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC257DED0E1F52ED0016B6C9 /* GlobalEvalFunction.cpp */; };
+		147F39CE107EC37600427A48 /* Identifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 933A349D038AE80F008635CE /* Identifier.cpp */; };
+		147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */; };
+		147F39D0107EC37600427A48 /* JSArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93ADFCE60CCBD7AC00D30B08 /* JSArray.cpp */; };
+		147F39D1107EC37600427A48 /* JSCell.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */; };
+		147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */; };
+		147F39D3107EC37600427A48 /* JSImmediate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14760863099C633800437128 /* JSImmediate.cpp */; };
+		147F39D4107EC37600427A48 /* JSObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A3980E16E14800AF21C8 /* JSObject.cpp */; };
+		147F39D5107EC37600427A48 /* JSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B60E1842FA000F9297 /* JSString.cpp */; };
+		147F39D6107EC37600427A48 /* JSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8870255597D01FF60F7 /* JSValue.cpp */; };
+		147F39D7107EC37600427A48 /* JSVariableObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */; };
 		1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B74C0A43032800517CFC /* JSStringRef.cpp */; };
 		1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B7E20A43076000517CFC /* JSObjectRef.cpp */; };
+		148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		148F21A3107EC5310042EC2C /* Grammar.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FB3F4809D11B2400F49DEB /* Grammar.cpp */; };
+		148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */; };
+		148F21B0107EC5410042EC2C /* Lexer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8650255597D01FF60F7 /* Lexer.cpp */; };
+		148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86D0255597D01FF60F7 /* Nodes.cpp */; };
+		148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F0B3A909BB4DC00068FCE3 /* Parser.cpp */; };
 		149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */; };
+		14A1563210966365006FA260 /* DateInstanceCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A1563010966365006FA260 /* DateInstanceCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14A23D750F4E1ABB0023CDAD /* JITStubs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */; };
 		14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14A42E3D0F4F60EE00599099 /* TimeoutChecker.cpp */; };
 		14A42E400F4F60EE00599099 /* TimeoutChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A42E3E0F4F60EE00599099 /* TimeoutChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -96,7 +167,11 @@
 		14BD5A300A3E91F600BAF59C /* JSContextRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A290A3E91F600BAF59C /* JSContextRef.cpp */; };
 		14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14BD5A2B0A3E91F600BAF59C /* JSValueRef.cpp */; };
 		14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */ = {isa = PBXBuildFile; fileRef = 14A6581A0F4E36F4000150FD /* JITStubs.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */; };
 		14F3488F0E95EF8A003648BC /* CollectorHeapIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 14F3488E0E95EF8A003648BC /* CollectorHeapIterator.h */; settings = {ATTRIBUTES = (); }; };
+		14F8BA3E107EC886009892DC /* FastMalloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B908E7EECC0023E5F6 /* FastMalloc.cpp */; };
+		14F8BA43107EC88C009892DC /* TCSystemAlloc.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6541BD7008E80A17002CBEE7 /* TCSystemAlloc.cpp */; };
+		14F8BA4F107EC899009892DC /* Collector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8520255597D01FF60F7 /* Collector.cpp */; };
 		180B9B080F16D94F009BDBC5 /* CurrentTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 180B9AF00F16C569009BDBC5 /* CurrentTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 180B9AEF0F16C569009BDBC5 /* CurrentTime.cpp */; };
 		1C61516C0EBAC7A00031376F /* ProfilerServer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1C61516A0EBAC7A00031376F /* ProfilerServer.mm */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
@@ -112,7 +187,6 @@
 		5D6A566B0F05995500266145 /* Threading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D6A566A0F05995500266145 /* Threading.cpp */; };
 		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (); }; };
 		6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		659126BD0BDD1728001921FB /* AllInOneFile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 659126BC0BDD1728001921FB /* AllInOneFile.cpp */; };
 		65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DFC92D08EA173A00F7300B /* HashTable.cpp */; };
 		65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65E217B808E7EECC0023E5F6 /* Assertions.cpp */; settings = {COMPILER_FLAGS = "-Wno-missing-format-attribute"; }; };
 		7E2ADD8E0E79AAD500D50C51 /* CharacterClassConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E2ADD8D0E79AAD500D50C51 /* CharacterClassConstructor.h */; };
@@ -356,8 +430,8 @@
 		BC18C5260E16FCA700B34460 /* StringPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5250E16FCA700B34460 /* StringPrototype.lut.h */; };
 		BC18C52A0E16FCC200B34460 /* MathObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5290E16FCC200B34460 /* MathObject.lut.h */; };
 		BC18C52C0E16FCD200B34460 /* RegExpObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52B0E16FCD200B34460 /* RegExpObject.lut.h */; };
-		BC18C52E0E16FCE100B34460 /* lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* lexer.lut.h */; };
-		BC18C5300E16FCEB00B34460 /* grammar.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52F0E16FCEB00B34460 /* grammar.h */; };
+		BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
+		BC18C5300E16FCEB00B34460 /* Grammar.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52F0E16FCEB00B34460 /* Grammar.h */; };
 		BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DE60E1F51C50016B6C9 /* Arguments.h */; };
 		BC257DF00E1F52ED0016B6C9 /* GlobalEvalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DEE0E1F52ED0016B6C9 /* GlobalEvalFunction.h */; };
 		BC257DF40E1F53740016B6C9 /* PrototypeFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DF20E1F53740016B6C9 /* PrototypeFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -539,8 +613,10 @@
 		1483B589099BC1950016E4F0 /* JSImmediate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSImmediate.h; sourceTree = "<group>"; };
 		148A1626095D16BB00666D0D /* ListRefPtr.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ListRefPtr.h; sourceTree = "<group>"; };
 		148A1ECD0D10C23B0069A47C /* RefPtrHashMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RefPtrHashMap.h; sourceTree = "<group>"; };
+		148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSContextRefPrivate.h; sourceTree = "<group>"; };
 		149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerCallFrame.cpp; sourceTree = "<group>"; };
 		149B24FF0D8AF6D1009CB8C7 /* Register.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Register.h; sourceTree = "<group>"; };
+		14A1563010966365006FA260 /* DateInstanceCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateInstanceCache.h; sourceTree = "<group>"; };
 		14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubs.cpp; sourceTree = "<group>"; };
 		14A396A60CD2933100B5B4FF /* SymbolTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SymbolTable.h; sourceTree = "<group>"; };
 		14A42E3D0F4F60EE00599099 /* TimeoutChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TimeoutChecker.cpp; sourceTree = "<group>"; };
@@ -608,7 +684,6 @@
 		657EB7450B708F540063461B /* ListHashSet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ListHashSet.h; sourceTree = "<group>"; };
 		657EEBBF094E445E008C9C7B /* HashCountedSet.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HashCountedSet.h; sourceTree = "<group>"; tabWidth = 8; };
 		6580F795094070560082C219 /* PassRefPtr.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = PassRefPtr.h; sourceTree = "<group>"; tabWidth = 8; };
-		659126BC0BDD1728001921FB /* AllInOneFile.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = AllInOneFile.cpp; sourceTree = "<group>"; };
 		6592C316098B7DE10003D4F6 /* Vector.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Vector.h; sourceTree = "<group>"; };
 		6592C317098B7DE10003D4F6 /* VectorTraits.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = VectorTraits.h; sourceTree = "<group>"; };
 		65B174BE09D1000200820339 /* chartables.c */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.c; fileEncoding = 30; path = chartables.c; sourceTree = "<group>"; };
@@ -633,7 +708,7 @@
 		65EA4C9A092AF9E20093D800 /* JSLock.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSLock.h; sourceTree = "<group>"; tabWidth = 8; };
 		65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CommonIdentifiers.cpp; sourceTree = "<group>"; };
 		65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CommonIdentifiers.h; sourceTree = "<group>"; };
-		65FB3F4809D11B2400F49DEB /* grammar.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = grammar.cpp; sourceTree = "<group>"; };
+		65FB3F4809D11B2400F49DEB /* Grammar.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Grammar.cpp; sourceTree = "<group>"; };
 		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
 		7E2ADD8D0E79AAD500D50C51 /* CharacterClassConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CharacterClassConstructor.h; sourceTree = "<group>"; };
 		7E2ADD8F0E79AC1100D50C51 /* CharacterClassConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CharacterClassConstructor.cpp; sourceTree = "<group>"; };
@@ -804,8 +879,8 @@
 		BC18C5250E16FCA700B34460 /* StringPrototype.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringPrototype.lut.h; sourceTree = "<group>"; };
 		BC18C5290E16FCC200B34460 /* MathObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathObject.lut.h; sourceTree = "<group>"; };
 		BC18C52B0E16FCD200B34460 /* RegExpObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpObject.lut.h; sourceTree = "<group>"; };
-		BC18C52D0E16FCE100B34460 /* lexer.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = lexer.lut.h; sourceTree = "<group>"; };
-		BC18C52F0E16FCEB00B34460 /* grammar.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = grammar.h; sourceTree = "<group>"; };
+		BC18C52D0E16FCE100B34460 /* Lexer.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Lexer.lut.h; sourceTree = "<group>"; };
+		BC18C52F0E16FCEB00B34460 /* Grammar.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Grammar.h; sourceTree = "<group>"; };
 		BC22A3980E16E14800AF21C8 /* JSObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObject.cpp; sourceTree = "<group>"; };
 		BC22A3990E16E14800AF21C8 /* JSObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObject.h; sourceTree = "<group>"; };
 		BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSVariableObject.cpp; sourceTree = "<group>"; };
@@ -1001,7 +1076,6 @@
 				F692A8540255597D01FF60F7 /* create_hash_table */,
 				14B8ECA60A5653980062BE54 /* JavaScriptCore.exp */,
 				F5C290E60284F98E018635CA /* JavaScriptCorePrefix.h */,
-				659126BC0BDD1728001921FB /* AllInOneFile.cpp */,
 				45E12D8806A49B0F00E9DF84 /* jsc.cpp */,
 				F68EBB8C0255D4C601FF60F7 /* config.h */,
 				1432EBD70A34CAD400717B9F /* API */,
@@ -1115,6 +1189,7 @@
 				1440FCE10A51E46B0005F061 /* JSClassRef.h */,
 				14BD5A290A3E91F600BAF59C /* JSContextRef.cpp */,
 				14BD5A2A0A3E91F600BAF59C /* JSContextRef.h */,
+				148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */,
 				1482B7E20A43076000517CFC /* JSObjectRef.cpp */,
 				1482B7E10A43076000517CFC /* JSObjectRef.h */,
 				95988BA90E477BEC00D28D4D /* JSProfilerPrivate.cpp */,
@@ -1186,10 +1261,10 @@
 				BC18C5230E16FC8A00B34460 /* ArrayPrototype.lut.h */,
 				65B174BE09D1000200820339 /* chartables.c */,
 				BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */,
-				65FB3F4809D11B2400F49DEB /* grammar.cpp */,
-				BC18C52F0E16FCEB00B34460 /* grammar.h */,
+				65FB3F4809D11B2400F49DEB /* Grammar.cpp */,
+				BC18C52F0E16FCEB00B34460 /* Grammar.h */,
 				BC87CDB810712ACA000614CF /* JSONObject.lut.h */,
-				BC18C52D0E16FCE100B34460 /* lexer.lut.h */,
+				BC18C52D0E16FCE100B34460 /* Lexer.lut.h */,
 				BC18C5290E16FCC200B34460 /* MathObject.lut.h */,
 				BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */,
 				BCD202D50E170708002C7E82 /* RegExpConstructor.lut.h */,
@@ -1343,7 +1418,6 @@
 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
 			isa = PBXGroup;
 			children = (
-				A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */,
 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
 				BCF605120E203EF800B9A64D /* ArgList.h */,
 				BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
@@ -1377,6 +1451,7 @@
 				D21202290AD4310C00ED79B6 /* DateConversion.h */,
 				BC1166000E1997B1008066DD /* DateInstance.cpp */,
 				BC1166010E1997B1008066DD /* DateInstance.h */,
+				14A1563010966365006FA260 /* DateInstanceCache.h */,
 				BCD203470E17135E002C7E82 /* DatePrototype.cpp */,
 				BCD203480E17135E002C7E82 /* DatePrototype.h */,
 				BC337BEA0E1B00CB0076918A /* Error.cpp */,
@@ -1440,6 +1515,7 @@
 				BC02E9B60E1842FA000F9297 /* JSString.cpp */,
 				F692A8620255597D01FF60F7 /* JSString.h */,
 				14ABB454099C2A0F00E2A24F /* JSType.h */,
+				6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
 				F692A8870255597D01FF60F7 /* JSValue.cpp */,
 				14ABB36E099C076400E2A24F /* JSValue.h */,
 				BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
@@ -1450,6 +1526,9 @@
 				A7E2EA690FB460CF00601F06 /* LiteralParser.h */,
 				F692A8680255597D01FF60F7 /* Lookup.cpp */,
 				F692A8690255597D01FF60F7 /* Lookup.h */,
+				A74B3498102A5F8E0032AB98 /* MarkStack.cpp */,
+				A779558F101A74D500114E55 /* MarkStack.h */,
+				A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */,
 				F692A86A0255597D01FF60F7 /* MathObject.cpp */,
 				F692A86B0255597D01FF60F7 /* MathObject.h */,
 				BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */,
@@ -1470,6 +1549,8 @@
 				BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */,
 				F692A8770255597D01FF60F7 /* Operations.cpp */,
 				F692A8780255597D01FF60F7 /* Operations.h */,
+				A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */,
+				A7FB604B103F5EAB0017A286 /* PropertyDescriptor.h */,
 				BC95437C0EBA70FD0072B6D3 /* PropertyMapHashTable.h */,
 				65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */,
 				65400C100A69BAF200509887 /* PropertyNameArray.h */,
@@ -1510,13 +1591,8 @@
 				14A42E3E0F4F60EE00599099 /* TimeoutChecker.h */,
 				5D53726D0E1C546B0021E549 /* Tracing.d */,
 				5D53726E0E1C54880021E549 /* Tracing.h */,
-				6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
 				F692A8850255597D01FF60F7 /* UString.cpp */,
 				F692A8860255597D01FF60F7 /* UString.h */,
-				A779558F101A74D500114E55 /* MarkStack.h */,
-				A7C530E3102A3813005BC741 /* MarkStackPosix.cpp */,
-				A74B3498102A5F8E0032AB98 /* MarkStack.cpp */,
-				A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */,
 			);
 			path = runtime;
 			sourceTree = "<group>";
@@ -1734,7 +1810,7 @@
 				BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */,
 				BC18C4060E16F5CD00B34460 /* GetPtr.h in Headers */,
 				BC257DF00E1F52ED0016B6C9 /* GlobalEvalFunction.h in Headers */,
-				BC18C5300E16FCEB00B34460 /* grammar.h in Headers */,
+				BC18C5300E16FCEB00B34460 /* Grammar.h in Headers */,
 				BC18C4080E16F5CD00B34460 /* HashCountedSet.h in Headers */,
 				BC18C4090E16F5CD00B34460 /* HashFunctions.h in Headers */,
 				BC18C40A0E16F5CD00B34460 /* HashIterators.h in Headers */,
@@ -1792,7 +1868,7 @@
 				969A072A0ED1CE6900F1F681 /* Label.h in Headers */,
 				960097A60EBABB58007A7297 /* LabelScope.h in Headers */,
 				BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */,
-				BC18C52E0E16FCE100B34460 /* lexer.lut.h in Headers */,
+				BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
 				86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */,
 				BC18C4340E16F5CD00B34460 /* ListHashSet.h in Headers */,
 				BC18C4350E16F5CD00B34460 /* ListRefPtr.h in Headers */,
@@ -1924,6 +2000,8 @@
 				142D3939103E4560007DCB52 /* NumericStrings.h in Headers */,
 				A7FB61001040C38B0017A286 /* PropertyDescriptor.h in Headers */,
 				BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */,
+				148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
+				14A1563210966365006FA260 /* DateInstanceCache.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2210,26 +2288,57 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				659126BD0BDD1728001921FB /* AllInOneFile.cpp in Sources */,
+				147F39BD107EC37600427A48 /* ArgList.cpp in Sources */,
+				147F39BE107EC37600427A48 /* Arguments.cpp in Sources */,
 				86D3B2C310156BDE002865E7 /* ARMAssembler.cpp in Sources */,
+				147F39BF107EC37600427A48 /* ArrayConstructor.cpp in Sources */,
+				147F39C0107EC37600427A48 /* ArrayPrototype.cpp in Sources */,
 				65FDE49C0BDD1D4A00E80111 /* Assertions.cpp in Sources */,
+				14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */,
+				14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */,
+				14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */,
 				A7A1F7AC0F252B3C00E184E2 /* ByteArray.cpp in Sources */,
+				148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */,
+				1428082D107EC0570013E7B2 /* CallData.cpp in Sources */,
 				1429D8DD0ED2205B00B89619 /* CallFrame.cpp in Sources */,
 				1429D9C40ED23C3900B89619 /* CharacterClass.cpp in Sources */,
 				7E2ADD900E79AC1100D50C51 /* CharacterClassConstructor.cpp in Sources */,
 				969A07960ED1D3AE00F1F681 /* CodeBlock.cpp in Sources */,
 				E1A862D60D7F2B5C001EC6AA /* CollatorDefault.cpp in Sources */,
 				E1A862A90D7EBB76001EC6AA /* CollatorICU.cpp in Sources */,
+				14F8BA4F107EC899009892DC /* Collector.cpp in Sources */,
+				147F39C1107EC37600427A48 /* CommonIdentifiers.cpp in Sources */,
+				147F39C2107EC37600427A48 /* Completion.cpp in Sources */,
+				1428082E107EC0570013E7B2 /* ConstructData.cpp in Sources */,
 				180B9BFE0F16E94D009BDBC5 /* CurrentTime.cpp in Sources */,
+				147F39C3107EC37600427A48 /* DateConstructor.cpp in Sources */,
+				147F39C4107EC37600427A48 /* DateConversion.cpp in Sources */,
+				147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */,
 				41359CF60FDD89CB00206180 /* DateMath.cpp in Sources */,
+				147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */,
+				14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */,
 				BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
 				149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
+				14469DD7107EC79E00650446 /* dtoa.cpp in Sources */,
+				147F39C7107EC37600427A48 /* Error.cpp in Sources */,
+				147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */,
+				147F39C9107EC37600427A48 /* ErrorInstance.cpp in Sources */,
+				147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */,
 				1429D8780ED21ACD00B89619 /* ExceptionHelpers.cpp in Sources */,
+				86CA032E1038E8440028A609 /* Executable.cpp in Sources */,
 				A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */,
 				86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */,
 				A782F1A50EEC9FA20036273F /* ExecutableAllocatorPosix.cpp in Sources */,
+				14F8BA3E107EC886009892DC /* FastMalloc.cpp in Sources */,
+				147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */,
+				147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */,
+				14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */,
+				147F39CD107EC37600427A48 /* GlobalEvalFunction.cpp in Sources */,
+				148F21A3107EC5310042EC2C /* Grammar.cpp in Sources */,
 				65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */,
+				147F39CE107EC37600427A48 /* Identifier.cpp in Sources */,
 				E178636D0D9BEEC300D74E75 /* InitializeThreading.cpp in Sources */,
+				147F39CF107EC37600427A48 /* InternalFunction.cpp in Sources */,
 				1429D7D40ED2128200B89619 /* Interpreter.cpp in Sources */,
 				1429D92F0ED22D7000B89619 /* JIT.cpp in Sources */,
 				86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */,
@@ -2238,28 +2347,58 @@
 				86CC85C40EE7A89400288682 /* JITPropertyAccess.cpp in Sources */,
 				14A23D750F4E1ABB0023CDAD /* JITStubs.cpp in Sources */,
 				140B7D1D0DC69AF7009C42B8 /* JSActivation.cpp in Sources */,
+				140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */,
+				147F39D0107EC37600427A48 /* JSArray.cpp in Sources */,
 				1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */,
 				A791EF290F11E07900AE1F68 /* JSByteArray.cpp in Sources */,
 				1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */,
 				1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */,
 				14ABDF600A437FEF00ECCA01 /* JSCallbackObject.cpp in Sources */,
+				147F39D1107EC37600427A48 /* JSCell.cpp in Sources */,
 				1440FCE40A51E46B0005F061 /* JSClassRef.cpp in Sources */,
 				14BD5A300A3E91F600BAF59C /* JSContextRef.cpp in Sources */,
+				140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */,
 				E18E3A590DF9278C00D90B34 /* JSGlobalData.cpp in Sources */,
+				147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
+				14E9D17B107EC469004DDA21 /* JSGlobalObjectFunctions.cpp in Sources */,
+				147F39D3107EC37600427A48 /* JSImmediate.cpp in Sources */,
+				14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
 				A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */,
+				1428085D107EC0F80013E7B2 /* JSNumberCell.cpp in Sources */,
+				147F39D4107EC37600427A48 /* JSObject.cpp in Sources */,
 				1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */,
 				A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */,
 				95F6E6950E5B5F970091E860 /* JSProfilerPrivate.cpp in Sources */,
 				A727FF6B0DA3092200E548D7 /* JSPropertyNameIterator.cpp in Sources */,
+				140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */,
+				147F39D5107EC37600427A48 /* JSString.cpp in Sources */,
 				1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */,
 				146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */,
+				147F39D6107EC37600427A48 /* JSValue.cpp in Sources */,
 				14BD5A320A3E91F600BAF59C /* JSValueRef.cpp in Sources */,
+				147F39D7107EC37600427A48 /* JSVariableObject.cpp in Sources */,
+				14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */,
 				BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */,
+				148F21B0107EC5410042EC2C /* Lexer.cpp in Sources */,
 				A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */,
+				14469DDE107EC7E700650446 /* Lookup.cpp in Sources */,
 				06D358B30DAADAA4003B174E /* MainThread.cpp in Sources */,
 				06D358B40DAADAAA003B174E /* MainThreadMac.mm in Sources */,
+				A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */,
+				A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */,
+				14469DDF107EC7E700650446 /* MathObject.cpp in Sources */,
+				14469DE0107EC7E700650446 /* NativeErrorConstructor.cpp in Sources */,
+				14469DE1107EC7E700650446 /* NativeErrorPrototype.cpp in Sources */,
+				148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */,
+				14469DE2107EC7E700650446 /* NumberConstructor.cpp in Sources */,
+				14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */,
+				14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */,
+				14469DE5107EC7E700650446 /* ObjectConstructor.cpp in Sources */,
+				14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */,
 				E124A8F80E555775003091F1 /* OpaqueJSString.cpp in Sources */,
 				969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */,
+				14280850107EC0D70013E7B2 /* Operations.cpp in Sources */,
+				148F21BC107EC54D0042EC2C /* Parser.cpp in Sources */,
 				93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */,
 				930754C108B0F68000AB3056 /* pcre_compile.cpp in Sources */,
 				930754EB08B0F78500AB3056 /* pcre_exec.cpp in Sources */,
@@ -2271,29 +2410,40 @@
 				95AB83560DA43C3000BC83F3 /* ProfileNode.cpp in Sources */,
 				95AB83420DA4322500BC83F3 /* Profiler.cpp in Sources */,
 				1C61516C0EBAC7A00031376F /* ProfilerServer.mm in Sources */,
+				A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */,
+				14469DE7107EC7E700650446 /* PropertyNameArray.cpp in Sources */,
+				14469DE8107EC7E700650446 /* PropertySlot.cpp in Sources */,
+				14469DE9107EC7E700650446 /* PrototypeFunction.cpp in Sources */,
 				088FA5BB0EF76D4300578E6F /* RandomNumber.cpp in Sources */,
 				905B02AE0E28640F006DF882 /* RefCountedLeakCounter.cpp in Sources */,
 				86EAC4950F93E8D1008EC948 /* RegexCompiler.cpp in Sources */,
 				86EAC4970F93E8D1008EC948 /* RegexInterpreter.cpp in Sources */,
 				86EAC4990F93E8D1008EC948 /* RegexJIT.cpp in Sources */,
+				14280841107EC0930013E7B2 /* RegExp.cpp in Sources */,
+				14280842107EC0930013E7B2 /* RegExpConstructor.cpp in Sources */,
+				14280843107EC0930013E7B2 /* RegExpObject.cpp in Sources */,
+				14280844107EC0930013E7B2 /* RegExpPrototype.cpp in Sources */,
+				1428083A107EC0750013E7B2 /* RegisterFile.cpp in Sources */,
 				1429D8850ED21C3D00B89619 /* SamplingTool.cpp in Sources */,
+				14469DEA107EC7E700650446 /* ScopeChain.cpp in Sources */,
 				9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
+				14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */,
+				14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
+				14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
 				BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */,
 				7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */,
 				BCCF0D0C0EF0B8A500413C8F /* StructureStubInfo.cpp in Sources */,
+				14F8BA43107EC88C009892DC /* TCSystemAlloc.cpp in Sources */,
 				5D6A566B0F05995500266145 /* Threading.cpp in Sources */,
 				E1EE793D0D6C9B9200FEA3BA /* ThreadingPthreads.cpp in Sources */,
 				14A42E3F0F4F60EE00599099 /* TimeoutChecker.cpp in Sources */,
 				0B330C270F38C62300692DE3 /* TypeTraits.cpp in Sources */,
+				14469DEE107EC7E700650446 /* UString.cpp in Sources */,
 				E1EF79AA0CE97BA60088D500 /* UTF8.cpp in Sources */,
 				869083150E6518D7000D36ED /* WREC.cpp in Sources */,
 				1429DA820ED2482900B89619 /* WRECFunctors.cpp in Sources */,
 				1429DAE10ED2645B00B89619 /* WRECGenerator.cpp in Sources */,
 				1429DAC00ED263E700B89619 /* WRECParser.cpp in Sources */,
-				A7C530E4102A3813005BC741 /* MarkStackPosix.cpp in Sources */,
-				A74B3499102A5F8E0032AB98 /* MarkStack.cpp in Sources */,
-				86CA032E1038E8440028A609 /* Executable.cpp in Sources */,
-				A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.h b/JavaScriptCore/assembler/ARMv7Assembler.h
index 078de44..02ce2e9 100644
--- a/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -407,6 +407,11 @@ register writeback
 
 class ARMv7Assembler {
 public:
+    ~ARMv7Assembler()
+    {
+        ASSERT(m_jumpsToLink.isEmpty());
+    }
+
     typedef ARMRegisters::RegisterID RegisterID;
     typedef ARMRegisters::FPRegisterID FPRegisterID;
 
@@ -477,6 +482,17 @@ public:
 
 private:
 
+    struct LinkRecord {
+        LinkRecord(intptr_t from, intptr_t to)
+            : from(from)
+            , to(to)
+        {
+        }
+
+        intptr_t from;
+        intptr_t to;
+    };
+
     // ARMv7, Appx-A.6.3
     bool BadReg(RegisterID reg)
     {
@@ -574,6 +590,7 @@ private:
         OP_SUB_SP_imm_T1    = 0xB080,
         OP_BKPT             = 0xBE00,
         OP_IT               = 0xBF00,
+        OP_NOP_T1           = 0xBF00,
     } OpcodeID;
 
     typedef enum {
@@ -608,6 +625,7 @@ private:
         OP_MOV_imm_T3   = 0xF240,
         OP_SUB_imm_T4   = 0xF2A0,
         OP_MOVT         = 0xF2C0,
+        OP_NOP_T2a      = 0xF3AF,
         OP_LDRH_reg_T2  = 0xF830,
         OP_LDRH_imm_T3  = 0xF830,
         OP_STR_imm_T4   = 0xF840,
@@ -626,6 +644,7 @@ private:
 
     typedef enum {
         OP_B_T4b        = 0x9000,
+        OP_NOP_T2b      = 0x8000,
     } OpcodeID2;
 
     struct FourFours {
@@ -1481,6 +1500,15 @@ public:
     void* executableCopy(ExecutablePool* allocator)
     {
         void* copy = m_formatter.executableCopy(allocator);
+
+        unsigned jumpCount = m_jumpsToLink.size();
+        for (unsigned i = 0; i < jumpCount; ++i) {
+            uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(copy) + m_jumpsToLink[i].from);
+            uint16_t* target = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(copy) + m_jumpsToLink[i].to);
+            linkJumpAbsolute(location, target);
+        }
+        m_jumpsToLink.clear();
+
         ASSERT(copy);
         return copy;
     }
@@ -1503,11 +1531,7 @@ public:
     {
         ASSERT(to.m_offset != -1);
         ASSERT(from.m_offset != -1);
-
-        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(m_formatter.data()) + from.m_offset);
-        intptr_t relative = to.m_offset - from.m_offset;
-
-        linkWithOffset(location, relative);
+        m_jumpsToLink.append(LinkRecord(from.m_offset, to.m_offset));
     }
 
     static void linkJump(void* code, JmpSrc from, void* to)
@@ -1515,9 +1539,7 @@ public:
         ASSERT(from.m_offset != -1);
         
         uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
-        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(location);
-
-        linkWithOffset(location, relative);
+        linkJumpAbsolute(location, to);
     }
 
     // bah, this mathod should really be static, since it is used by the LinkBuffer.
@@ -1541,10 +1563,9 @@ public:
         ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
         ASSERT(!(reinterpret_cast<intptr_t>(to) & 1));
 
-        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
-        linkWithOffset(reinterpret_cast<uint16_t*>(from), relative);
+        linkJumpAbsolute(reinterpret_cast<uint16_t*>(from), to);
 
-        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(from) - 2, 2 * sizeof(uint16_t));
+        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(from) - 5, 5 * sizeof(uint16_t));
     }
     
     static void relinkCall(void* from, void* to)
@@ -1613,14 +1634,14 @@ private:
     static void setInt32(void* code, uint32_t value)
     {
         uint16_t* location = reinterpret_cast<uint16_t*>(code);
+        ASSERT(isMOV_imm_T3(location - 4) && isMOVT(location - 2));
 
-        uint16_t lo16 = value;
-        uint16_t hi16 = value >> 16;
-
-        spliceHi5(location - 4, lo16);
-        spliceLo11(location - 3, lo16);
-        spliceHi5(location - 2, hi16);
-        spliceLo11(location - 1, hi16);
+        ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(value));
+        ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(value >> 16));
+        location[-4] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+        location[-3] = twoWordOp5i6Imm4Reg4EncodedImmSecond((location[-3] >> 8) & 0xf, lo16);
+        location[-2] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+        location[-1] = twoWordOp5i6Imm4Reg4EncodedImmSecond((location[-1] >> 8) & 0xf, hi16);
 
         ExecutableAllocator::cacheFlush(location - 4, 4 * sizeof(uint16_t));
     }
@@ -1630,41 +1651,89 @@ private:
         setInt32(code, reinterpret_cast<uint32_t>(value));
     }
 
-    // Linking & patching:
-    // This method assumes that the JmpSrc being linked is a T4 b instruction.
-    static void linkWithOffset(uint16_t* instruction, intptr_t relative)
-    {
-        // Currently branches > 16m = mostly deathy.
-        if (((relative << 7) >> 7) != relative) {
-            // FIXME: This CRASH means we cannot turn the JIT on by default on arm-v7.
-            fprintf(stderr, "Error: Cannot link T4b.\n");
-            CRASH();
-        }
-        
-        // ARM encoding for the top two bits below the sign bit is 'peculiar'.
-        if (relative >= 0)
-            relative ^= 0xC00000;
+    static bool isB(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return ((instruction[0] & 0xf800) == OP_B_T4a) && ((instruction[1] & 0xd000) == OP_B_T4b);
+    }
+
+    static bool isBX(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return (instruction[0] & 0xff87) == OP_BX;
+    }
 
-        // All branch offsets should be an even distance.
-        ASSERT(!(relative & 1));
+    static bool isMOV_imm_T3(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return ((instruction[0] & 0xFBF0) == OP_MOV_imm_T3) && ((instruction[1] & 0x8000) == 0);
+    }
 
-        int word1 = ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
-        int word2 = ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+    static bool isMOVT(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return ((instruction[0] & 0xFBF0) == OP_MOVT) && ((instruction[1] & 0x8000) == 0);
+    }
 
-        instruction[-2] = OP_B_T4a | word1;
-        instruction[-1] = OP_B_T4b | word2;
+    static bool isNOP_T1(void* address)
+    {
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return instruction[0] == OP_NOP_T1;
     }
 
-    // These functions can be used to splice 16-bit immediates back into previously generated instructions.
-    static void spliceHi5(uint16_t* where, uint16_t what)
+    static bool isNOP_T2(void* address)
     {
-        uint16_t pattern = (what >> 12) | ((what & 0x0800) >> 1);
-        *where = (*where & 0xFBF0) | pattern;
+        uint16_t* instruction = static_cast<uint16_t*>(address);
+        return (instruction[0] == OP_NOP_T2a) && (instruction[1] == OP_NOP_T2b);
     }
-    static void spliceLo11(uint16_t* where, uint16_t what)
+
+    static void linkJumpAbsolute(uint16_t* instruction, void* target)
     {
-        uint16_t pattern = ((what & 0x0700) << 4) | (what & 0x00FF);
-        *where = (*where & 0x8F00) | pattern;
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        const uint16_t JUMP_TEMPORARY_REGISTER = ARMRegisters::ip;
+
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+
+        ASSERT( (isMOV_imm_T3(instruction - 5) && isMOVT(instruction - 3) && isBX(instruction - 1))
+            || (isNOP_T1(instruction - 5) && isNOP_T2(instruction - 4) && isB(instruction - 2)) );
+
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        if (((relative << 7) >> 7) == relative) {
+            // ARM encoding for the top two bits below the sign bit is 'peculiar'.
+            if (relative >= 0)
+                relative ^= 0xC00000;
+
+            // All branch offsets should be an even distance.
+            ASSERT(!(relative & 1));
+            // There may be a better way to fix this, but right now put the NOPs first, since in the
+            // case of an conditional branch this will be coming after an ITTT predicating *three*
+            // instructions!  Looking backwards to modify the ITTT to an IT is not easy, due to
+            // variable wdith encoding - the previous instruction might *look* like an ITTT but
+            // actually be the second half of a 2-word op.
+            instruction[-5] = OP_NOP_T1;
+            instruction[-4] = OP_NOP_T2a;
+            instruction[-3] = OP_NOP_T2b;
+            instruction[-2] = OP_B_T4a | ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
+            instruction[-1] = OP_B_T4b | ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+        } else {
+            ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) + 1));
+            ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) >> 16));
+            instruction[-5] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+            instruction[-4] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, lo16);
+            instruction[-3] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+            instruction[-2] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, hi16);
+            instruction[-1] = OP_BX | (JUMP_TEMPORARY_REGISTER << 3);
+        }
+    }
+
+    static uint16_t twoWordOp5i6Imm4Reg4EncodedImmFirst(uint16_t op, ARMThumbImmediate imm)
+    {
+        return op | (imm.m_value.i << 10) | imm.m_value.imm4;
+    }
+    static uint16_t twoWordOp5i6Imm4Reg4EncodedImmSecond(uint16_t rd, ARMThumbImmediate imm)
+    {
+        return (imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8;
     }
 
     class ARMInstructionFormatter {
@@ -1723,8 +1792,11 @@ private:
 
         void twoWordOp5i6Imm4Reg4EncodedImm(OpcodeID1 op, int imm4, RegisterID rd, ARMThumbImmediate imm)
         {
-            m_buffer.putShort(op | (imm.m_value.i << 10) | imm4);
-            m_buffer.putShort((imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8);
+            ARMThumbImmediate newImm = imm;
+            newImm.m_value.imm4 = imm4;
+
+            m_buffer.putShort(ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmFirst(op, newImm));
+            m_buffer.putShort(ARMv7Assembler::twoWordOp5i6Imm4Reg4EncodedImmSecond(rd, newImm));
         }
 
         void twoWordOp12Reg4Reg4Imm12(OpcodeID1 op, RegisterID reg1, RegisterID reg2, uint16_t imm)
@@ -1749,6 +1821,8 @@ private:
     private:
         AssemblerBuffer m_buffer;
     } m_formatter;
+
+    Vector<LinkRecord> m_jumpsToLink;
 };
 
 } // namespace JSC
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.h b/JavaScriptCore/assembler/MacroAssemblerARM.h
index aa8cbb0..7a72b06 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -65,6 +65,7 @@ public:
     };
 
     static const RegisterID stackPointerRegister = ARMRegisters::sp;
+    static const RegisterID linkRegister = ARMRegisters::lr;
 
     static const Scale ScalePtr = TimesFour;
 
@@ -530,7 +531,7 @@ public:
 
     void ret()
     {
-        pop(ARMRegisters::pc);
+        m_assembler.mov_r(ARMRegisters::pc, linkRegister);
     }
 
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
@@ -746,11 +747,9 @@ protected:
 
     void prepareCall()
     {
-        ensureSpace(3 * sizeof(ARMWord), sizeof(ARMWord));
+        ensureSpace(2 * sizeof(ARMWord), sizeof(ARMWord));
 
-        // S0 might be used for parameter passing
-        m_assembler.add_r(ARMRegisters::S1, ARMRegisters::pc, ARMAssembler::OP2_IMM | 0x4);
-        m_assembler.push_r(ARMRegisters::S1);
+        m_assembler.mov_r(linkRegister, ARMRegisters::pc);
     }
 
     void call32(RegisterID base, int32_t offset)
diff --git a/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index a549604..c479517 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -990,13 +990,15 @@ public:
 protected:
     ARMv7Assembler::JmpSrc makeJump()
     {
-        return m_assembler.b();
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return m_assembler.bx(dataTempRegister);
     }
 
     ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
     {
-        m_assembler.it(cond);
-        return m_assembler.b();
+        m_assembler.it(cond, true, true);
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return m_assembler.bx(dataTempRegister);
     }
     ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
     ARMv7Assembler::JmpSrc makeBranch(DoubleCondition cond) { return makeBranch(armV7Condition(cond)); }
diff --git a/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
index 568260a..3681af8 100644
--- a/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
+++ b/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -69,7 +69,13 @@ public:
 
     template<typename FunctionType>
     explicit FunctionPtr(FunctionType* value)
+#if COMPILER(RVCT)
+     // RVTC compiler needs C-style cast as it fails with the following error
+     // Error:  #694: reinterpret_cast cannot cast away const or other type qualifiers
+        : m_value((void*)(value))
+#else
         : m_value(reinterpret_cast<void*>(value))
+#endif
     {
         ASSERT_VALID_CODE_POINTER(m_value);
     }
diff --git a/JavaScriptCore/bytecode/CodeBlock.cpp b/JavaScriptCore/bytecode/CodeBlock.cpp
index 6bac9b9..c915934 100644
--- a/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -135,11 +135,6 @@ NEVER_INLINE static const char* debugHookName(int debugHookID)
     return "";
 }
 
-static int locationForOffset(const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it, int offset)
-{
-    return it - begin + offset;
-}
-
 static void printUnaryOp(int location, Vector<Instruction>::const_iterator& it, const char* op)
 {
     int r0 = (++it)->u.operand;
@@ -156,11 +151,11 @@ static void printBinaryOp(int location, Vector<Instruction>::const_iterator& it,
     printf("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
 }
 
-static void printConditionalJump(const Vector<Instruction>::const_iterator& begin, Vector<Instruction>::const_iterator& it, int location, const char* op)
+static void printConditionalJump(const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, locationForOffset(begin, it, offset));
+    printf("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(r0).c_str(), offset, location + offset);
 }
 
 static void printGetByIdOp(int location, Vector<Instruction>::const_iterator& it, const Vector<Identifier>& m_identifiers, const char* op)
@@ -829,6 +824,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str());
             break;
         }
+        case op_get_by_pname: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int r2 = (++it)->u.operand;
+            int r3 = (++it)->u.operand;
+            int r4 = (++it)->u.operand;
+            int r5 = (++it)->u.operand;
+            printf("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), registerName(r4).c_str(), registerName(r5).c_str());
+            break;
+        }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -852,12 +857,12 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_jmp: {
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jmp\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_loop: {
             int offset = (++it)->u.operand;
-            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop\t\t %d(->%d)\n", location, offset, location + offset);
             break;
         }
         case op_jtrue: {
@@ -884,56 +889,56 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, location + offset);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, locationForOffset(begin, it, defaultTarget), registerName(scrutineeRegister).c_str());
+            printf("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(scrutineeRegister).c_str());
             break;
         }
         case op_new_func: {
@@ -1020,16 +1025,21 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_get_pnames: {
-            int r0 = (++it)->u.operand;
-            int r1 = (++it)->u.operand;
-            printf("[%4d] get_pnames\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            int r0 = it[1].u.operand;
+            int r1 = it[2].u.operand;
+            int r2 = it[3].u.operand;
+            int r3 = it[4].u.operand;
+            int offset = it[5].u.operand;
+            printf("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), registerName(r2).c_str(), registerName(r3).c_str(), offset, location + offset);
+            it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
         case op_next_pname: {
-            int dest = (++it)->u.operand;
-            int iter = (++it)->u.operand;
-            int offset = (++it)->u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, locationForOffset(begin, it, offset));
+            int dest = it[1].u.operand;
+            int iter = it[4].u.operand;
+            int offset = it[5].u.operand;
+            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(dest).c_str(), registerName(iter).c_str(), offset, location + offset);
+            it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
@@ -1051,7 +1061,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_jmp_scopes: {
             int scopeDelta = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, location + offset);
             break;
         }
         case op_catch: {
@@ -1074,7 +1084,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_jsr: {
             int retAddrDst = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, locationForOffset(begin, it, offset));
+            printf("[%4d] jsr\t\t %s, %d(->%d)\n", location, registerName(retAddrDst).c_str(), offset, location + offset);
             break;
         }
         case op_sret: {
diff --git a/JavaScriptCore/bytecode/Opcode.h b/JavaScriptCore/bytecode/Opcode.h
index c9196ce..4facbef 100644
--- a/JavaScriptCore/bytecode/Opcode.h
+++ b/JavaScriptCore/bytecode/Opcode.h
@@ -113,6 +113,7 @@ namespace JSC {
         macro(op_put_by_id_generic, 8) \
         macro(op_del_by_id, 4) \
         macro(op_get_by_val, 4) \
+        macro(op_get_by_pname, 7) \
         macro(op_put_by_val, 4) \
         macro(op_del_by_val, 4) \
         macro(op_put_by_index, 4) \
@@ -152,8 +153,8 @@ namespace JSC {
         macro(op_strcat, 4) \
         macro(op_to_primitive, 3) \
         \
-        macro(op_get_pnames, 3) \
-        macro(op_next_pname, 4) \
+        macro(op_get_pnames, 6) \
+        macro(op_next_pname, 7) \
         \
         macro(op_push_scope, 2) \
         macro(op_pop_scope, 1) \
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 8951ce3..04dae15 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -608,8 +608,9 @@ void ALWAYS_INLINE BytecodeGenerator::rewindUnaryOp()
 
 PassRefPtr<Label> BytecodeGenerator::emitJump(Label* target)
 {
+    size_t begin = instructions().size();
     emitOpcode(target->isForward() ? op_jmp : op_loop);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -624,10 +625,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_loop_if_less);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_lesseq && !target->isForward()) {
@@ -639,10 +642,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_loop_if_lesseq);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_eq_null && target->isForward()) {
@@ -653,9 +658,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jeq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_neq_null && target->isForward()) {
@@ -666,16 +673,20 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfTrue(RegisterID* cond, Label* tar
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jneq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     }
 
+    size_t begin = instructions().size();
+
     emitOpcode(target->isForward() ? op_jtrue : op_loop_if_true);
     instructions().append(cond->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -692,10 +703,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jnless);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_lesseq) {
@@ -707,10 +720,12 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindBinaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jnlesseq);
             instructions().append(src1Index);
             instructions().append(src2Index);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_not) {
@@ -721,9 +736,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jtrue);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_eq_null) {
@@ -734,9 +751,11 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jneq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     } else if (m_lastOpcodeID == op_neq_null) {
@@ -747,34 +766,41 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
 
         if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
             rewindUnaryOp();
+
+            size_t begin = instructions().size();
             emitOpcode(op_jeq_null);
             instructions().append(srcIndex);
-            instructions().append(target->offsetFrom(instructions().size()));
+            instructions().append(target->bind(begin, instructions().size()));
             return target;
         }
     }
 
+    size_t begin = instructions().size();
     emitOpcode(op_jfalse);
     instructions().append(cond->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
     instructions().append(m_scopeChain->globalObject()->d()->callFunction);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jneq_ptr);
     instructions().append(cond->index());
     instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
@@ -1255,6 +1281,19 @@ RegisterID* BytecodeGenerator::emitDeleteById(RegisterID* dst, RegisterID* base,
 
 RegisterID* BytecodeGenerator::emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
 {
+    for (size_t i = m_forInContextStack.size(); i > 0; i--) {
+        ForInContext& context = m_forInContextStack[i - 1];
+        if (context.propertyRegister == property) {
+            emitOpcode(op_get_by_pname);
+            instructions().append(dst->index());
+            instructions().append(base->index());
+            instructions().append(property->index());
+            instructions().append(context.expectedSubscriptRegister->index());
+            instructions().append(context.iterRegister->index());
+            instructions().append(context.indexRegister->index());
+            return dst;
+        }
+    }
     emitOpcode(op_get_by_val);
     instructions().append(dst->index());
     instructions().append(base->index());
@@ -1718,6 +1757,8 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
         }
 
         if (nNormalScopes) {
+            size_t begin = instructions().size();
+
             // We need to remove a number of dynamic scopes to get to the next
             // finally block
             emitOpcode(op_jmp_scopes);
@@ -1726,14 +1767,14 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
             // If topScope == bottomScope then there isn't actually a finally block
             // left to emit, so make the jmp_scopes jump directly to the target label
             if (topScope == bottomScope) {
-                instructions().append(target->offsetFrom(instructions().size()));
+                instructions().append(target->bind(begin, instructions().size()));
                 return target;
             }
 
             // Otherwise we just use jmp_scopes to pop a group of scopes and go
             // to the next instruction
             RefPtr<Label> nextInsn = newLabel();
-            instructions().append(nextInsn->offsetFrom(instructions().size()));
+            instructions().append(nextInsn->bind(begin, instructions().size()));
             emitLabel(nextInsn.get());
         }
 
@@ -1758,27 +1799,47 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpScopes(Label* target, int targetSco
     if (m_finallyDepth)
         return emitComplexJumpScopes(target, &m_scopeContextStack.last(), &m_scopeContextStack.last() - scopeDelta);
 
+    size_t begin = instructions().size();
+
     emitOpcode(op_jmp_scopes);
     instructions().append(scopeDelta);
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return target;
 }
 
-RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID* iter, Label* target)
+RegisterID* BytecodeGenerator::emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget)
 {
+    size_t begin = instructions().size();
+
+    emitOpcode(op_get_pnames);
+    instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(i->index());
+    instructions().append(size->index());
+    instructions().append(breakTarget->bind(begin, instructions().size()));
+    return dst;
+}
+
+RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target)
+{
+    size_t begin = instructions().size();
+
     emitOpcode(op_next_pname);
     instructions().append(dst->index());
+    instructions().append(base->index());
+    instructions().append(i->index());
+    instructions().append(size->index());
     instructions().append(iter->index());
-    instructions().append(target->offsetFrom(instructions().size()));
+    instructions().append(target->bind(begin, instructions().size()));
     return dst;
 }
 
 RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* start, Label* end)
 {
 #if ENABLE(JIT)
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
 #else
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
+    HandlerInfo info = { start->bind(0, 0), end->bind(0, 0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
 #endif
 
     m_codeBlock->addExceptionHandler(info);
@@ -1798,9 +1859,11 @@ RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSV
 
 PassRefPtr<Label> BytecodeGenerator::emitJumpSubroutine(RegisterID* retAddrDst, Label* finally)
 {
+    size_t begin = instructions().size();
+
     emitOpcode(op_jsr);
     instructions().append(retAddrDst->index());
-    instructions().append(finally->offsetFrom(instructions().size()));
+    instructions().append(finally->bind(begin, instructions().size()));
     emitLabel(newLabel().get()); // Record the fact that the next instruction is implicitly labeled, because op_sret will return to it.
     return finally;
 }
@@ -1870,7 +1933,7 @@ static void prepareJumpTableForImmediateSwitch(SimpleJumpTable& jumpTable, int32
         // We're emitting this after the clause labels should have been fixed, so 
         // the labels should not be "forward" references
         ASSERT(!labels[i]->isForward());
-        jumpTable.add(keyForImmediateSwitch(nodes[i], min, max), labels[i]->offsetFrom(switchAddress)); 
+        jumpTable.add(keyForImmediateSwitch(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
     }
 }
 
@@ -1896,7 +1959,7 @@ static void prepareJumpTableForCharacterSwitch(SimpleJumpTable& jumpTable, int32
         // We're emitting this after the clause labels should have been fixed, so 
         // the labels should not be "forward" references
         ASSERT(!labels[i]->isForward());
-        jumpTable.add(keyForCharacterSwitch(nodes[i], min, max), labels[i]->offsetFrom(switchAddress)); 
+        jumpTable.add(keyForCharacterSwitch(nodes[i], min, max), labels[i]->bind(switchAddress, switchAddress + 3)); 
     }
 }
 
@@ -1910,7 +1973,7 @@ static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t
         ASSERT(nodes[i]->isString());
         UString::Rep* clause = static_cast<StringNode*>(nodes[i])->value().ustring().rep();
         OffsetLocation location;
-        location.branchOffset = labels[i]->offsetFrom(switchAddress);
+        location.branchOffset = labels[i]->bind(switchAddress, switchAddress + 3);
         jumpTable.offsetTable.add(clause, location);
     }
 }
@@ -1921,23 +1984,23 @@ void BytecodeGenerator::endSwitch(uint32_t clauseCount, RefPtr<Label>* labels, E
     m_switchContextStack.removeLast();
     if (switchInfo.switchType == SwitchInfo::SwitchImmediate) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfImmediateSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
         SimpleJumpTable& jumpTable = m_codeBlock->addImmediateSwitchJumpTable();
-        prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes, min, max);
+        prepareJumpTableForImmediateSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else if (switchInfo.switchType == SwitchInfo::SwitchCharacter) {
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfCharacterSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
         
         SimpleJumpTable& jumpTable = m_codeBlock->addCharacterSwitchJumpTable();
-        prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes, min, max);
+        prepareJumpTableForCharacterSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes, min, max);
     } else {
         ASSERT(switchInfo.switchType == SwitchInfo::SwitchString);
         instructions()[switchInfo.bytecodeOffset + 1] = m_codeBlock->numberOfStringSwitchJumpTables();
-        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->offsetFrom(switchInfo.bytecodeOffset + 3);
+        instructions()[switchInfo.bytecodeOffset + 2] = defaultLabel->bind(switchInfo.bytecodeOffset, switchInfo.bytecodeOffset + 3);
 
         StringJumpTable& jumpTable = m_codeBlock->addStringSwitchJumpTable();
-        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset + 3, clauseCount, labels, nodes);
+        prepareJumpTableForStringSwitch(jumpTable, switchInfo.bytecodeOffset, clauseCount, labels, nodes);
     }
 }
 
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 1a83ce9..4648fb5 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -61,6 +61,13 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
+    struct ForInContext {
+        RefPtr<RegisterID> expectedSubscriptRegister;
+        RefPtr<RegisterID> iterRegister;
+        RefPtr<RegisterID> indexRegister;
+        RefPtr<RegisterID> propertyRegister;
+    };
+
     class BytecodeGenerator : public FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
@@ -312,8 +319,8 @@ namespace JSC {
         PassRefPtr<Label> emitJumpSubroutine(RegisterID* retAddrDst, Label*);
         void emitSubroutineReturn(RegisterID* retAddrSrc);
 
-        RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base) { return emitUnaryOp(op_get_pnames, dst, base); }
-        RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* iter, Label* target);
+        RegisterID* emitGetPropertyNames(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, Label* breakTarget);
+        RegisterID* emitNextPropertyName(RegisterID* dst, RegisterID* base, RegisterID* i, RegisterID* size, RegisterID* iter, Label* target);
 
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
@@ -331,6 +338,17 @@ namespace JSC {
         void pushFinallyContext(Label* target, RegisterID* returnAddrDst);
         void popFinallyContext();
 
+        void pushOptimisedForIn(RegisterID* expectedBase, RegisterID* iter, RegisterID* index, RegisterID* propertyRegister)
+        {
+            ForInContext context = { expectedBase, iter, index, propertyRegister };
+            m_forInContextStack.append(context);
+        }
+
+        void popOptimisedForIn()
+        {
+            m_forInContextStack.removeLast();
+        }
+
         LabelScope* breakTarget(const Identifier&);
         LabelScope* continueTarget(const Identifier&);
 
@@ -467,6 +485,7 @@ namespace JSC {
 
         Vector<ControlFlowContext> m_scopeContextStack;
         Vector<SwitchInfo> m_switchContextStack;
+        Vector<ForInContext> m_forInContextStack;
 
         int m_nextGlobalIndex;
         int m_nextParameterIndex;
diff --git a/JavaScriptCore/bytecompiler/Label.h b/JavaScriptCore/bytecompiler/Label.h
index 0b3d038..8cab1db 100644
--- a/JavaScriptCore/bytecompiler/Label.h
+++ b/JavaScriptCore/bytecompiler/Label.h
@@ -51,19 +51,17 @@ namespace JSC {
             m_location = location;
 
             unsigned size = m_unresolvedJumps.size();
-            for (unsigned i = 0; i < size; ++i) {
-                unsigned j = m_unresolvedJumps[i];
-                m_codeBlock->instructions()[j].u.operand = m_location - j;
-            }
+            for (unsigned i = 0; i < size; ++i)
+                m_codeBlock->instructions()[m_unresolvedJumps[i].second].u.operand = m_location - m_unresolvedJumps[i].first;
         }
 
-        int offsetFrom(int location) const
+        int bind(int opcode, int offset) const
         {
             if (m_location == invalidLocation) {
-                m_unresolvedJumps.append(location);
+                m_unresolvedJumps.append(std::make_pair(opcode, offset));
                 return 0;
             }
-            return m_location - location;
+            return m_location - opcode;
         }
 
         void ref() { ++m_refCount; }
@@ -77,7 +75,7 @@ namespace JSC {
         bool isForward() const { return m_location == invalidLocation; }
 
     private:
-        typedef Vector<int, 8> JumpVector;
+        typedef Vector<std::pair<int, int>, 8> JumpVector;
 
         static const unsigned invalidLocation = UINT_MAX;
 
diff --git a/JavaScriptCore/debugger/DebuggerActivation.h b/JavaScriptCore/debugger/DebuggerActivation.h
index dd34265..63cf635 100644
--- a/JavaScriptCore/debugger/DebuggerActivation.h
+++ b/JavaScriptCore/debugger/DebuggerActivation.h
@@ -51,9 +51,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | JSObject::StructureFlags;
+
     private:
         JSActivation* m_activation;
     };
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index 847b1fa..c77a0f1 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -91,8 +91,8 @@ static int depth(CodeBlock* codeBlock, ScopeChain& sc)
 #if USE(INTERPRETER)
 NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -121,9 +121,9 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
 
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
-    int skip = (vPC + 3)->u.operand + codeBlock->needsFullScopeChain();
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
+    int skip = vPC[3].u.operand + codeBlock->needsFullScopeChain();
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -152,12 +152,12 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
 
 NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int dst = (vPC + 1)->u.operand;
-    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>((vPC + 2)->u.jsCell);
+    int dst = vPC[1].u.operand;
+    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
     ASSERT(globalObject->isGlobalObject());
-    int property = (vPC + 3)->u.operand;
-    Structure* structure = (vPC + 4)->u.structure;
-    int offset = (vPC + 5)->u.operand;
+    int property = vPC[3].u.operand;
+    Structure* structure = vPC[4].u.structure;
+    int offset = vPC[5].u.operand;
 
     if (structure == globalObject->structure()) {
         callFrame->r(dst) = JSValue(globalObject->getDirectOffset(offset));
@@ -192,16 +192,16 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
 
 NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vPC)
 {
-    int dst = (vPC + 1)->u.operand;
-    int property = (vPC + 2)->u.operand;
+    int dst = vPC[1].u.operand;
+    int property = vPC[2].u.operand;
     callFrame->r(dst) = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
 }
 
 NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
-    int baseDst = (vPC + 1)->u.operand;
-    int propDst = (vPC + 2)->u.operand;
-    int property = (vPC + 3)->u.operand;
+    int baseDst = vPC[1].u.operand;
+    int propDst = vPC[2].u.operand;
+    int property = vPC[3].u.operand;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChainIterator iter = scopeChain->begin();
@@ -233,51 +233,6 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
-{
-    int baseDst = (vPC + 1)->u.operand;
-    int funcDst = (vPC + 2)->u.operand;
-    int property = (vPC + 3)->u.operand;
-
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& ident = codeBlock->identifier(property);
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValue result = slot.getValue(callFrame, ident);
-            exceptionValue = callFrame->globalData().exception;
-            if (exceptionValue)
-                return false;
-
-            callFrame->r(baseDst) = JSValue(thisObj);
-            callFrame->r(funcDst) = JSValue(result);
-            return true;
-        }
-        ++iter;
-    } while (iter != end);
-
-    exceptionValue = createUndefinedVariableError(callFrame, ident, vPC - codeBlock->instructions().begin(), codeBlock);
-    return false;
-}
-
 #endif // USE(INTERPRETER)
 
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argc)
@@ -928,10 +883,10 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
 #if USE(INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
-    int dst = (++vPC)->u.operand;
+    int dst = vPC[1].u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
-    Identifier& property = codeBlock->identifier((++vPC)->u.operand);
-    JSValue value = callFrame->r((++vPC)->u.operand).jsValue();
+    Identifier& property = codeBlock->identifier(vPC[2].u.operand);
+    JSValue value = callFrame->r(vPC[3].u.operand).jsValue();
     JSObject* scope = new (callFrame) JSStaticScopeObject(callFrame, property, value, DontDelete);
     callFrame->r(dst) = JSValue(scope);
 
@@ -983,22 +938,20 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    StructureChain* protoChain = structure->prototypeChain(callFrame);
-    if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_put_by_id_generic);
-        return;
-    }
-
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         if (structure->isDictionary()) {
             vPC[0] = getOpcode(op_put_by_id_generic);
             return;
         }
+
+        // put_by_id_transition checks the prototype chain for setters.
+        normalizePrototypeChain(callFrame, baseCell);
+
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        vPC[6] = protoChain;
+        vPC[6] = structure->prototypeChain(callFrame);
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
         return;
@@ -1094,21 +1047,15 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    StructureChain* protoChain = structure->prototypeChain(callFrame);
-    if (!protoChain->isCacheable()) {
-        vPC[0] = getOpcode(op_get_by_id_generic);
-        return;
-    }
-
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = protoChain;
+    vPC[5] = structure->prototypeChain(callFrame);
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
@@ -1213,10 +1160,10 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Constructs a new empty Object instance using the original
            constructor, and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
         callFrame->r(dst) = JSValue(constructEmptyObject(callFrame));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_object);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_array) {
@@ -1227,13 +1174,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            The array will contain argCount elements with values
            taken from registers starting at register firstArg.
         */
-        int dst = (++vPC)->u.operand;
-        int firstArg = (++vPC)->u.operand;
-        int argCount = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int firstArg = vPC[2].u.operand;
+        int argCount = vPC[3].u.operand;
         ArgList args(callFrame->registers() + firstArg, argCount);
         callFrame->r(dst) = JSValue(constructArray(callFrame, args));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_array);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_regexp) {
@@ -1243,11 +1190,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor from regexp regExp, and puts the result in
            register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int regExp = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int regExp = vPC[2].u.operand;
         callFrame->r(dst) = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_regexp);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mov) {
@@ -1255,11 +1202,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            Copies register src to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = callFrame->r(src);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_mov);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_eq) {
@@ -1269,9 +1216,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            as with the ECMAScript '==' operator, and puts the result
            as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsBoolean(src1.asInt32() == src2.asInt32());
         else {
@@ -1280,7 +1227,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_eq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_eq_null) {
@@ -1289,17 +1236,17 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Checks whether register src is null, as with the ECMAScript '!='
            operator, and puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame->r(dst) = jsBoolean(true);
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_eq_null);
             NEXT_INSTRUCTION();
         }
         
         callFrame->r(dst) = jsBoolean(src.isCell() && src.asCell()->structure()->typeInfo().masqueradesAsUndefined());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_eq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_neq) {
@@ -1309,9 +1256,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            equal, as with the ECMAScript '!=' operator, and puts the
            result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsBoolean(src1.asInt32() != src2.asInt32());
         else {
@@ -1320,7 +1267,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_neq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_neq_null) {
@@ -1329,17 +1276,17 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Checks whether register src is not null, as with the ECMAScript '!='
            operator, and puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
 
         if (src.isUndefinedOrNull()) {
             callFrame->r(dst) = jsBoolean(false);
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_neq_null);
             NEXT_INSTRUCTION();
         }
         
         callFrame->r(dst) = jsBoolean(!src.isCell() || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_neq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_stricteq) {
@@ -1349,12 +1296,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            equal, as with the ECMAScript '===' operator, and puts the
            result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         callFrame->r(dst) = jsBoolean(JSValue::strictEqual(src1, src2));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_stricteq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_nstricteq) {
@@ -1364,12 +1311,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            strictly equal, as with the ECMAScript '!==' operator, and
            puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         callFrame->r(dst) = jsBoolean(!JSValue::strictEqual(src1, src2));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_nstricteq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_less) {
@@ -1379,14 +1326,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            with the ECMAScript '<' operator, and puts the result as
            a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         JSValue result = jsBoolean(jsLess(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_less);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_lesseq) {
@@ -1396,14 +1343,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register src2, as with the ECMAScript '<=' operator, and
            puts the result as a boolean in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         JSValue result = jsBoolean(jsLessEq(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_lesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pre_inc) {
@@ -1412,7 +1359,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register srcDst to number, adds one, and puts the result
            back in register srcDst.
         */
-        int srcDst = (++vPC)->u.operand;
+        int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX)
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
@@ -1422,7 +1369,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(srcDst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pre_inc);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pre_dec) {
@@ -1431,7 +1378,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register srcDst to number, subtracts one, and puts the result
            back in register srcDst.
         */
-        int srcDst = (++vPC)->u.operand;
+        int srcDst = vPC[1].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN)
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
@@ -1441,7 +1388,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(srcDst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pre_dec);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_post_inc) {
@@ -1451,8 +1398,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            written to register dst, and the number plus one is written
            back to register srcDst.
         */
-        int dst = (++vPC)->u.operand;
-        int srcDst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() < INT_MAX) {
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() + 1);
@@ -1464,7 +1411,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = number;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_post_inc);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_post_dec) {
@@ -1474,8 +1421,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            written to register dst, and the number minus one is written
            back to register srcDst.
         */
-        int dst = (++vPC)->u.operand;
-        int srcDst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int srcDst = vPC[2].u.operand;
         JSValue v = callFrame->r(srcDst).jsValue();
         if (v.isInt32() && v.asInt32() > INT_MIN) {
             callFrame->r(srcDst) = jsNumber(callFrame, v.asInt32() - 1);
@@ -1487,7 +1434,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = number;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_post_dec);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_to_jsnumber) {
@@ -1496,8 +1443,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register src to number, and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
 
         JSValue srcVal = callFrame->r(src).jsValue();
 
@@ -1509,7 +1456,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_to_jsnumber);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_negate) {
@@ -1518,8 +1465,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Converts register src to number, negates it, and puts the
            result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32() && src.asInt32())
             callFrame->r(dst) = jsNumber(callFrame, -src.asInt32());
         else {
@@ -1528,7 +1475,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_negate);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_add) {
@@ -1538,9 +1485,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            in register dst. (JS add may be string concatenation or
            numeric add, depending on the types of the operands.)
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() + src2.asInt32());
         else {
@@ -1548,7 +1495,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_add);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mul) {
@@ -1557,9 +1504,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Multiplies register src1 and register src2 (converted to
            numbers), and puts the product in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() >> 15)) // no overflow
                 callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() * src2.asInt32());
         else {
@@ -1568,7 +1515,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_mul);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_div) {
@@ -1578,15 +1525,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register divisor (converted to number), and puts the
            quotient in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_div);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_mod) {
@@ -1596,15 +1543,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register divisor (converted to number), and puts the
            remainder in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue dividend = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue divisor = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue dividend = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue divisor = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (dividend.isInt32() && divisor.isInt32() && divisor.asInt32() != 0) {
             JSValue result = jsNumber(callFrame, dividend.asInt32() % divisor.asInt32());
             ASSERT(result);
             callFrame->r(dst) = result;
-            ++vPC;
+            vPC += OPCODE_LENGTH(op_mod);
             NEXT_INSTRUCTION();
         }
 
@@ -1615,7 +1562,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         JSValue result = jsNumber(callFrame, fmod(d1, d2));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_mod);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_sub) {
@@ -1625,9 +1572,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            src1 (converted to number), and puts the difference in
            register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32() && !(src1.asInt32() | src2.asInt32() & 0xc0000000)) // no overflow
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() - src2.asInt32());
         else {
@@ -1635,7 +1582,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_sub);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_lshift) {
@@ -1645,9 +1592,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register shift (converted to uint32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() << (shift.asInt32() & 0x1f));
@@ -1657,7 +1604,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_lshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_rshift) {
@@ -1667,9 +1614,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            to int32) by register shift (converted to
            uint32), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
 
         if (val.isInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
@@ -1679,7 +1626,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_rshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_urshift) {
@@ -1689,9 +1636,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            to uint32) by register shift (converted to
            uint32), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue val = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue shift = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue val = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue shift = callFrame->r(vPC[3].u.operand).jsValue();
         if (val.isUInt32() && shift.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, val.asInt32() >> (shift.asInt32() & 0x1f));
         else {
@@ -1700,7 +1647,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_urshift);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitand) {
@@ -1710,9 +1657,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() & src2.asInt32());
         else {
@@ -1721,7 +1668,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitand);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitxor) {
@@ -1731,9 +1678,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() ^ src2.asInt32());
         else {
@@ -1742,7 +1689,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitxor);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitor) {
@@ -1752,9 +1699,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and register src2 (converted to int32), and puts the
            result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src1 = callFrame->r(vPC[2].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[3].u.operand).jsValue();
         if (src1.isInt32() && src2.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, src1.asInt32() | src2.asInt32());
         else {
@@ -1763,7 +1710,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = result;
         }
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_bitor);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_bitnot) {
@@ -1772,8 +1719,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Computes bitwise NOT of register src1 (converted to int32),
            and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        JSValue src = callFrame->r((++vPC)->u.operand).jsValue();
+        int dst = vPC[1].u.operand;
+        JSValue src = callFrame->r(vPC[2].u.operand).jsValue();
         if (src.isInt32())
             callFrame->r(dst) = jsNumber(callFrame, ~src.asInt32());
         else {
@@ -1781,7 +1728,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = result;
         }
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_bitnot);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_not) {
@@ -1790,13 +1737,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Computes logical NOT of register src (converted to
            boolean), and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         JSValue result = jsBoolean(!callFrame->r(src).jsValue().toBoolean(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_not);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_instanceof) {
@@ -1826,7 +1773,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = jsBoolean(result);
 
-        vPC += 5;
+        vPC += OPCODE_LENGTH(op_instanceof);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_typeof) {
@@ -1835,11 +1782,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Determines the type string for src according to ECMAScript
            rules, and puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = JSValue(jsTypeStringForValue(callFrame, callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_typeof);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_undefined) {
@@ -1849,12 +1796,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "undefined", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         JSValue v = callFrame->r(src).jsValue();
         callFrame->r(dst) = jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_undefined);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_boolean) {
@@ -1864,11 +1811,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "boolean", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isBoolean());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_boolean);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_number) {
@@ -1878,11 +1825,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "number", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isNumber());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_number);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_string) {
@@ -1892,11 +1839,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "string", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(callFrame->r(src).jsValue().isString());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_string);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_object) {
@@ -1906,11 +1853,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "object", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(jsIsObjectType(callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_object);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_is_function) {
@@ -1920,11 +1867,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            the ECMAScript rules is "function", and puts the result
            in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
         callFrame->r(dst) = jsBoolean(jsIsFunctionType(callFrame->r(src).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_is_function);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_in) {
@@ -1936,9 +1883,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Raises an exception if register constructor is not an
            object.
         */
-        int dst = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int base = vPC[3].u.operand;
 
         JSValue baseVal = callFrame->r(base).jsValue();
         if (isInvalidParamForIn(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
@@ -1957,7 +1904,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             callFrame->r(dst) = jsBoolean(baseObj->hasProperty(callFrame, property));
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_in);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve) {
@@ -1970,7 +1917,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolve(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_resolve);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_skip) {
@@ -1983,7 +1930,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveSkip(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_resolve_skip);
 
         NEXT_INSTRUCTION();
     }
@@ -1998,7 +1945,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveGlobal(callFrame, vPC, exceptionValue)))
             goto vm_throw;
         
-        vPC += 6;
+        vPC += OPCODE_LENGTH(op_resolve_global);
         
         NEXT_INSTRUCTION();
     }
@@ -2007,13 +1954,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            Gets the global var at global slot index and places it in register dst.
          */
-        int dst = (++vPC)->u.operand;
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
+        int dst = vPC[1].u.operand;
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = (++vPC)->u.operand;
+        int index = vPC[3].u.operand;
 
         callFrame->r(dst) = scope->registerAt(index);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_global_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_global_var) {
@@ -2021,13 +1968,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          
            Puts value into global slot index.
          */
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[1].u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int index = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
         
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_global_var);
         NEXT_INSTRUCTION();
     }            
     DEFINE_OPCODE(op_get_scoped_var) {
@@ -2036,9 +1983,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          Loads the contents of the index-th local from the scope skip nodes from
          the top of the scope chain, and places it in register dst
          */
-        int dst = (++vPC)->u.operand;
-        int index = (++vPC)->u.operand;
-        int skip = (++vPC)->u.operand + callFrame->codeBlock()->needsFullScopeChain();
+        int dst = vPC[1].u.operand;
+        int index = vPC[2].u.operand;
+        int skip = vPC[3].u.operand + callFrame->codeBlock()->needsFullScopeChain();
 
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
@@ -2052,16 +1999,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         callFrame->r(dst) = scope->registerAt(index);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_scoped_var) {
         /* put_scoped_var index(n) skip(n) value(r)
 
          */
-        int index = (++vPC)->u.operand;
-        int skip = (++vPC)->u.operand + callFrame->codeBlock()->needsFullScopeChain();
-        int value = (++vPC)->u.operand;
+        int index = vPC[1].u.operand;
+        int skip = vPC[2].u.operand + callFrame->codeBlock()->needsFullScopeChain();
+        int value = vPC[3].u.operand;
 
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
@@ -2075,7 +2022,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_scoped_var);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_base) {
@@ -2088,7 +2035,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         resolveBase(callFrame, vPC);
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_resolve_base);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_resolve_with_base) {
@@ -2106,7 +2053,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (UNLIKELY(!resolveBaseAndProperty(callFrame, vPC, exceptionValue)))
             goto vm_throw;
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_resolve_with_base);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id) {
@@ -2129,7 +2076,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         tryCacheGetByID(callFrame, codeBlock, vPC, baseValue, ident, slot);
 
         callFrame->r(dst) = result;
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_self) {
@@ -2155,7 +2102,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                 callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_get_by_id_self);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2189,7 +2136,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
                     callFrame->r(dst) = JSValue(protoObject->getDirectOffset(offset));
 
-                    vPC += 8;
+                    vPC += OPCODE_LENGTH(op_get_by_id_proto);
                     NEXT_INSTRUCTION();
                 }
             }
@@ -2202,14 +2149,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         // Polymorphic self access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
         // This case of the switch must not be empty, else (op_get_by_id_self_list == op_get_by_id_chain)!
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_self_list);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_proto_list) {
         // Polymorphic prototype access caching currently only supported when JITting.
         ASSERT_NOT_REACHED();
         // This case of the switch must not be empty, else (op_get_by_id_proto_list == op_get_by_id_chain)!
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_proto_list);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_id_chain) {
@@ -2244,7 +2191,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
                         callFrame->r(dst) = JSValue(baseObject->getDirectOffset(offset));
 
-                        vPC += 8;
+                        vPC += OPCODE_LENGTH(op_get_by_id_chain);
                         NEXT_INSTRUCTION();
                     }
 
@@ -2274,7 +2221,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         CHECK_FOR_EXCEPTION();
 
         callFrame->r(dst) = result;
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_get_by_id_generic);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_array_length) {
@@ -2290,7 +2237,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
             callFrame->r(dst) = jsNumber(callFrame, asArray(baseValue)->length());
-            vPC += 8;
+            vPC += OPCODE_LENGTH(op_get_array_length);
             NEXT_INSTRUCTION();
         }
 
@@ -2310,7 +2257,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
             callFrame->r(dst) = jsNumber(callFrame, asString(baseValue)->value().size());
-            vPC += 8;
+            vPC += OPCODE_LENGTH(op_get_string_length);
             NEXT_INSTRUCTION();
         }
 
@@ -2340,7 +2287,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         tryCachePutByID(callFrame, codeBlock, vPC, baseValue, slot);
 
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_put_by_id);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_id_transition) {
@@ -2385,7 +2332,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_put_by_id_transition);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2420,7 +2367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(offset, callFrame->r(value).jsValue());
 
-                vPC += 8;
+                vPC += OPCODE_LENGTH(op_put_by_id_replace);
                 NEXT_INSTRUCTION();
             }
         }
@@ -2447,7 +2394,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         baseValue.put(callFrame, ident, callFrame->r(value).jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
-        vPC += 8;
+        vPC += OPCODE_LENGTH(op_put_by_id_generic);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_del_by_id) {
@@ -2458,16 +2405,43 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            boolean indicating success (if true) or failure (if false)
            to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame);
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_del_by_id);
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_get_by_pname) {
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
+        int expected = vPC[4].u.operand;
+        int iter = vPC[5].u.operand;
+        int i = vPC[6].u.operand;
+
+        JSValue baseValue = callFrame->r(base).jsValue();
+        JSPropertyNameIterator* it = callFrame->r(iter).propertyNameIterator();
+        JSValue subscript = callFrame->r(property).jsValue();
+        JSValue expectedSubscript = callFrame->r(expected).jsValue();
+        int index = callFrame->r(i).i() - 1;
+        JSValue result;
+        int offset = 0;
+        if (subscript == expectedSubscript && baseValue.isCell() && (baseValue.asCell()->structure() == it->cachedStructure()) && it->getOffset(index, offset)) {
+            callFrame->r(dst) = asObject(baseValue)->getDirectOffset(offset);
+            vPC += OPCODE_LENGTH(op_get_by_pname);
+            NEXT_INSTRUCTION();
+        }
+        Identifier propertyName(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, propertyName);
+        CHECK_FOR_EXCEPTION();
+        callFrame->r(dst) = result;
+        vPC += OPCODE_LENGTH(op_get_by_pname);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_by_val) {
@@ -2478,9 +2452,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            in register dst. property is nominally converted to string
            but numbers are treated more efficiently.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
         
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
@@ -2508,7 +2482,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_get_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_val) {
@@ -2522,9 +2496,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
 
         JSValue baseValue = callFrame->r(base).jsValue();
         JSValue subscript = callFrame->r(property).jsValue();
@@ -2558,7 +2532,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
 
         CHECK_FOR_EXCEPTION();
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_del_by_val) {
@@ -2569,9 +2543,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            boolean indicating success (if true) or failure (if false)
            to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int property = vPC[3].u.operand;
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame); // may throw
 
@@ -2589,7 +2563,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         CHECK_FOR_EXCEPTION();
         callFrame->r(dst) = result;
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_del_by_val);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_by_index) {
@@ -2604,13 +2578,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
            This opcode is mainly used to initialize array literals.
         */
-        int base = (++vPC)->u.operand;
-        unsigned property = (++vPC)->u.operand;
-        int value = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        unsigned property = vPC[2].u.operand;
+        int value = vPC[3].u.operand;
 
         callFrame->r(base).jsValue().put(callFrame, property, callFrame->r(value).jsValue());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_by_index);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop) {
@@ -2625,7 +2599,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if ENABLE(OPCODE_STATS)
         OpcodeStats::resetLastInstruction();
 #endif
-        int target = (++vPC)->u.operand;
+        int target = vPC[1].u.operand;
         CHECK_FOR_TIMEOUT();
         vPC += target;
         NEXT_INSTRUCTION();
@@ -2639,7 +2613,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 #if ENABLE(OPCODE_STATS)
         OpcodeStats::resetLastInstruction();
 #endif
-        int target = (++vPC)->u.operand;
+        int target = vPC[1].u.operand;
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -2653,15 +2627,15 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             CHECK_FOR_TIMEOUT();
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_true);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jtrue) {
@@ -2670,14 +2644,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register cond converts to boolean as true.
         */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jtrue);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jfalse) {
@@ -2686,14 +2660,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register cond converts to boolean as false.
         */
-        int cond = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int cond = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         if (!callFrame->r(cond).jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jfalse);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jeq_null) {
@@ -2702,8 +2676,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register src is null.
         */
-        int src = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
         if (srcValue.isUndefinedOrNull() || (srcValue.isCell() && srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
@@ -2711,7 +2685,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jeq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jneq_null) {
@@ -2720,8 +2694,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if and
            only if register src is not null.
         */
-        int src = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
 
         if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
@@ -2729,7 +2703,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jneq_null);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jneq_ptr) {
@@ -2738,16 +2712,16 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Jumps to offset target from the current instruction, if the value r is equal
            to ptr, using pointer equality.
          */
-        int src = (++vPC)->u.operand;
-        JSValue ptr = JSValue((++vPC)->u.jsCell);
-        int target = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
+        JSValue ptr = JSValue(vPC[2].u.jsCell);
+        int target = vPC[3].u.operand;
         JSValue srcValue = callFrame->r(src).jsValue();
         if (srcValue != ptr) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jneq_ptr);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop_if_less) {
@@ -2761,9 +2735,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
         
         bool result = jsLess(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2774,7 +2748,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_less);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_loop_if_lesseq) {
@@ -2788,9 +2762,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
         
         bool result = jsLessEq(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2801,7 +2775,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
         
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_loop_if_lesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jnless) {
@@ -2812,9 +2786,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            target from the current instruction, if and only if the 
            result of the comparison is false.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
 
         bool result = jsLess(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2824,7 +2798,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jnless);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jnlesseq) {
@@ -2835,9 +2809,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            and then jumps to offset target from the current instruction,
            if and only if theresult of the comparison is false.
         */
-        JSValue src1 = callFrame->r((++vPC)->u.operand).jsValue();
-        JSValue src2 = callFrame->r((++vPC)->u.operand).jsValue();
-        int target = (++vPC)->u.operand;
+        JSValue src1 = callFrame->r(vPC[1].u.operand).jsValue();
+        JSValue src2 = callFrame->r(vPC[2].u.operand).jsValue();
+        int target = vPC[3].u.operand;
 
         bool result = jsLessEq(callFrame, src1, src2);
         CHECK_FOR_EXCEPTION();
@@ -2847,7 +2821,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             NEXT_INSTRUCTION();
         }
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_jnlesseq);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_switch_imm) {
@@ -2859,9 +2833,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            table, and the value at jumpTable[scrutinee value] is non-zero, then
            that value is used as the jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (scrutinee.isInt32())
             vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.asInt32(), defaultOffset);
         else {
@@ -2883,9 +2857,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            table, and the value at jumpTable[scrutinee value] is non-zero, then
            that value is used as the jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
@@ -2906,9 +2880,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            jump table, then the value associated with the string is used as the 
            jump offset, otherwise defaultOffset is used.
          */
-        int tableIndex = (++vPC)->u.operand;
-        int defaultOffset = (++vPC)->u.operand;
-        JSValue scrutinee = callFrame->r((++vPC)->u.operand).jsValue();
+        int tableIndex = vPC[1].u.operand;
+        int defaultOffset = vPC[2].u.operand;
+        JSValue scrutinee = callFrame->r(vPC[3].u.operand).jsValue();
         if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
@@ -2923,12 +2897,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor, using the rules for function declarations, and
            puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int func = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int func = vPC[2].u.operand;
 
         callFrame->r(dst) = JSValue(callFrame->codeBlock()->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_func);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_new_func_exp) {
@@ -2939,8 +2913,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constructor, using the rules for function expressions, and
            puts the result in register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int funcIndex = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int funcIndex = vPC[2].u.operand;
 
         FunctionExecutable* function = callFrame->codeBlock()->functionExpr(funcIndex);
         JSFunction* func = function->make(callFrame, callFrame->scopeChain());
@@ -2959,7 +2933,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         callFrame->r(dst) = JSValue(func);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_func_exp);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_call_eval) {
@@ -2992,7 +2966,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
                 goto vm_throw;
             callFrame->r(dst) = result;
 
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call_eval);
             NEXT_INSTRUCTION();
         }
 
@@ -3066,7 +3040,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
             callFrame->r(dst) = returnValue;
 
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call);
             NEXT_INSTRUCTION();
         }
 
@@ -3076,8 +3050,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         goto vm_throw;
     }
     DEFINE_OPCODE(op_load_varargs) {
-        int argCountDst = (++vPC)->u.operand;
-        int argsOffset = (++vPC)->u.operand;
+        int argCountDst = vPC[1].u.operand;
+        int argsOffset = vPC[2].u.operand;
         
         JSValue arguments = callFrame->r(argsOffset).jsValue();
         int32_t argCount = 0;
@@ -3149,7 +3123,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         }
         CHECK_FOR_EXCEPTION();
         callFrame->r(argCountDst) = Register::withInt(argCount + 1);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_load_varargs);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_call_varargs) {
@@ -3220,7 +3194,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             
             callFrame->r(dst) = returnValue;
             
-            vPC += 5;
+            vPC += OPCODE_LENGTH(op_call_varargs);
             NEXT_INSTRUCTION();
         }
         
@@ -3242,12 +3216,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            This opcode should only be used immediately before op_ret.
         */
 
-        int src = (++vPC)->u.operand;
+        int src = vPC[1].u.operand;
         ASSERT(callFrame->codeBlock()->needsFullScopeChain());
 
         asActivation(callFrame->r(src).jsValue())->copyRegisters(callFrame->optionalCalleeArguments());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_tear_off_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_tear_off_arguments) {
@@ -3268,7 +3242,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (callFrame->optionalCalleeArguments())
             callFrame->optionalCalleeArguments()->copyRegisters();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_tear_off_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_ret) {
@@ -3281,7 +3255,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            register base to those of the calling function.
         */
 
-        int result = (++vPC)->u.operand;
+        int result = vPC[1].u.operand;
 
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
@@ -3316,7 +3290,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         for (size_t count = codeBlock->m_numVars; i < count; ++i)
             callFrame->r(i) = jsUndefined();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_enter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_enter_with_activation) {
@@ -3338,12 +3312,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         for (size_t count = codeBlock->m_numVars; i < count; ++i)
             callFrame->r(i) = jsUndefined();
 
-        int dst = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
         JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
         callFrame->r(dst) = JSValue(activation);
         callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_enter_with_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_convert_this) {
@@ -3358,12 +3332,12 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            block.
         */
 
-        int thisRegister = (++vPC)->u.operand;
+        int thisRegister = vPC[1].u.operand;
         JSValue thisVal = callFrame->r(thisRegister).jsValue();
         if (thisVal.needsThisConversion())
             callFrame->r(thisRegister) = JSValue(thisVal.toThisObject(callFrame));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_convert_this);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_init_arguments) {
@@ -3377,7 +3351,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            block.
          */
         callFrame->r(RegisterFile::ArgumentsRegister) = JSValue();
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_init_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_create_arguments) {
@@ -3393,7 +3367,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
              callFrame->setCalleeArguments(arguments);
              callFrame->r(RegisterFile::ArgumentsRegister) = JSValue(arguments);
          }
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_create_arguments);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_construct) {
@@ -3471,7 +3445,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             CHECK_FOR_EXCEPTION();
             callFrame->r(dst) = JSValue(returnValue);
 
-            vPC += 7;
+            vPC += OPCODE_LENGTH(op_construct);
             NEXT_INSTRUCTION();
         }
 
@@ -3489,32 +3463,32 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         int dst = vPC[1].u.operand;
         if (LIKELY(callFrame->r(dst).jsValue().isObject())) {
-            vPC += 3;
+            vPC += OPCODE_LENGTH(op_construct_verify);
             NEXT_INSTRUCTION();
         }
 
         int override = vPC[2].u.operand;
         callFrame->r(dst) = callFrame->r(override);
 
-        vPC += 3;
+        vPC += OPCODE_LENGTH(op_construct_verify);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_strcat) {
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
-        int count = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
+        int count = vPC[3].u.operand;
 
         callFrame->r(dst) = concatenateStrings(callFrame, &callFrame->registers()[src], count);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_strcat);
 
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_to_primitive) {
-        int dst = (++vPC)->u.operand;
-        int src = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int src = vPC[2].u.operand;
 
         callFrame->r(dst) = callFrame->r(src).jsValue().toPrimitive(callFrame);
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_to_primitive);
 
         NEXT_INSTRUCTION();
     }
@@ -3525,7 +3499,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            of the current scope chain.  The contents of the register scope
            are replaced by the result of toObject conversion of the scope.
         */
-        int scope = (++vPC)->u.operand;
+        int scope = vPC[1].u.operand;
         JSValue v = callFrame->r(scope).jsValue();
         JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
@@ -3533,7 +3507,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         callFrame->r(scope) = JSValue(o);
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_push_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_pop_scope) {
@@ -3543,47 +3517,69 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         callFrame->setScopeChain(callFrame->scopeChain()->pop());
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_pop_scope);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_pnames) {
-        /* get_pnames dst(r) base(r)
+        /* get_pnames dst(r) base(r) i(n) size(n) breakTarget(offset)
 
            Creates a property name list for register base and puts it
-           in register dst. This is not a true JavaScript value, just
-           a synthetic value used to keep the iteration state in a
-           register.
+           in register dst, initializing i and size for iteration. If
+           base is undefined or null, jumps to breakTarget.
         */
-        int dst = (++vPC)->u.operand;
-        int base = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int i = vPC[3].u.operand;
+        int size = vPC[4].u.operand;
+        int breakTarget = vPC[5].u.operand;
 
-        callFrame->r(dst) = JSPropertyNameIterator::create(callFrame, callFrame->r(base).jsValue());
-        ++vPC;
+        JSValue v = callFrame->r(base).jsValue();
+        if (v.isUndefinedOrNull()) {
+            vPC += breakTarget;
+            NEXT_INSTRUCTION();
+        }
+
+        JSObject* o = v.toObject(callFrame);
+        Structure* structure = o->structure();
+        JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+        if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(callFrame))
+            jsPropertyNameIterator = JSPropertyNameIterator::create(callFrame, o);
+
+        callFrame->r(dst) = jsPropertyNameIterator;
+        callFrame->r(base) = JSValue(o);
+        callFrame->r(i) = Register::withInt(0);
+        callFrame->r(size) = Register::withInt(jsPropertyNameIterator->size());
+        vPC += OPCODE_LENGTH(op_get_pnames);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_next_pname) {
-        /* next_pname dst(r) iter(r) target(offset)
+        /* next_pname dst(r) base(r) i(n) size(n) iter(r) target(offset)
 
-           Tries to copies the next name from property name list in
-           register iter. If there are names left, then copies one to
-           register dst, and jumps to offset target. If there are none
-           left, invalidates the iterator and continues to the next
+           Copies the next name from the property name list in
+           register iter to dst, then jumps to offset target. If there are no
+           names left, invalidates the iterator and continues to the next
            instruction.
         */
-        int dst = (++vPC)->u.operand;
-        int iter = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int base = vPC[2].u.operand;
+        int i = vPC[3].u.operand;
+        int size = vPC[4].u.operand;
+        int iter = vPC[5].u.operand;
+        int target = vPC[6].u.operand;
 
         JSPropertyNameIterator* it = callFrame->r(iter).propertyNameIterator();
-        if (JSValue temp = it->next(callFrame)) {
-            CHECK_FOR_TIMEOUT();
-            callFrame->r(dst) = JSValue(temp);
-            vPC += target;
-            NEXT_INSTRUCTION();
+        while (callFrame->r(i).i() != callFrame->r(size).i()) {
+            JSValue key = it->get(callFrame, asObject(callFrame->r(base).jsValue()), callFrame->r(i).i());
+            callFrame->r(i) = Register::withInt(callFrame->r(i).i() + 1);
+            if (key) {
+                CHECK_FOR_TIMEOUT();
+                callFrame->r(dst) = key;
+                vPC += target;
+                NEXT_INSTRUCTION();
+            }
         }
-        it->invalidate();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_next_pname);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_jmp_scopes) {
@@ -3593,8 +3589,8 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            specified by immediate number count, then jumps to offset
            target.
         */
-        int count = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
+        int count = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
 
         ScopeChainNode* tmp = callFrame->scopeChain();
         while (count--)
@@ -3617,7 +3613,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          */
         callFrame->setScopeChain(createExceptionScope(callFrame, vPC));
 
-        vPC += 4;
+        vPC += OPCODE_LENGTH(op_push_new_scope);
         NEXT_INSTRUCTION();
     }
 #if HAVE(COMPUTED_GOTO)
@@ -3632,11 +3628,11 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         ASSERT(exceptionValue);
         ASSERT(!globalData->exception);
-        int ex = (++vPC)->u.operand;
+        int ex = vPC[1].u.operand;
         callFrame->r(ex) = exceptionValue;
         exceptionValue = JSValue();
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_catch);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_throw) {
@@ -3650,7 +3646,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            else the script returns control to the nearest native caller.
         */
 
-        int ex = (++vPC)->u.operand;
+        int ex = vPC[1].u.operand;
         exceptionValue = callFrame->r(ex).jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - callFrame->codeBlock()->instructions().begin(), true);
@@ -3670,14 +3666,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            constant message as the message string. The result is
            written to register dst.
         */
-        int dst = (++vPC)->u.operand;
-        int type = (++vPC)->u.operand;
-        int message = (++vPC)->u.operand;
+        int dst = vPC[1].u.operand;
+        int type = vPC[2].u.operand;
+        int message = vPC[3].u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
         callFrame->r(dst) = JSValue(Error::create(callFrame, (ErrorType)type, callFrame->r(message).jsValue().toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerExecutable()->sourceID(), codeBlock->ownerExecutable()->sourceURL()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_new_error);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_end) {
@@ -3692,7 +3688,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
             ASSERT(scopeChain->refCount > 1);
             scopeChain->deref();
         }
-        int result = (++vPC)->u.operand;
+        int result = vPC[1].u.operand;
         return callFrame->r(result).jsValue();
     }
     DEFINE_OPCODE(op_put_getter) {
@@ -3706,9 +3702,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int function = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int function = vPC[3].u.operand;
 
         ASSERT(callFrame->r(base).jsValue().isObject());
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
@@ -3716,7 +3712,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(callFrame->r(function).jsValue().isObject());
         baseObj->defineGetter(callFrame, ident, asObject(callFrame->r(function).jsValue()));
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_getter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_setter) {
@@ -3730,9 +3726,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Unlike many opcodes, this one does not write any output to
            the register file.
         */
-        int base = (++vPC)->u.operand;
-        int property = (++vPC)->u.operand;
-        int function = (++vPC)->u.operand;
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        int function = vPC[3].u.operand;
 
         ASSERT(callFrame->r(base).jsValue().isObject());
         JSObject* baseObj = asObject(callFrame->r(base).jsValue());
@@ -3740,7 +3736,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT(callFrame->r(function).jsValue().isObject());
         baseObj->defineSetter(callFrame, ident, asObject(callFrame->r(function).jsValue()), 0);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_put_setter);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_method_check) {
@@ -3753,9 +3749,9 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
            Places the address of the next instruction into the retAddrDst
            register and jumps to offset target from the current instruction.
         */
-        int retAddrDst = (++vPC)->u.operand;
-        int target = (++vPC)->u.operand;
-        callFrame->r(retAddrDst) = vPC + 1;
+        int retAddrDst = vPC[1].u.operand;
+        int target = vPC[2].u.operand;
+        callFrame->r(retAddrDst) = vPC + OPCODE_LENGTH(op_jsr);
 
         vPC += target;
         NEXT_INSTRUCTION();
@@ -3767,7 +3763,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          differs from op_jmp because the target address is stored in a
          register, not as an immediate.
         */
-        int retAddrSrc = (++vPC)->u.operand;
+        int retAddrSrc = vPC[1].u.operand;
         vPC = callFrame->r(retAddrSrc).vPC();
         NEXT_INSTRUCTION();
     }
@@ -3777,13 +3773,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
          Notifies the debugger of the current state of execution. This opcode
          is only generated while the debugger is attached.
         */
-        int debugHookID = (++vPC)->u.operand;
-        int firstLine = (++vPC)->u.operand;
-        int lastLine = (++vPC)->u.operand;
+        int debugHookID = vPC[1].u.operand;
+        int firstLine = vPC[2].u.operand;
+        int lastLine = vPC[3].u.operand;
 
         debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
 
-        ++vPC;
+        vPC += OPCODE_LENGTH(op_debug);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_profile_will_call) {
@@ -3797,7 +3793,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (*enabledProfilerReference)
             (*enabledProfilerReference)->willExecute(callFrame, callFrame->r(function).jsValue());
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_profile_will_call);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_profile_did_call) {
@@ -3811,7 +3807,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         if (*enabledProfilerReference)
             (*enabledProfilerReference)->didExecute(callFrame, callFrame->r(function).jsValue());
 
-        vPC += 2;
+        vPC += OPCODE_LENGTH(op_profile_did_call);
         NEXT_INSTRUCTION();
     }
     vm_throw: {
diff --git a/JavaScriptCore/interpreter/Interpreter.h b/JavaScriptCore/interpreter/Interpreter.h
index 3046b28..e17b055 100644
--- a/JavaScriptCore/interpreter/Interpreter.h
+++ b/JavaScriptCore/interpreter/Interpreter.h
@@ -129,7 +129,6 @@ namespace JSC {
         NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
         NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
-        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
 
         void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
diff --git a/JavaScriptCore/jit/ExecutableAllocator.h b/JavaScriptCore/jit/ExecutableAllocator.h
index 3274fcc..1d15ef0 100644
--- a/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/JavaScriptCore/jit/ExecutableAllocator.h
@@ -78,6 +78,9 @@ private:
     struct Allocation {
         char* pages;
         size_t size;
+#if PLATFORM(SYMBIAN)
+        RChunk* chunk;
+#endif
     };
     typedef Vector<Allocation, 2> AllocationList;
 
diff --git a/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp b/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
new file mode 100644
index 0000000..c96ecae
--- /dev/null
+++ b/JavaScriptCore/jit/ExecutableAllocatorSymbian.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, 
+ *  Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+
+#include "ExecutableAllocator.h"
+
+#if ENABLE(ASSEMBLER) && PLATFORM(SYMBIAN)
+
+#include <e32hal.h>
+#include <e32std.h>
+
+// Set the page size to 256 Kb to compensate for moving memory model limitation
+const size_t MOVING_MEM_PAGE_SIZE = 256 * 1024; 
+
+namespace JSC {
+
+void ExecutableAllocator::intializePageSize()
+{
+#if PLATFORM_ARM_ARCH(5)
+    // The moving memory model (as used in ARMv5 and earlier platforms)
+    // on Symbian OS limits the number of chunks for each process to 16. 
+    // To mitigate this limitation increase the pagesize to 
+    // allocate less of larger chunks.
+    ExecutableAllocator::pageSize = MOVING_MEM_PAGE_SIZE;
+#else
+    TInt page_size;
+    UserHal::PageSizeInBytes(page_size);
+    ExecutableAllocator::pageSize = page_size;
+#endif
+}
+
+ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
+{
+    RChunk* codeChunk = new RChunk();
+
+    TInt errorCode = codeChunk->CreateLocalCode(n, n);
+
+    char* allocation = reinterpret_cast<char*>(codeChunk->Base());
+    if (!allocation)
+        CRASH();
+    ExecutablePool::Allocation alloc = { allocation, n, codeChunk };
+    return alloc;
+}
+
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
+{ 
+    alloc.chunk->Close();
+    delete alloc.chunk;
+}
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
+#endif
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/JavaScriptCore/jit/JIT.cpp b/JavaScriptCore/jit/JIT.cpp
index ea8434e..000e4b8 100644
--- a/JavaScriptCore/jit/JIT.cpp
+++ b/JavaScriptCore/jit/JIT.cpp
@@ -202,7 +202,6 @@ void JIT::privateCompileMainPass()
         DEFINE_BINARY_OP(op_less)
         DEFINE_BINARY_OP(op_lesseq)
         DEFINE_BINARY_OP(op_urshift)
-        DEFINE_UNARY_OP(op_get_pnames)
         DEFINE_UNARY_OP(op_is_boolean)
         DEFINE_UNARY_OP(op_is_function)
         DEFINE_UNARY_OP(op_is_number)
@@ -240,7 +239,9 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_eq_null)
         DEFINE_OP(op_get_by_id)
         DEFINE_OP(op_get_by_val)
+        DEFINE_OP(op_get_by_pname)
         DEFINE_OP(op_get_global_var)
+        DEFINE_OP(op_get_pnames)
         DEFINE_OP(op_get_scoped_var)
         DEFINE_OP(op_instanceof)
         DEFINE_OP(op_jeq_null)
@@ -385,6 +386,7 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_eq)
         DEFINE_SLOWCASE_OP(op_get_by_id)
         DEFINE_SLOWCASE_OP(op_get_by_val)
+        DEFINE_SLOWCASE_OP(op_get_by_pname)
         DEFINE_SLOWCASE_OP(op_instanceof)
         DEFINE_SLOWCASE_OP(op_jfalse)
         DEFINE_SLOWCASE_OP(op_jnless)
@@ -489,21 +491,21 @@ JITCode JIT::privateCompile()
             ASSERT(record.type == SwitchRecord::Immediate || record.type == SwitchRecord::Character); 
             ASSERT(record.jumpTable.simpleJumpTable->branchOffsets.size() == record.jumpTable.simpleJumpTable->ctiOffsets.size());
 
-            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + record.defaultOffset]);
 
             for (unsigned j = 0; j < record.jumpTable.simpleJumpTable->branchOffsets.size(); ++j) {
                 unsigned offset = record.jumpTable.simpleJumpTable->branchOffsets[j];
-                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
+                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
             }
         } else {
             ASSERT(record.type == SwitchRecord::String);
 
-            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + record.defaultOffset]);
 
             StringJumpTable::StringOffsetTable::iterator end = record.jumpTable.stringJumpTable->offsetTable.end();            
             for (StringJumpTable::StringOffsetTable::iterator it = record.jumpTable.stringJumpTable->offsetTable.begin(); it != end; ++it) {
                 unsigned offset = it->second.branchOffset;
-                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
+                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
             }
         }
     }
diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index 0712743..e19ea17 100644
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -38,6 +38,8 @@
 #define JIT_CLASS_ALIGNMENT
 #endif
 
+#define ASSERT_JIT_OFFSET(actual, expected) ASSERT_WITH_MESSAGE(actual == expected, "JIT Offset \"%s\" should be %d, not %d.\n", #expected, static_cast<int>(actual), static_cast<int>(expected));
+
 #include "CodeBlock.h"
 #include "Interpreter.h"
 #include "JITCode.h"
@@ -249,7 +251,6 @@ namespace JSC {
 
         static const RegisterID timeoutCheckRegister = ARMRegisters::r5;
         static const RegisterID callFrameRegister = ARMRegisters::r4;
-        static const RegisterID ctiReturnRegister = ARMRegisters::r6;
 
         static const RegisterID regT0 = ARMRegisters::r0;
         static const RegisterID regT1 = ARMRegisters::r1;
@@ -386,6 +387,8 @@ namespace JSC {
 
         Address addressFor(unsigned index, RegisterID base = callFrameRegister);
 
+        void testPrototype(Structure*, JumpList& failureCases);
+
 #if USE(JSVALUE32_64)
         Address tagFor(unsigned index, RegisterID base = callFrameRegister);
         Address payloadFor(unsigned index, RegisterID base = callFrameRegister);
@@ -425,6 +428,7 @@ namespace JSC {
 #endif
         void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, Structure* structure, size_t cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset);
         void compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, Structure* structure, size_t cachedOffset);
 
         // Arithmetic opcode helpers
@@ -526,6 +530,7 @@ namespace JSC {
 #endif
         void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
         void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch);
         void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
 
 #if PLATFORM(X86_64)
@@ -581,26 +586,26 @@ namespace JSC {
 #elif PLATFORM(ARM_THUMB2)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
-        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchOffsetPutByIdExternalLoad = 26;
         static const int patchLengthPutByIdExternalLoad = 12;
-        static const int patchOffsetPutByIdPropertyMapOffset = 40;
+        static const int patchOffsetPutByIdPropertyMapOffset = 46;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
-        static const int patchOffsetGetByIdBranchToSlowCase = 20;
-        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchOffsetGetByIdBranchToSlowCase = 26;
+        static const int patchOffsetGetByIdExternalLoad = 26;
         static const int patchLengthGetByIdExternalLoad = 12;
-        static const int patchOffsetGetByIdPropertyMapOffset = 40;
-        static const int patchOffsetGetByIdPutResult = 44;
+        static const int patchOffsetGetByIdPropertyMapOffset = 46;
+        static const int patchOffsetGetByIdPutResult = 50;
 #if ENABLE(OPCODE_SAMPLING)
         static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
 #else
         static const int patchOffsetGetByIdSlowCaseCall = 28;
 #endif
-        static const int patchOffsetOpCallCompareToJump = 10;
+        static const int patchOffsetOpCallCompareToJump = 16;
 
-        static const int patchOffsetMethodCheckProtoObj = 18;
-        static const int patchOffsetMethodCheckProtoStruct = 28;
-        static const int patchOffsetMethodCheckPutFunction = 46;
+        static const int patchOffsetMethodCheckProtoObj = 24;
+        static const int patchOffsetMethodCheckProtoStruct = 34;
+        static const int patchOffsetMethodCheckPutFunction = 58;
 #elif PLATFORM(ARM_TRADITIONAL)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 4;
@@ -617,7 +622,7 @@ namespace JSC {
 #if ENABLE(OPCODE_SAMPLING)
         #error "OPCODE_SAMPLING is not yet supported"
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 36;
+        static const int patchOffsetGetByIdSlowCaseCall = 28;
 #endif
         static const int patchOffsetOpCallCompareToJump = 12;
 
@@ -638,7 +643,7 @@ namespace JSC {
         static const int sequenceGetByIdHotPathInstructionSpace = 28;
         static const int sequenceGetByIdHotPathConstantSpace = 3;
         // sequenceGetByIdSlowCase
-        static const int sequenceGetByIdSlowCaseInstructionSpace = 40;
+        static const int sequenceGetByIdSlowCaseInstructionSpace = 32;
         static const int sequenceGetByIdSlowCaseConstantSpace = 2;
         // sequencePutById
         static const int sequencePutByIdInstructionSpace = 28;
@@ -680,6 +685,7 @@ namespace JSC {
         void emit_op_eq_null(Instruction*);
         void emit_op_get_by_id(Instruction*);
         void emit_op_get_by_val(Instruction*);
+        void emit_op_get_by_pname(Instruction*);
         void emit_op_get_global_var(Instruction*);
         void emit_op_get_scoped_var(Instruction*);
         void emit_op_init_arguments(Instruction*);
@@ -713,6 +719,7 @@ namespace JSC {
         void emit_op_new_func_exp(Instruction*);
         void emit_op_new_object(Instruction*);
         void emit_op_new_regexp(Instruction*);
+        void emit_op_get_pnames(Instruction*);
         void emit_op_next_pname(Instruction*);
         void emit_op_not(Instruction*);
         void emit_op_nstricteq(Instruction*);
@@ -768,6 +775,7 @@ namespace JSC {
         void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_pname(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
diff --git a/JavaScriptCore/jit/JITArithmetic.cpp b/JavaScriptCore/jit/JITArithmetic.cpp
index 7afc1f2..8cda482 100644
--- a/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/JavaScriptCore/jit/JITArithmetic.cpp
@@ -98,16 +98,16 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(LessThanOrEqual, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, regT2), target);
     }
 
     if (!supportsFloatingPoint()) {
@@ -145,7 +145,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
 void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
@@ -161,16 +161,16 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT3, regT2);
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(LessThan, regT2, Imm32(getConstantOperand(op1).asInt32())), target);
     } else if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
     } else {
         emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
         notInt32Op1.append(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
         notInt32Op2.append(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, regT2), target + 3);
+        addJump(branch32(GreaterThan, regT0, regT2), target);
     }
 
     if (!supportsFloatingPoint()) {
@@ -208,7 +208,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 }
 
 // LeftShift (<<)
@@ -829,11 +829,11 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst + 3);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT0, fpRegT2), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op1, fpRegT2);
-                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst + 3);
+                addJump(branchDouble(DoubleLessThan, fpRegT0, fpRegT2), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -882,11 +882,11 @@ void JIT::emitBinaryDoubleOp(OpcodeID opcodeID, unsigned dst, unsigned op1, unsi
                 break;
             case op_jnless:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst + 3);
+                addJump(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), dst);
                 break;
             case op_jnlesseq:
                 emitLoadDouble(op2, fpRegT1);
-                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst + 3);
+                addJump(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), dst);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -1313,7 +1313,7 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
@@ -1322,13 +1322,13 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target + 3);
+        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
 
-        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target);
     }
 }
 
@@ -1365,7 +1365,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1382,7 +1382,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
@@ -1406,7 +1406,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1423,7 +1423,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else {
         linkSlowCase(iter);
@@ -1452,7 +1452,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
@@ -1475,7 +1475,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
     }
 }
 
@@ -1498,7 +1498,7 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
@@ -1507,13 +1507,13 @@ void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target + 3);
+        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
 
-        addJump(branch32(GreaterThan, regT0, regT1), target + 3);
+        addJump(branch32(GreaterThan, regT0, regT1), target);
     }
 }
 
@@ -1550,7 +1550,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op2imm), regT1);
             convertInt32ToDouble(regT1, fpRegT1);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1567,7 +1567,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
@@ -1591,7 +1591,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             move(Imm32(op1imm), regT0);
             convertInt32ToDouble(regT0, fpRegT0);
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1608,7 +1608,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
 
     } else {
         linkSlowCase(iter);
@@ -1637,7 +1637,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
             loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
 
-            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
@@ -1660,7 +1660,7 @@ void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseE
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target);
     }
 }
 
diff --git a/JavaScriptCore/jit/JITCall.cpp b/JavaScriptCore/jit/JITCall.cpp
index cfaa69f..f7fcc0a 100644
--- a/JavaScriptCore/jit/JITCall.cpp
+++ b/JavaScriptCore/jit/JITCall.cpp
@@ -614,7 +614,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     END_UNINTERRUPTED_SEQUENCE(sequenceOpCall);
 
     addSlowCase(jumpToSlow);
-    ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
+    ASSERT_JIT_OFFSET(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow), patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
 
     // The following is the fast case, only used whan a callee can be linked.
diff --git a/JavaScriptCore/jit/JITInlineMethods.h b/JavaScriptCore/jit/JITInlineMethods.h
index f26457a..93d6ce7 100644
--- a/JavaScriptCore/jit/JITInlineMethods.h
+++ b/JavaScriptCore/jit/JITInlineMethods.h
@@ -144,7 +144,7 @@ ALWAYS_INLINE void JIT::endUninterruptedSequence(int insnSpace, int constSpace)
 
 #endif
 
-#if PLATFORM(ARM_THUMB2)
+#if PLATFORM(ARM)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -161,7 +161,7 @@ ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
     loadPtr(address, linkRegister);
 }
 
-#else // PLATFORM(X86) || PLATFORM(X86_64) || PLATFORM(ARM_TRADITIONAL)
+#else // PLATFORM(X86) || PLATFORM(X86_64)
 
 ALWAYS_INLINE void JIT::preserveReturnAddressAfterCall(RegisterID reg)
 {
@@ -191,16 +191,13 @@ ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
     move(stackPointerRegister, firstArgumentRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
-#if PLATFORM(ARM_TRADITIONAL)
-    move(ctiReturnRegister, ARMRegisters::lr);
-#endif
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
 #if PLATFORM(X86)
     // Within a trampoline the return address will be on the stack at this point.
     addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
-#elif PLATFORM(ARM_THUMB2)
+#elif PLATFORM(ARM)
     move(stackPointerRegister, firstArgumentRegister);
 #endif
     // In the trampoline on x86-64, the first argument register is not overwritten.
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
index f362d75..14736cf 100644
--- a/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -33,6 +33,7 @@
 #include "JSArray.h"
 #include "JSCell.h"
 #include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
 #include "LinkBuffer.h"
 
 namespace JSC {
@@ -267,7 +268,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     restoreReturnAddressBeforeReturn(regT2);
@@ -345,14 +346,14 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 void JIT::emit_op_jmp(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
     emitTimeoutCheck();
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
@@ -366,21 +367,21 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
     
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThan, regT0, regT2), target + 3);
+    addJump(branch32(LessThan, regT0, regT2), target);
 }
 
 void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -397,7 +398,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
@@ -411,21 +412,21 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitLoad(op2, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target + 3);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target);
         return;
     }
 
     if (isOperandConstantImmediateInt(op2)) {
         emitLoad(op1, regT1, regT0);
         addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
-        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);
         return;
     }
 
     emitLoad2(op1, regT1, regT0, op2, regT3, regT2);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));
     addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));
-    addJump(branch32(LessThanOrEqual, regT0, regT2), target + 3);
+    addJump(branch32(LessThanOrEqual, regT0, regT2), target);
 }
 
 void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -442,7 +443,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
     stubCall.addArgument(op1);
     stubCall.addArgument(op2);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_new_object(Instruction* currentInstruction)
@@ -457,30 +458,20 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     unsigned baseVal = currentInstruction[3].u.operand;
     unsigned proto = currentInstruction[4].u.operand;
 
-    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // Load the operands into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
-    emitLoadPayload(proto, regT1);
-    emitLoadPayload(baseVal, regT0);
     emitLoadPayload(value, regT2);
+    emitLoadPayload(baseVal, regT0);
+    emitLoadPayload(proto, regT1);
 
-    // Check that baseVal & proto are cells.
-    emitJumpSlowCaseIfNotJSCell(proto);
+    // Check that value, baseVal, and proto are cells.
+    emitJumpSlowCaseIfNotJSCell(value);
     emitJumpSlowCaseIfNotJSCell(baseVal);
+    emitJumpSlowCaseIfNotJSCell(proto);
 
-    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType))); // FIXME: Maybe remove this test.
-    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsHasInstance))); // FIXME: TOT checks ImplementsDefaultHasInstance.
-
-    // If value is not an Object, return false.
-    emitLoadTag(value, regT0);
-    Jump valueIsImmediate = branch32(NotEqual, regT0, Imm32(JSValue::CellTag));
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)); // FIXME: Maybe remove this test.
-
-    // Check proto is object.
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
@@ -488,16 +479,14 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     move(Imm32(JSValue::TrueTag), regT0);
     Label loop(this);
 
-    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
-    branch32(NotEqual, regT2, Imm32(0), loop);
+    branchTest32(NonZero, regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    valueIsImmediate.link(this);
-    valueIsNotObject.link(this);
     move(Imm32(JSValue::FalseTag), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
@@ -512,11 +501,10 @@ void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCas
     unsigned baseVal = currentInstruction[3].u.operand;
     unsigned proto = currentInstruction[4].u.operand;
 
+    linkSlowCaseIfNotJSCell(iter, value);
     linkSlowCaseIfNotJSCell(iter, baseVal);
     linkSlowCaseIfNotJSCell(iter, proto);
     linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
 
     JITStubCall stubCall(this, cti_op_instanceof);
     stubCall.addArgument(value);
@@ -671,12 +659,12 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
-    addJump(branch32(NotEqual, regT0, Imm32(0)), target + 2);
+    addJump(branch32(NotEqual, regT0, Imm32(0)), target);
     Jump isNotZero = jump();
 
     isNotInteger.link(this);
 
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
     addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::FalseTag)));
 
     isNotZero.link(this);
@@ -692,7 +680,7 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
@@ -785,11 +773,11 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isTrue = branch32(Equal, regT1, Imm32(JSValue::TrueTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::FalseTag)), target);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     Jump isTrue2 = branch32(NotEqual, regT0, Imm32(0));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
@@ -798,7 +786,7 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target + 2);
+        addJump(branchDouble(DoubleEqual, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -815,7 +803,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), target + 2); // Inverted.
+    emitJumpSlowToHot(branchTest32(Zero, regT0), target); // Inverted.
 }
 
 void JIT::emit_op_jtrue(Instruction* currentInstruction)
@@ -826,11 +814,11 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     emitLoad(cond, regT1, regT0);
 
     Jump isFalse = branch32(Equal, regT1, Imm32(JSValue::FalseTag));
-    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target + 2);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::TrueTag)), target);
 
     Jump isNotInteger = branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag));
     Jump isFalse2 = branch32(Equal, regT0, Imm32(0));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
 
     if (supportsFloatingPoint()) {
         isNotInteger.link(this);
@@ -839,7 +827,7 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
 
         zeroDouble(fpRegT0);
         emitLoadDouble(cond, fpRegT1);
-        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target + 2);
+        addJump(branchDouble(DoubleNotEqual, fpRegT0, fpRegT1), target);
     } else
         addSlowCase(isNotInteger);
 
@@ -856,7 +844,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(cond);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
 }
 
 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
@@ -870,7 +858,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -881,7 +869,7 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
     set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
-    addJump(branchTest32(NonZero, regT1), target + 2);
+    addJump(branchTest32(NonZero, regT1), target);
 
     wasNotImmediate.link(this);
 }
@@ -897,7 +885,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
 
     Jump wasNotImmediate = jump();
 
@@ -908,7 +896,7 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
     set32(Equal, regT1, Imm32(JSValue::UndefinedTag), regT1);
     or32(regT2, regT1);
 
-    addJump(branchTest32(Zero, regT1), target + 2);
+    addJump(branchTest32(Zero, regT1), target);
 
     wasNotImmediate.link(this);
 }
@@ -920,8 +908,8 @@ void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
     unsigned target = currentInstruction[3].u.operand;
 
     emitLoad(src, regT1, regT0);
-    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target + 3);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target + 3);
+    addJump(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)), target);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(ptr)), target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
@@ -929,7 +917,7 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
     DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
 }
 
@@ -1195,23 +1183,109 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 #endif
 }
 
+void JIT::emit_op_get_pnames(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int breakTarget = currentInstruction[5].u.operand;
+
+    JumpList isNotObject;
+
+    emitLoad(base, regT1, regT0);
+    if (!m_codeBlock->isKnownNotImmediate(base))
+        isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
+    if (base != m_codeBlock->thisRegister()) {
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    }
+
+    // We could inline the case where you have a valid cache, but
+    // this call doesn't seem to be hot.
+    Label isObject(this);
+    JITStubCall getPnamesStubCall(this, cti_op_get_pnames);
+    getPnamesStubCall.addArgument(regT0);
+    getPnamesStubCall.call(dst);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
+    store32(Imm32(0), addressFor(i));
+    store32(regT3, addressFor(size));
+    Jump end = jump();
+
+    isNotObject.link(this);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::NullTag)), breakTarget);
+    addJump(branch32(Equal, regT1, Imm32(JSValue::UndefinedTag)), breakTarget);
+    JITStubCall toObjectStubCall(this, cti_to_object);
+    toObjectStubCall.addArgument(regT1, regT0);
+    toObjectStubCall.call(base);
+    jump().linkTo(isObject, this);
+    
+    end.link(this);
+}
+
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
     int dst = currentInstruction[1].u.operand;
-    int iter = currentInstruction[2].u.operand;
-    int target = currentInstruction[3].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int it = currentInstruction[5].u.operand;
+    int target = currentInstruction[6].u.operand;
+    
+    JumpList callHasProperty;
 
-    load32(Address(callFrameRegister, (iter * sizeof(Register))), regT0);
+    Label begin(this);
+    load32(addressFor(i), regT0);
+    Jump end = branch32(Equal, regT0, addressFor(size));
 
-    JITStubCall stubCall(this, cti_op_next_pname);
+    // Grab key @ i
+    loadPtr(addressFor(it), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+    load32(BaseIndex(regT2, regT0, TimesEight), regT2);
+    store32(Imm32(JSValue::CellTag), tagFor(dst));
+    store32(regT2, payloadFor(dst));
+
+    // Increment i
+    add32(Imm32(1), regT0);
+    store32(regT0, addressFor(i));
+
+    // Verify that i is valid:
+    loadPtr(addressFor(base), regT0);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
+
+    // Test base's prototype chain
+    loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
+    addJump(branchTestPtr(Zero, Address(regT3)), target);
+
+    Label checkPrototype(this);
+    callHasProperty.append(branch32(Equal, Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::NullTag)));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
+    addPtr(Imm32(sizeof(Structure*)), regT3);
+    branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
+
+    // Continue loop.
+    addJump(jump(), target);
+
+    // Slow case: Ask the object if i is valid.
+    callHasProperty.link(this);
+    loadPtr(addressFor(dst), regT1);
+    JITStubCall stubCall(this, cti_has_property);
     stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
     stubCall.call();
 
-    Jump endOfIter = branchTestPtr(Zero, regT0);
-    emitStore(dst, regT1, regT0);
-    map(m_bytecodeIndex + OPCODE_LENGTH(op_next_pname), dst, regT1, regT0);
-    addJump(jump(), target + 3);
-    endOfIter.link(this);
+    // Test for valid key.
+    addJump(branchTest32(NonZero, regT0), target);
+    jump().linkTo(begin, this);
+
+    // End of loop.
+    end.link(this);
 }
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
@@ -1281,7 +1355,7 @@ void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
     JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
-    addJump(jump(), currentInstruction[2].u.operand + 2);
+    addJump(jump(), currentInstruction[2].u.operand);
 }
 
 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
@@ -1718,7 +1792,6 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     // Setup arg4: This is a plain hack
     move(stackPointerRegister, ARMRegisters::S0);
 
-    move(ctiReturnRegister, ARMRegisters::lr);
     call(Address(regT1, OBJECT_OFFSETOF(JSFunction, m_data)));
 
     addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
@@ -1749,7 +1822,7 @@ void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executable
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     move(ImmPtr(&globalData->exceptionLocation), regT2);
     storePtr(regT1, regT2);
-    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
     restoreReturnAddressBeforeReturn(regT2);
@@ -1825,8 +1898,8 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 void JIT::emit_op_jmp(Instruction* currentInstruction)
 {
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
-    RECORD_JUMP_TARGET(target + 1);
+    addJump(jump(), target);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_loop(Instruction* currentInstruction)
@@ -1834,7 +1907,7 @@ void JIT::emit_op_loop(Instruction* currentInstruction)
     emitTimeoutCheck();
 
     unsigned target = currentInstruction[1].u.operand;
-    addJump(jump(), target + 1);
+    addJump(jump(), target);
 }
 
 void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
@@ -1852,7 +1925,7 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
@@ -1861,12 +1934,12 @@ void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
 #else
         int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target + 3);
+        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThan, regT0, regT1), target + 3);
+        addJump(branch32(LessThan, regT0, regT1), target);
     }
 }
 
@@ -1885,12 +1958,12 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
 #else
         int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-        addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
+        addJump(branch32(LessThanOrEqual, regT0, regT1), target);
     }
 }
 
@@ -1901,30 +1974,26 @@ void JIT::emit_op_new_object(Instruction* currentInstruction)
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
 {
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
     // Load the operands (baseVal, proto, and value respectively) into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
-    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
-    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
-    emitGetVirtualRegister(currentInstruction[2].u.operand, regT2);
+    emitGetVirtualRegister(value, regT2);
+    emitGetVirtualRegister(baseVal, regT0);
+    emitGetVirtualRegister(proto, regT1);
 
     // Check that baseVal & proto are cells.
-    emitJumpSlowCaseIfNotJSCell(regT0);
-    emitJumpSlowCaseIfNotJSCell(regT1);
+    emitJumpSlowCaseIfNotJSCell(regT2, value);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVal);
+    emitJumpSlowCaseIfNotJSCell(regT1, proto);
 
-    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    // Check that baseVal 'ImplementsDefaultHasInstance'.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
 
-    // If value is not an Object, return false.
-    Jump valueIsImmediate = emitJumpIfNotJSCell(regT2);
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
-
-    // Check proto is object.
-    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
-    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
-
     // Optimistically load the result true, and start looping.
     // Initially, regT1 still contains proto and regT2 still contains value.
     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
@@ -1936,16 +2005,14 @@ void JIT::emit_op_instanceof(Instruction* currentInstruction)
     loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
     Jump isInstance = branchPtr(Equal, regT2, regT1);
-    branchPtr(NotEqual, regT2, ImmPtr(JSValue::encode(jsNull())), loop);
+    emitJumpIfJSCell(regT2).linkTo(loop, this);
 
     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
-    valueIsImmediate.link(this);
-    valueIsNotObject.link(this);
     move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
 
     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
     isInstance.link(this);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    emitPutVirtualRegister(dst);
 }
 
 void JIT::emit_op_new_func(Instruction* currentInstruction)
@@ -2122,9 +2189,9 @@ void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+    addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
@@ -2191,14 +2258,14 @@ void JIT::emit_op_jfalse(Instruction* currentInstruction)
     unsigned target = currentInstruction[2].u.operand;
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target);
     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
 
     isNonZero.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 };
 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 {
@@ -2210,16 +2277,16 @@ void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
     andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 };
 void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 {
@@ -2231,16 +2298,16 @@ void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 
     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
     loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target);
     Jump wasNotImmediate = jump();
 
     // Now handle the immediate cases - undefined & null
     isImmediate.link(this);
     andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target);            
 
     wasNotImmediate.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
@@ -2250,9 +2317,9 @@ void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
     unsigned target = currentInstruction[3].u.operand;
     
     emitGetVirtualRegister(src, regT0);
-    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target + 3);            
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target);            
 
-    RECORD_JUMP_TARGET(target + 3);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_jsr(Instruction* currentInstruction)
@@ -2260,10 +2327,10 @@ void JIT::emit_op_jsr(Instruction* currentInstruction)
     int retAddrDst = currentInstruction[1].u.operand;
     int target = currentInstruction[2].u.operand;
     DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
-    addJump(jump(), target + 2);
+    addJump(jump(), target);
     m_jsrSites.append(JSRInfo(storeLocation, label()));
     killLastResultRegister();
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_sret(Instruction* currentInstruction)
@@ -2315,13 +2382,13 @@ void JIT::emit_op_jtrue(Instruction* currentInstruction)
     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 
     Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
-    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+    addJump(emitJumpIfImmediateInteger(regT0), target);
 
-    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target);
     addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
 
     isZero.link(this);
-    RECORD_JUMP_TARGET(target + 2);
+    RECORD_JUMP_TARGET(target);
 }
 
 void JIT::emit_op_neq(Instruction* currentInstruction)
@@ -2372,15 +2439,116 @@ void JIT::emit_op_throw(Instruction* currentInstruction)
 #endif
 }
 
+void JIT::emit_op_get_pnames(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int breakTarget = currentInstruction[5].u.operand;
+
+    JumpList isNotObject;
+
+    emitGetVirtualRegister(base, regT0);
+    if (!m_codeBlock->isKnownNotImmediate(base))
+        isNotObject.append(emitJumpIfNotJSCell(regT0));
+    if (base != m_codeBlock->thisRegister()) {
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        isNotObject.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    }
+
+    // We could inline the case where you have a valid cache, but
+    // this call doesn't seem to be hot.
+    Label isObject(this);
+    JITStubCall getPnamesStubCall(this, cti_op_get_pnames);
+    getPnamesStubCall.addArgument(regT0);
+    getPnamesStubCall.call(dst);
+    load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
+    store32(Imm32(0), addressFor(i));
+    store32(regT3, addressFor(size));
+    Jump end = jump();
+
+    isNotObject.link(this);
+    move(regT0, regT1);
+    and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT1);
+    addJump(branch32(Equal, regT1, Imm32(JSImmediate::FullTagTypeNull)), breakTarget);
+
+    JITStubCall toObjectStubCall(this, cti_to_object);
+    toObjectStubCall.addArgument(regT0);
+    toObjectStubCall.call(base);
+    jump().linkTo(isObject, this);
+    
+    end.link(this);
+}
+
 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_next_pname);
-    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+    int i = currentInstruction[3].u.operand;
+    int size = currentInstruction[4].u.operand;
+    int it = currentInstruction[5].u.operand;
+    int target = currentInstruction[6].u.operand;
+    
+    JumpList callHasProperty;
+
+    Label begin(this);
+    load32(addressFor(i), regT0);
+    Jump end = branch32(Equal, regT0, addressFor(size));
+
+    // Grab key @ i
+    loadPtr(addressFor(it), regT1);
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
+
+#if USE(JSVALUE64)
+    loadPtr(BaseIndex(regT2, regT0, TimesEight), regT2);
+#else
+    loadPtr(BaseIndex(regT2, regT0, TimesFour), regT2);
+#endif
+
+    emitPutVirtualRegister(dst, regT2);
+
+    // Increment i
+    add32(Imm32(1), regT0);
+    store32(regT0, addressFor(i));
+
+    // Verify that i is valid:
+    emitGetVirtualRegister(base, regT0);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
+
+    // Test base's prototype chain
+    loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
+    addJump(branchTestPtr(Zero, Address(regT3)), target);
+
+    Label checkPrototype(this);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    callHasProperty.append(emitJumpIfNotJSCell(regT2));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
+    addPtr(Imm32(sizeof(Structure*)), regT3);
+    branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
+
+    // Continue loop.
+    addJump(jump(), target);
+
+    // Slow case: Ask the object if i is valid.
+    callHasProperty.link(this);
+    emitGetVirtualRegister(dst, regT1);
+    JITStubCall stubCall(this, cti_has_property);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
     stubCall.call();
-    Jump endOfIter = branchTestPtr(Zero, regT0);
-    emitPutVirtualRegister(currentInstruction[1].u.operand);
-    addJump(jump(), currentInstruction[3].u.operand + 3);
-    endOfIter.link(this);
+
+    // Test for valid key.
+    addJump(branchTest32(NonZero, regT0), target);
+    jump().linkTo(begin, this);
+
+    // End of loop.
+    end.link(this);
 }
 
 void JIT::emit_op_push_scope(Instruction* currentInstruction)
@@ -2464,8 +2632,8 @@ void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
     JITStubCall stubCall(this, cti_op_jmp_scopes);
     stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.call();
-    addJump(jump(), currentInstruction[2].u.operand + 2);
-    RECORD_JUMP_TARGET(currentInstruction[2].u.operand + 2);
+    addJump(jump(), currentInstruction[2].u.operand);
+    RECORD_JUMP_TARGET(currentInstruction[2].u.operand);
 }
 
 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
@@ -2718,14 +2886,14 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         stubCall.addArgument(regT0);
         stubCall.addArgument(op2, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
         JITStubCall stubCall(this, cti_op_loop_if_less);
         stubCall.addArgument(op1, regT2);
         stubCall.addArgument(regT0);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
@@ -2733,7 +2901,7 @@ void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowC
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     }
 }
 
@@ -2747,7 +2915,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
         stubCall.addArgument(regT0);
         stubCall.addArgument(currentInstruction[2].u.operand, regT2);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     } else {
         linkSlowCase(iter);
         linkSlowCase(iter);
@@ -2755,7 +2923,7 @@ void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<Slo
         stubCall.addArgument(regT0);
         stubCall.addArgument(regT1);
         stubCall.call();
-        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target);
     }
 }
 
@@ -2783,7 +2951,7 @@ void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowC
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2801,7 +2969,7 @@ void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEnt
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand); // inverted!
 }
 
 void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2818,7 +2986,7 @@ void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntr
     JITStubCall stubCall(this, cti_op_jtrue);
     stubCall.addArgument(regT0);
     stubCall.call();
-    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand);
 }
 
 void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -2884,16 +3052,20 @@ void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCase
 
 void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned value = currentInstruction[2].u.operand;
+    unsigned baseVal = currentInstruction[3].u.operand;
+    unsigned proto = currentInstruction[4].u.operand;
+
+    linkSlowCaseIfNotJSCell(iter, value);
+    linkSlowCaseIfNotJSCell(iter, baseVal);
+    linkSlowCaseIfNotJSCell(iter, proto);
     linkSlowCase(iter);
     JITStubCall stubCall(this, cti_op_instanceof);
-    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
-    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
-    stubCall.addArgument(currentInstruction[4].u.operand, regT2);
-    stubCall.call(currentInstruction[1].u.operand);
+    stubCall.addArgument(value, regT2);
+    stubCall.addArgument(baseVal, regT2);
+    stubCall.addArgument(proto, regT2);
+    stubCall.call(dst);
 }
 
 void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 9edfd01..bf367a6 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -33,6 +33,7 @@
 #include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
+#include "JSPropertyNameIterator.h"
 #include "Interpreter.h"
 #include "LinkBuffer.h"
 #include "RepatchBuffer.h"
@@ -521,22 +522,26 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     load32(Address(temp, offset + 4), resultTag);
 }
 
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+
+    failureCases.append(branchPtr(NotEqual, AbsoluteAddress(&asCell(structure->m_prototype)->m_structure), ImmPtr(asCell(structure->m_prototype)->m_structure)));
+}
+
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     // It is assumed that regT0 contains the basePayload and regT1 contains the baseTag.  The value can be found on the stack.
 
     JumpList failureCases;
     failureCases.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(oldStructure)));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
+    testPrototype(oldStructure, failureCases);
 
     // Verify that nothing in the prototype chain has a setter for this property. 
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        failureCases.append(branchPtr(NotEqual, regT2, ImmPtr(it->get())));
-    }
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
 
     // Reallocate property storage if needed.
     Call callTarget;
@@ -930,6 +935,69 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 #endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID structure, RegisterID offset)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSValue) == 8);
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    finishedLoad.link(this);
+}
+
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+
+    emitLoad2(property, regT1, regT0, base, regT3, regT2);
+    emitJumpSlowCaseIfNotJSCell(property, regT1);
+    addSlowCase(branchPtr(NotEqual, regT0, payloadFor(expected)));
+    // Property registers are now available as the property is known
+    emitJumpSlowCaseIfNotJSCell(base, regT3);
+    emitLoadPayload(iter, regT1);
+    
+    // Test base's structure
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT2, regT1, regT0, regT0, regT3);    
+
+    emitStore(dst, regT1, regT0);
+    map(m_bytecodeIndex + OPCODE_LENGTH(op_get_by_pname), dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    
+    linkSlowCaseIfNotJSCell(iter, property);
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base);
+    stubCall.addArgument(property);
+    stubCall.call(dst);
+}
+
 #else // USE(JSVALUE32_64)
 
 void JIT::emit_op_get_by_val(Instruction* currentInstruction)
@@ -963,6 +1031,48 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     emitPutVirtualRegister(dst);
 }
 
+void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+    unsigned expected = currentInstruction[4].u.operand;
+    unsigned iter = currentInstruction[5].u.operand;
+    unsigned i = currentInstruction[6].u.operand;
+
+    emitGetVirtualRegister(property, regT0);
+    addSlowCase(branchPtr(NotEqual, regT0, addressFor(expected)));
+    emitGetVirtualRegisters(base, regT0, iter, regT1);
+    emitJumpSlowCaseIfNotJSCell(regT0, base);
+
+    // Test base's structure
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addSlowCase(branchPtr(NotEqual, regT2, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure))));
+    load32(addressFor(i), regT3);
+    sub32(Imm32(1), regT3);
+    addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    compileGetDirectOffset(regT0, regT0, regT2, regT3, regT1);
+
+    emitPutVirtualRegister(dst, regT0);
+}
+
+void JIT::emitSlow_op_get_by_pname(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned base = currentInstruction[2].u.operand;
+    unsigned property = currentInstruction[3].u.operand;
+
+    linkSlowCase(iter);
+    linkSlowCaseIfNotJSCell(iter, base);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, cti_op_get_by_val);
+    stubCall.addArgument(base, regT2);
+    stubCall.addArgument(property, regT2);
+    stubCall.call(dst);
+}
+
 void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
     unsigned base = currentInstruction[1].u.operand;
@@ -1128,9 +1238,9 @@ void JIT::emit_op_method_check(Instruction* currentInstruction)
 
     Jump match = jump();
 
-    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
-    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
-    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoObj), patchOffsetMethodCheckProtoObj);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, protoStructureToCompare), patchOffsetMethodCheckProtoStruct);
+    ASSERT_JIT_OFFSET(differenceBetween(info.structureToCompare, putFunction), patchOffsetMethodCheckPutFunction);
 
     // Link the failure cases here.
     notCell.link(this);
@@ -1197,22 +1307,22 @@ void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propert
     DataLabelPtr structureToCompare;
     Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
-    ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetGetByIdStructure);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureCheck), patchOffsetGetByIdBranchToSlowCase)
 
     Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
     Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, externalLoad), patchOffsetGetByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(externalLoad, externalLoadComplete), patchLengthGetByIdExternalLoad);
 
     DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel), patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 
-    ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, putResult), patchOffsetGetByIdPutResult);
 }
 
 void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -1247,7 +1357,7 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdSlowCase);
 
-    ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
+    ASSERT_JIT_OFFSET(differenceBetween(coldPathBegin, call), patchOffsetGetByIdSlowCaseCall);
 
     // Track the location of the call; this will be used to recover patch information.
     m_propertyAccessCompilationInfo[m_propertyAccessInstructionIndex].callReturnLocation = call;
@@ -1278,19 +1388,19 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
     addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
-    ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, structureToCompare), patchOffsetPutByIdStructure);
 
     // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
     Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
     Label externalLoadComplete(this);
-    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
-    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, externalLoad), patchOffsetPutByIdExternalLoad);
+    ASSERT_JIT_OFFSET(differenceBetween(externalLoad, externalLoadComplete), patchLengthPutByIdExternalLoad);
 
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
 
     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
 
-    ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
+    ASSERT_JIT_OFFSET(differenceBetween(hotPathBegin, displacementLabel), patchOffsetPutByIdPropertyMapOffset);
 }
 
 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -1347,35 +1457,41 @@ void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID res
     } 
 }
 
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID structure, RegisterID offset, RegisterID scratch)
+{
+    ASSERT(sizeof(((Structure*)0)->m_propertyStorageCapacity) == sizeof(int32_t));
+    ASSERT(sizeof(JSObject::inlineStorageCapacity) == sizeof(int32_t));
+
+    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
+    loadPtr(BaseIndex(base, offset, ScalePtr, OBJECT_OFFSETOF(JSObject, m_inlineStorage)), result);
+    Jump finishedLoad = jump();
+    notUsingInlineStorage.link(this);
+    loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), scratch);
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);    
+    finishedLoad.link(this);
+}
+
+void JIT::testPrototype(Structure* structure, JumpList& failureCases)
+{
+    if (structure->m_prototype.isNull())
+        return;
+
+    move(ImmPtr(&asCell(structure->m_prototype)->m_structure), regT2);
+    move(ImmPtr(asCell(structure->m_prototype)->m_structure), regT3);
+    failureCases.append(branchPtr(NotEqual, Address(regT2), regT3));
+}
+
 void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     JumpList failureCases;
     // Check eax is an object of the right Structure.
     failureCases.append(emitJumpIfNotJSCell(regT0));
     failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
-    JumpList successCases;
+    testPrototype(oldStructure, failureCases);
 
-    // ecx = baseObject
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-    // proto(ecx) = baseObject->structure()->prototype()
-    failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
-
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-    
     // ecx = baseObject->m_structure
-    for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
-        // null check the prototype
-        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
-
-        // Check the structure id
-        failureCases.append(branchPtr(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(it->get())));
-        
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
-        failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
-        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
-    }
-
-    successCases.link(this);
+    for (RefPtr<Structure>* it = chain->head(); *it; ++it)
+        testPrototype(it->get(), failureCases);
 
     Call callTarget;
 
diff --git a/JavaScriptCore/jit/JITStubCall.h b/JavaScriptCore/jit/JITStubCall.h
index cb5354b..c5ed9e3 100644
--- a/JavaScriptCore/jit/JITStubCall.h
+++ b/JavaScriptCore/jit/JITStubCall.h
@@ -26,7 +26,7 @@
 #ifndef JITStubCall_h
 #define JITStubCall_h
 
-#include <wtf/Platform.h>
+#include "MacroAssemblerCodeRef.h"
 
 #if ENABLE(JIT)
 
@@ -36,7 +36,7 @@ namespace JSC {
     public:
         JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Cell)
             , m_stackIndex(stackIndexStart)
         {
@@ -44,7 +44,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Cell)
             , m_stackIndex(stackIndexStart)
         {
@@ -52,7 +52,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(VoidPtr)
             , m_stackIndex(stackIndexStart)
         {
@@ -60,7 +60,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Int)
             , m_stackIndex(stackIndexStart)
         {
@@ -68,7 +68,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, bool (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Int)
             , m_stackIndex(stackIndexStart)
         {
@@ -76,7 +76,7 @@ namespace JSC {
 
         JITStubCall(JIT* jit, void (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Void)
             , m_stackIndex(stackIndexStart)
         {
@@ -85,7 +85,7 @@ namespace JSC {
 #if USE(JSVALUE32_64)
         JITStubCall(JIT* jit, EncodedJSValue (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
             : m_jit(jit)
-            , m_stub(reinterpret_cast<void*>(stub))
+            , m_stub(stub)
             , m_returnType(Value)
             , m_stackIndex(stackIndexStart)
         {
@@ -171,7 +171,7 @@ namespace JSC {
 
             m_jit->restoreArgumentReference();
             JIT::Call call = m_jit->call();
-            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
+            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub.value()));
 
 #if ENABLE(OPCODE_SAMPLING)
             if (m_jit->m_bytecodeIndex != (unsigned)-1)
@@ -225,7 +225,7 @@ namespace JSC {
         static const size_t stackIndexStart = 1; // Index 0 is reserved for restoreArgumentReference().
 
         JIT* m_jit;
-        void* m_stub;
+        FunctionPtr m_stub;
         enum { Void, VoidPtr, Int, Value, Cell } m_returnType;
         size_t m_stackIndex;
     };
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index c7257af..c999618 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -535,37 +535,27 @@ asm volatile (
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "stmdb sp!, {r1-r3}" "\n"
     "stmdb sp!, {r4-r8, lr}" "\n"
-    "mov r6, pc" "\n"
-    "add r6, r6, #40" "\n"
-    "sub sp, sp, #32" "\n"
-    "ldr r4, [sp, #60]" "\n"
+    "sub sp, sp, #36" "\n"
+    "mov r4, r2" "\n"
     "mov r5, #512" "\n"
-    // r0 contains the code
-    "add r8, pc, #4" "\n"
-    "str r8, [sp, #-4]!" "\n"
+    "mov lr, pc" "\n"
     "mov pc, r0" "\n"
-    "add sp, sp, #32" "\n"
+    "add sp, sp, #36" "\n"
     "ldmia sp!, {r4-r8, lr}" "\n"
     "add sp, sp, #12" "\n"
     "mov pc, lr" "\n"
-
-    // the return instruction
-    "ldr pc, [sp], #4" "\n"
 );
 
 asm volatile (
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov r0, sp" "\n"
-    "mov lr, r6" "\n"
-    "add r8, pc, #4" "\n"
-    "str r8, [sp, #-4]!" "\n"
-    "b " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
+    "bl " SYMBOL_STRING_RELOCATION(cti_vm_throw) "\n"
 
 // Both has the same return sequence
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
-    "add sp, sp, #32" "\n"
+    "add sp, sp, #36" "\n"
     "ldmia sp!, {r4-r8, lr}" "\n"
     "add sp, sp, #12" "\n"
     "mov pc, lr" "\n"
@@ -700,11 +690,15 @@ NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* co
 
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
-        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-        if (!prototypeChain->isCacheable() || structure->isDictionary()) {
+        if (structure->isDictionary()) {
             ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_put_by_id_generic));
             return;
         }
+
+        // put_by_id_transition checks the prototype chain for setters.
+        normalizePrototypeChain(callFrame, baseCell);
+
+        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
         stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
         JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress);
         return;
@@ -780,17 +774,13 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
 
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase());
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
         return;
     }
 
     StructureChain* prototypeChain = structure->prototypeChain(callFrame);
-    if (!prototypeChain->isCacheable()) {
-        ctiPatchCallByReturnAddress(codeBlock, returnAddress, FunctionPtr(cti_op_get_by_id_generic));
-        return;
-    }
     stubInfo->initGetByIdChain(structure, prototypeChain);
     JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
 }
@@ -908,6 +898,22 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
 
+#elif PLATFORM(ARM_TRADITIONAL) && COMPILER(GCC)
+
+#define DEFINE_STUB_FUNCTION(rtype, op) \
+    extern "C" { \
+        rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
+    }; \
+    asm volatile ( \
+        ".globl " SYMBOL_STRING(cti_##op) "\n" \
+        SYMBOL_STRING(cti_##op) ":" "\n" \
+        "str lr, [sp, #32]" "\n" \
+        "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
+        "ldr lr, [sp, #32]" "\n" \
+        "mov pc, lr" "\n" \
+        ); \
+    rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
+
 #else
 #define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
 #endif
@@ -1332,15 +1338,11 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
-        StructureChain* protoChain = structure->prototypeChain(callFrame);
-        if (!protoChain->isCacheable()) {
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
-            return JSValue::encode(result);
-        }
-        
+    } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase())) {
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+
+        StructureChain* protoChain = structure->prototypeChain(callFrame);
         JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
 
         if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
@@ -1418,7 +1420,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
 
     // ECMA-262 15.3.5.3:
     // Throw an exception either if baseVal is not an object, or if it does not implement 'HasInstance' (i.e. is a function).
-    TypeInfo typeInfo(UnspecifiedType, 0);
+    TypeInfo typeInfo(UnspecifiedType);
     if (!baseVal.isObject() || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance()) {
         CallFrame* callFrame = stackFrame.callFrame;
         CodeBlock* codeBlock = callFrame->codeBlock();
@@ -2656,7 +2658,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
 
     if (!handler) {
         *stackFrame.exception = exceptionValue;
-        STUB_SET_RETURN_ADDRESS(reinterpret_cast<void*>(ctiOpThrowNotCaught));
+        STUB_SET_RETURN_ADDRESS(FunctionPtr(ctiOpThrowNotCaught).value());
         return JSValue::encode(jsNull());
     }
 
@@ -2671,18 +2673,22 @@ DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSPropertyNameIterator::create(stackFrame.callFrame, stackFrame.args[0].jsValue());
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSObject* o = stackFrame.args[0].jsObject();
+    Structure* structure = o->structure();
+    JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
+    if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(callFrame))
+        jsPropertyNameIterator = JSPropertyNameIterator::create(callFrame, o);
+    return jsPropertyNameIterator;
 }
 
-DEFINE_STUB_FUNCTION(EncodedJSValue, op_next_pname)
+DEFINE_STUB_FUNCTION(int, has_property)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    JSPropertyNameIterator* it = stackFrame.args[0].propertyNameIterator();
-    JSValue temp = it->next(stackFrame.callFrame);
-    if (!temp)
-        it->invalidate();
-    return JSValue::encode(temp);
+    JSObject* base = stackFrame.args[0].jsObject();
+    JSString* property = stackFrame.args[1].jsString();
+    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
 }
 
 DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
@@ -3023,6 +3029,14 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
     return JSValue::encode(exceptionValue);
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, to_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    return JSValue::encode(stackFrame.args[0].jsValue().toObject(callFrame));
+}
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITStubs.h b/JavaScriptCore/jit/JITStubs.h
index daae043..69776cb 100644
--- a/JavaScriptCore/jit/JITStubs.h
+++ b/JavaScriptCore/jit/JITStubs.h
@@ -63,6 +63,7 @@ namespace JSC {
         int32_t asInt32;
 
         JSValue jsValue() { return JSValue::decode(asEncodedJSValue); }
+        JSObject* jsObject() { return static_cast<JSObject*>(asPointer); }
         Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
         int32_t int32() { return asInt32; }
         CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
@@ -162,6 +163,8 @@ namespace JSC {
         JITStubArg padding; // Unused
         JITStubArg args[7];
 
+        ReturnAddressPtr thunkReturnAddress;
+
         void* preservedR4;
         void* preservedR5;
         void* preservedR6;
@@ -172,11 +175,13 @@ namespace JSC {
         RegisterFile* registerFile;
         CallFrame* callFrame;
         JSValue* exception;
+
+        // These arguments passed on the stack.
         Profiler** enabledProfilerReference;
         JSGlobalData* globalData;
 
         // When JIT code makes a call, it pushes its return address just below the rest of the stack.
-        ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
+        ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
     };
 #else
 #error "JITStackFrame not defined for this platform."
@@ -285,7 +290,6 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
-    EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
@@ -307,6 +311,7 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_to_object(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
     JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
@@ -332,6 +337,7 @@ extern "C" {
     int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
     int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_has_property(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
     void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
diff --git a/JavaScriptCore/jsc.cpp b/JavaScriptCore/jsc.cpp
index 9399b1a..b6bc0aa 100644
--- a/JavaScriptCore/jsc.cpp
+++ b/JavaScriptCore/jsc.cpp
@@ -29,6 +29,7 @@
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "JSLock.h"
+#include "JSString.h"
 #include "PrototypeFunction.h"
 #include "SamplingTool.h"
 #include <math.h>
diff --git a/JavaScriptCore/jsc.pro b/JavaScriptCore/jsc.pro
index ba880ff..c6efabc 100644
--- a/JavaScriptCore/jsc.pro
+++ b/JavaScriptCore/jsc.pro
@@ -29,3 +29,7 @@ lessThan(QT_MINOR_VERSION, 4) {
 
 *-g++*:QMAKE_CXXFLAGS_RELEASE -= -O2
 *-g++*:QMAKE_CXXFLAGS_RELEASE += -O3
+
+symbian {
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/JavaScriptCore/parser/Grammar.y b/JavaScriptCore/parser/Grammar.y
index 85fd163..6d953df 100644
--- a/JavaScriptCore/parser/Grammar.y
+++ b/JavaScriptCore/parser/Grammar.y
@@ -27,6 +27,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Lexer.h"
 #include "NodeConstructors.h"
 #include "NodeInfo.h"
 #include <stdlib.h>
@@ -48,7 +49,6 @@
 #define YYERROR_VERBOSE
 #endif
 
-int jscyylex(void* lvalp, void* llocp, void* globalPtr);
 int jscyyerror(const char*);
 
 static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index 785b219..df30838 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -46,12 +46,6 @@ using namespace JSC;
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
-// A bridge for yacc from the C world to the C++ world.
-int jscyylex(void* lvalp, void* llocp, void* globalData)
-{
-    return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
-}
-
 namespace JSC {
 
 static const UChar byteOrderMark = 0xFEFF;
diff --git a/JavaScriptCore/parser/Lexer.h b/JavaScriptCore/parser/Lexer.h
index 174e05a..c76696c 100644
--- a/JavaScriptCore/parser/Lexer.h
+++ b/JavaScriptCore/parser/Lexer.h
@@ -136,6 +136,12 @@ namespace JSC {
         return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
     }
 
+    // A bridge for yacc from the C world to the C++ world.
+    inline int jscyylex(void* lvalp, void* llocp, void* globalData)
+    {
+        return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
+    }
+
 } // namespace JSC
 
 #endif // Lexer_h
diff --git a/JavaScriptCore/parser/Nodes.cpp b/JavaScriptCore/parser/Nodes.cpp
index 3bd318a..45009dc 100644
--- a/JavaScriptCore/parser/Nodes.cpp
+++ b/JavaScriptCore/parser/Nodes.cpp
@@ -1468,20 +1468,24 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     if (!m_lexpr->isLocation())
         return emitThrowError(generator, ReferenceError, "Left side of for-in statement is not a reference.");
 
-    RefPtr<Label> continueTarget = generator.newLabel(); 
-
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
         generator.emitNode(generator.ignoredResult(), m_init);
-    RegisterID* forInBase = generator.emitNode(m_expr);
-    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
+
+    RefPtr<RegisterID> base = generator.newTemporary();
+    generator.emitNode(base.get(), m_expr);
+    RefPtr<RegisterID> i = generator.newTemporary();
+    RefPtr<RegisterID> size = generator.newTemporary();
+    RefPtr<RegisterID> expectedSubscript;
+    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), base.get(), i.get(), size.get(), scope->breakTarget());
     generator.emitJump(scope->continueTarget());
 
     RefPtr<Label> loopStart = generator.newLabel();
     generator.emitLabel(loopStart.get());
 
     RegisterID* propertyName;
+    bool optimizedForinAccess = false;
     if (m_lexpr->isResolveNode()) {
         const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
         propertyName = generator.registerFor(ident);
@@ -1492,6 +1496,10 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
             generator.emitExpressionInfo(divot(), startOffset(), endOffset());
             generator.emitPutById(base, ident, propertyName);
+        } else {
+            expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
+            generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
+            optimizedForinAccess = true;
         }
     } else if (m_lexpr->isDotAccessorNode()) {
         DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
@@ -1516,8 +1524,11 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     generator.emitNode(dst, m_statement);
 
+    if (optimizedForinAccess)
+        generator.popOptimisedForIn();
+
     generator.emitLabel(scope->continueTarget());
-    generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
+    generator.emitNextPropertyName(propertyName, base.get(), i.get(), size.get(), iter.get(), loopStart.get());
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     generator.emitLabel(scope->breakTarget());
     return dst;
diff --git a/JavaScriptCore/runtime/Arguments.h b/JavaScriptCore/runtime/Arguments.h
index 5be84a2..9b674a2 100644
--- a/JavaScriptCore/runtime/Arguments.h
+++ b/JavaScriptCore/runtime/Arguments.h
@@ -85,9 +85,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
+
     private:
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
diff --git a/JavaScriptCore/runtime/ArrayConstructor.cpp b/JavaScriptCore/runtime/ArrayConstructor.cpp
index 0237fd4..fb44494 100644
--- a/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -50,7 +50,7 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, NonNullPassRefPtr<Structure>
     putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isArray, arrayConstructorIsArray), DontEnum);
 }
 
-static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
+static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
     // a single numeric argument denotes the array size (!)
     if (args.size() == 1 && args.at(0).isNumber()) {
diff --git a/JavaScriptCore/runtime/BooleanObject.h b/JavaScriptCore/runtime/BooleanObject.h
index 28f796a..69c2e51 100644
--- a/JavaScriptCore/runtime/BooleanObject.h
+++ b/JavaScriptCore/runtime/BooleanObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
     };
 
diff --git a/JavaScriptCore/runtime/Collector.cpp b/JavaScriptCore/runtime/Collector.cpp
index 1a5eb89..1b238d9 100644
--- a/JavaScriptCore/runtime/Collector.cpp
+++ b/JavaScriptCore/runtime/Collector.cpp
@@ -1228,6 +1228,10 @@ static const char* typeName(JSCell* cell)
 #endif
     if (cell->isGetterSetter())
         return "gettersetter";
+    if (cell->isAPIValueWrapper())
+        return "value wrapper";
+    if (cell->isPropertyNameIterator())
+        return "for-in iterator";
     ASSERT(cell->isObject());
     const ClassInfo* info = cell->classInfo();
     return info ? info->className : "Object";
diff --git a/JavaScriptCore/runtime/Collector.h b/JavaScriptCore/runtime/Collector.h
index 2ce13dc..9ca9d18 100644
--- a/JavaScriptCore/runtime/Collector.h
+++ b/JavaScriptCore/runtime/Collector.h
@@ -71,14 +71,6 @@ namespace JSC {
 
         void destroy();
 
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-        // We can inline these functions because everything is compiled as
-        // one file, so the heapAllocate template definitions are available.
-        // However, allocateNumber is used via jsNumberCell outside JavaScriptCore.
-        // Thus allocateNumber needs to provide a non-inline version too.
-        void* inlineAllocateNumber(size_t s) { return heapAllocate<NumberHeap>(s); }
-        void* inlineAllocate(size_t s) { return heapAllocate<PrimaryHeap>(s); }
-#endif
         void* allocateNumber(size_t);
         void* allocate(size_t);
 
diff --git a/JavaScriptCore/runtime/DateConstructor.cpp b/JavaScriptCore/runtime/DateConstructor.cpp
index f9b7d84..9908fef 100644
--- a/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/JavaScriptCore/runtime/DateConstructor.cpp
@@ -112,9 +112,7 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
         }
     }
 
-    DateInstance* result = new (exec) DateInstance(exec->lexicalGlobalObject()->dateStructure());
-    result->setInternalValue(jsNumber(exec, timeClip(value)));
-    return result;
+    return new (exec) DateInstance(exec, value);
 }
     
 static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args)
diff --git a/JavaScriptCore/runtime/DateInstance.cpp b/JavaScriptCore/runtime/DateInstance.cpp
index 4cd58f5..d4c9ef7 100644
--- a/JavaScriptCore/runtime/DateInstance.cpp
+++ b/JavaScriptCore/runtime/DateInstance.cpp
@@ -32,95 +32,43 @@ using namespace WTF;
 
 namespace JSC {
 
-struct DateInstance::Cache {
-    double m_gregorianDateTimeCachedForMS;
-    GregorianDateTime m_cachedGregorianDateTime;
-    double m_gregorianDateTimeUTCCachedForMS;
-    GregorianDateTime m_cachedGregorianDateTimeUTC;
-};
-
 const ClassInfo DateInstance::info = {"Date", 0, 0, 0};
 
-DateInstance::DateInstance(NonNullPassRefPtr<Structure> structure)
+DateInstance::DateInstance(ExecState* exec, NonNullPassRefPtr<Structure> structure)
     : JSWrapperObject(structure)
-    , m_cache(0)
 {
+    setInternalValue(jsNaN(exec));
 }
 
 DateInstance::DateInstance(ExecState* exec, double time)
     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
-    , m_cache(0)
 {
     setInternalValue(jsNumber(exec, timeClip(time)));
 }
 
-DateInstance::~DateInstance()
+bool DateInstance::getGregorianDateTime(ExecState* exec, bool outputIsUTC, GregorianDateTime& t) const
 {
-    delete m_cache;
-}
+    double milli = internalNumber();
+    if (isnan(milli))
+        return false;
 
-void DateInstance::msToGregorianDateTime(double milli, bool outputIsUTC, GregorianDateTime& t) const
-{
-    if (!m_cache) {
-        m_cache = new Cache;
-        m_cache->m_gregorianDateTimeCachedForMS = NaN;
-        m_cache->m_gregorianDateTimeUTCCachedForMS = NaN;
-    }
+    if (!m_data)
+        m_data = exec->globalData().dateInstanceCache.add(milli);
 
     if (outputIsUTC) {
-        if (m_cache->m_gregorianDateTimeUTCCachedForMS != milli) {
-            WTF::msToGregorianDateTime(milli, true, m_cache->m_cachedGregorianDateTimeUTC);
-            m_cache->m_gregorianDateTimeUTCCachedForMS = milli;
+        if (m_data->m_gregorianDateTimeUTCCachedForMS != milli) {
+            WTF::msToGregorianDateTime(internalNumber(), true, m_data->m_cachedGregorianDateTimeUTC);
+            m_data->m_gregorianDateTimeUTCCachedForMS = milli;
         }
-        t.copyFrom(m_cache->m_cachedGregorianDateTimeUTC);
+        t.copyFrom(m_data->m_cachedGregorianDateTimeUTC);
     } else {
-        if (m_cache->m_gregorianDateTimeCachedForMS != milli) {
-            WTF::msToGregorianDateTime(milli, false, m_cache->m_cachedGregorianDateTime);
-            m_cache->m_gregorianDateTimeCachedForMS = milli;
+        if (m_data->m_gregorianDateTimeCachedForMS != milli) {
+            WTF::msToGregorianDateTime(internalNumber(), false, m_data->m_cachedGregorianDateTime);
+            m_data->m_gregorianDateTimeCachedForMS = milli;
         }
-        t.copyFrom(m_cache->m_cachedGregorianDateTime);
+        t.copyFrom(m_data->m_cachedGregorianDateTime);
     }
-}
 
-bool DateInstance::getTime(GregorianDateTime& t, int& offset) const
-{
-    double milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
-    msToGregorianDateTime(milli, false, t);
-    offset = gmtoffset(t);
-    return true;
-}
-
-bool DateInstance::getUTCTime(GregorianDateTime& t) const
-{
-    double milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
-    msToGregorianDateTime(milli, true, t);
-    return true;
-}
-
-bool DateInstance::getTime(double& milli, int& offset) const
-{
-    milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
-    GregorianDateTime t;
-    msToGregorianDateTime(milli, false, t);
-    offset = gmtoffset(t);
-    return true;
-}
-
-bool DateInstance::getUTCTime(double& milli) const
-{
-    milli = internalNumber();
-    if (isnan(milli))
-        return false;
-    
     return true;
 }
 
diff --git a/JavaScriptCore/runtime/DateInstance.h b/JavaScriptCore/runtime/DateInstance.h
index 36d90b1..38b321c 100644
--- a/JavaScriptCore/runtime/DateInstance.h
+++ b/JavaScriptCore/runtime/DateInstance.h
@@ -32,27 +32,26 @@ namespace JSC {
     class DateInstance : public JSWrapperObject {
     public:
         DateInstance(ExecState*, double);
-        explicit DateInstance(NonNullPassRefPtr<Structure>);
-        virtual ~DateInstance();
+        explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);
 
         double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
-        bool getTime(WTF::GregorianDateTime&, int& offset) const;
-        bool getUTCTime(WTF::GregorianDateTime&) const;
-        bool getTime(double& milliseconds, int& offset) const;
-        bool getUTCTime(double& milliseconds) const;
-
         static JS_EXPORTDATA const ClassInfo info;
 
-        void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
+        bool getGregorianDateTime(ExecState*, bool outputIsUTC, WTF::GregorianDateTime&) const;
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
+        }
+
+    protected:
+        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        using JSWrapperObject::internalValue;
-
-        struct Cache;
-        mutable Cache* m_cache;
+        mutable RefPtr<DateInstanceData> m_data;
     };
 
     DateInstance* asDateInstance(JSValue);
diff --git a/JavaScriptCore/runtime/DateInstanceCache.h b/JavaScriptCore/runtime/DateInstanceCache.h
new file mode 100644
index 0000000..b626c1d
--- /dev/null
+++ b/JavaScriptCore/runtime/DateInstanceCache.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateInstanceCache_h
+#define DateInstanceCache_h
+
+#include <wtf/DateMath.h>
+#include <wtf/HashFunctions.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace JSC {
+
+    extern const double NaN;
+
+    class DateInstanceData : public RefCounted<DateInstanceData> {
+    public:
+        static PassRefPtr<DateInstanceData> create() { return adoptRef(new DateInstanceData); }
+
+        double m_gregorianDateTimeCachedForMS;
+        WTF::GregorianDateTime m_cachedGregorianDateTime;
+        double m_gregorianDateTimeUTCCachedForMS;
+        WTF::GregorianDateTime m_cachedGregorianDateTimeUTC;
+
+    private:
+        DateInstanceData()
+            : m_gregorianDateTimeCachedForMS(NaN)
+            , m_gregorianDateTimeUTCCachedForMS(NaN)
+        {
+        }
+    };
+
+    class DateInstanceCache {
+    public:
+        DateInstanceCache()
+        {
+            for (size_t i = 0; i < cacheSize; ++i)
+                m_cache[i].key = NaN;
+        }
+        
+        DateInstanceData* add(double d)
+        {
+            CacheEntry& entry = lookup(d);
+            if (d == entry.key)
+                return entry.value.get();
+
+            entry.key = d;
+            entry.value = DateInstanceData::create();
+            return entry.value.get();
+        }
+
+    private:
+        static const size_t cacheSize = 64;
+
+        struct CacheEntry {
+            double key;
+            RefPtr<DateInstanceData> value;
+        };
+
+        CacheEntry& lookup(double d) { return m_cache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
+
+        CacheEntry m_cache[cacheSize];
+    };
+
+} // namespace JSC
+
+#endif // DateInstanceCache_h
diff --git a/JavaScriptCore/runtime/DatePrototype.cpp b/JavaScriptCore/runtime/DatePrototype.cpp
index e46ab67..3f3e1f9 100644
--- a/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/JavaScriptCore/runtime/DatePrototype.cpp
@@ -251,11 +251,12 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, L
     return jsNontrivialString(exec, timebuffer);
 }
 
-static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double timeInMilliseconds, LocaleDateTimeFormat format, const ArgList&)
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double, LocaleDateTimeFormat format, const ArgList&)
 {
     GregorianDateTime gregorianDateTime;
-    const bool notUTC = false;
-    dateObject->msToGregorianDateTime(timeInMilliseconds, notUTC, gregorianDateTime);
+    const bool outputIsUTC = false;
+    if (!dateObject->getGregorianDateTime(exec, outputIsUTC, gregorianDateTime))
+        return jsNontrivialString(exec, "Invalid Date");
     return formatLocaleDate(exec, gregorianDateTime, format);
 }
 
@@ -396,9 +397,8 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
 // ECMA 15.9.4
 
 DatePrototype::DatePrototype(ExecState* exec, NonNullPassRefPtr<Structure> structure)
-    : DateInstance(structure)
+    : DateInstance(exec, structure)
 {
-    setInternalValue(jsNaN(exec));
     // The constructor will be added later, after DateConstructor has been built.
 }
 
@@ -420,16 +420,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -437,16 +435,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -454,19 +450,17 @@ JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
     
-    const bool utc = true;
+    const bool outputIsUTC = true;
     
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (!isfinite(milli))
-        return jsNontrivialString(exec, "Invalid Date");
     
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
     // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second) + 4 (. + 3 digits for milliseconds)
     // 6 for formatting and one for null termination = 27.  We add one extra character to allow us to force null termination.
     char buffer[28];
-    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(milli, 1000)));
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02d.%03dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second, static_cast<int>(fmod(thisDateObj->internalNumber(), 1000)));
     buffer[sizeof(buffer) - 1] = 0;
     return jsNontrivialString(exec, buffer);
 }
@@ -476,15 +470,13 @@ JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
     return jsNontrivialString(exec, formatDate(t));
 }
 
@@ -493,16 +485,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSVa
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -511,11 +501,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JS
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
-
-    return formatLocaleDate(exec, thisDateObj, milli, LocaleDateAndTime, args);
+    return formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDateAndTime, args);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -524,11 +510,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
-
-    return formatLocaleDate(exec, thisDateObj, milli, LocaleDate, args);
+    return formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleDate, args);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
@@ -537,11 +519,7 @@ JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
-
-    return formatLocaleDate(exec, thisDateObj, milli, LocaleTime, args);
+    return formatLocaleDate(exec, thisDateObj, thisDateObj->internalNumber(), LocaleTime, args);
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -549,12 +527,7 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
-
-    return jsNumber(exec, milli);
+    return asDateInstance(thisValue)->internalValue(); 
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -562,15 +535,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, 1900 + t.year);
 }
 
@@ -579,15 +550,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JS
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, 1900 + t.year);
 }
 
@@ -596,16 +565,14 @@ JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNontrivialString(exec, "Invalid Date");
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNontrivialString(exec, "Invalid Date");
+    return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, outputIsUTC));
 }
 
 JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
@@ -613,15 +580,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.month);
 }
 
@@ -630,15 +595,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.month);
 }
 
@@ -647,15 +610,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.monthDay);
 }
 
@@ -664,15 +625,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.monthDay);
 }
 
@@ -681,15 +640,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue th
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.weekDay);
 }
 
@@ -698,15 +655,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.weekDay);
 }
 
@@ -715,15 +670,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.hour);
 }
 
@@ -732,15 +685,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSVal
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.hour);
 }
 
@@ -749,15 +700,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.minute);
 }
 
@@ -766,15 +715,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.minute);
 }
 
@@ -783,15 +730,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValu
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.second);
 }
 
@@ -800,15 +745,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSV
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = true;
+    const bool outputIsUTC = true;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, t.second);
 }
 
@@ -847,15 +790,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*,
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
     return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
 }
 
@@ -890,7 +831,7 @@ static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const
     double ms = milli - secs * msPerSecond;
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
+    thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
 
     if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
         JSValue result = jsNaN(exec);
@@ -922,11 +863,11 @@ static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const
     if (numArgsToUse == 3 && isnan(milli))
         // Based on ECMA 262 15.9.5.40 - .41 (set[UTC]FullYear)
         // the time must be reset to +0 if it is NaN. 
-        thisDateObj->msToGregorianDateTime(0, true, t);
+        WTF::msToGregorianDateTime(0, true, t);
     else {
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
+        thisDateObj->getGregorianDateTime(exec, inputIsUTC, t);
     }
     
     if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
@@ -1029,7 +970,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
@@ -1045,11 +986,11 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     if (isnan(milli))
         // Based on ECMA 262 B.2.5 (setYear)
         // the time must be reset to +0 if it is NaN. 
-        thisDateObj->msToGregorianDateTime(0, true, t);
+        WTF::msToGregorianDateTime(0, true, t);
     else {   
         double secs = floor(milli / msPerSecond);
         ms = milli - secs * msPerSecond;
-        thisDateObj->msToGregorianDateTime(milli, utc, t);
+        thisDateObj->getGregorianDateTime(exec, outputIsUTC, t);
     }
     
     bool ok = true;
@@ -1061,7 +1002,7 @@ JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue t
     }
             
     t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, outputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
@@ -1071,15 +1012,13 @@ JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue t
     if (!thisValue.inherits(&DateInstance::info))
         return throwError(exec, TypeError);
 
-    const bool utc = false;
+    const bool outputIsUTC = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
-    double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
-        return jsNaN(exec);
 
     GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
+    if (!thisDateObj->getGregorianDateTime(exec, outputIsUTC, t))
+        return jsNaN(exec);
 
     // NOTE: IE returns the full year even in getYear.
     return jsNumber(exec, t.year);
diff --git a/JavaScriptCore/runtime/DatePrototype.h b/JavaScriptCore/runtime/DatePrototype.h
index caed2d4..f565775 100644
--- a/JavaScriptCore/runtime/DatePrototype.h
+++ b/JavaScriptCore/runtime/DatePrototype.h
@@ -39,8 +39,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | DateInstance::StructureFlags;
+
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/FunctionPrototype.h b/JavaScriptCore/runtime/FunctionPrototype.h
index 0e38549..d1d6a1d 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/JavaScriptCore/runtime/FunctionPrototype.h
@@ -34,7 +34,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto)
         {
-            return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags));
         }
 
     private:
diff --git a/JavaScriptCore/runtime/GetterSetter.h b/JavaScriptCore/runtime/GetterSetter.h
index 73dd854..68e9ea3 100644
--- a/JavaScriptCore/runtime/GetterSetter.h
+++ b/JavaScriptCore/runtime/GetterSetter.h
@@ -50,7 +50,7 @@ namespace JSC {
         void setSetter(JSObject* setter) { m_setter = setter; }
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(GetterSetterType));
+            return Structure::create(prototype, TypeInfo(GetterSetterType, OverridesMarkChildren));
         }
     private:
         virtual bool isGetterSetter() const;
diff --git a/JavaScriptCore/runtime/GlobalEvalFunction.h b/JavaScriptCore/runtime/GlobalEvalFunction.h
index b62ad3e..389b1c3 100644
--- a/JavaScriptCore/runtime/GlobalEvalFunction.h
+++ b/JavaScriptCore/runtime/GlobalEvalFunction.h
@@ -37,9 +37,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+    protected:
+        static const unsigned StructureFlags = ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | PrototypeFunction::StructureFlags;
+
     private:
         virtual void markChildren(MarkStack&);
 
diff --git a/JavaScriptCore/runtime/InternalFunction.h b/JavaScriptCore/runtime/InternalFunction.h
index fdd5cc1..de9a1d6 100644
--- a/JavaScriptCore/runtime/InternalFunction.h
+++ b/JavaScriptCore/runtime/InternalFunction.h
@@ -42,10 +42,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot | HasDefaultMark)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
     protected:
+        static const unsigned StructureFlags = ImplementsHasInstance | JSObject::StructureFlags;
+
         InternalFunction(NonNullPassRefPtr<Structure> structure) : JSObject(structure) { }
         InternalFunction(JSGlobalData*, NonNullPassRefPtr<Structure>, const Identifier&);
 
diff --git a/JavaScriptCore/runtime/JSAPIValueWrapper.h b/JavaScriptCore/runtime/JSAPIValueWrapper.h
index 88a8493..aca550e 100644
--- a/JavaScriptCore/runtime/JSAPIValueWrapper.h
+++ b/JavaScriptCore/runtime/JSAPIValueWrapper.h
@@ -39,7 +39,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType));
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren | OverridesGetPropertyNames));
         }
 
         
diff --git a/JavaScriptCore/runtime/JSActivation.h b/JavaScriptCore/runtime/JSActivation.h
index 583b988..ee98191 100644
--- a/JavaScriptCore/runtime/JSActivation.h
+++ b/JavaScriptCore/runtime/JSActivation.h
@@ -66,7 +66,10 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
         struct JSActivationData : public JSVariableObjectData {
diff --git a/JavaScriptCore/runtime/JSArray.h b/JavaScriptCore/runtime/JSArray.h
index 66b5a1d..8c22451 100644
--- a/JavaScriptCore/runtime/JSArray.h
+++ b/JavaScriptCore/runtime/JSArray.h
@@ -87,12 +87,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
         
         inline void markChildrenDirect(MarkStack& markStack);
 
     protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
@@ -157,7 +158,7 @@ namespace JSC {
     inline void MarkStack::markChildren(JSCell* cell)
     {
         ASSERT(Heap::isCellMarked(cell));
-        if (cell->structure()->typeInfo().hasDefaultMark()) {
+        if (!cell->structure()->typeInfo().overridesMarkChildren()) {
 #ifdef NDEBUG
             asObject(cell)->markChildrenDirect(*this);
 #else
diff --git a/JavaScriptCore/runtime/JSByteArray.cpp b/JavaScriptCore/runtime/JSByteArray.cpp
index 90d39f0..5e5003b 100644
--- a/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/JavaScriptCore/runtime/JSByteArray.cpp
@@ -45,7 +45,7 @@ JSByteArray::JSByteArray(ExecState* exec, NonNullPassRefPtr<Structure> structure
     
 PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
-    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark));
+    PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     return result;
 }
 
diff --git a/JavaScriptCore/runtime/JSByteArray.h b/JavaScriptCore/runtime/JSByteArray.h
index 006f4a2..fe6e124 100644
--- a/JavaScriptCore/runtime/JSByteArray.h
+++ b/JavaScriptCore/runtime/JSByteArray.h
@@ -91,6 +91,9 @@ namespace JSC {
 
         WTF::ByteArray* storage() const { return m_storage.get(); }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
+
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
         JSByteArray(VPtrStealingHackType) 
diff --git a/JavaScriptCore/runtime/JSCell.cpp b/JavaScriptCore/runtime/JSCell.cpp
index aa93252..fae056e 100644
--- a/JavaScriptCore/runtime/JSCell.cpp
+++ b/JavaScriptCore/runtime/JSCell.cpp
@@ -78,11 +78,7 @@ extern const double Inf = NaNInf.doubles.Inf_Double;
 
 void* JSCell::operator new(size_t size, ExecState* exec)
 {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-    return exec->heap()->inlineAllocate(size);
-#else
     return exec->heap()->allocate(size);
-#endif
 }
 
 bool JSCell::getUInt32(uint32_t&) const
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index 503c6c4..722ae33 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -59,6 +59,7 @@ namespace JSC {
         virtual bool isGetterSetter() const;
         bool inherits(const ClassInfo*) const;
         virtual bool isAPIValueWrapper() const { return false; }
+        virtual bool isPropertyNameIterator() const { return false; }
 
         Structure* structure() const;
 
@@ -112,14 +113,6 @@ namespace JSC {
         Structure* m_structure;
     };
 
-    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
-    JSCell* asCell(JSValue);
-
-    inline JSCell* asCell(JSValue value)
-    {
-        return value.asCell();
-    }
-
     inline JSCell::JSCell(Structure* structure)
         : m_structure(structure)
     {
@@ -162,11 +155,7 @@ namespace JSC {
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
     {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-        return globalData->heap.inlineAllocate(size);
-#else
         return globalData->heap.allocate(size);
-#endif
     }
 
     // --- JSValue inlines ----------------------------
@@ -342,11 +331,6 @@ namespace JSC {
             append(value.asCell());
     }
 
-    inline void Structure::markAggregate(MarkStack& markStack)
-    {
-        markStack.append(m_prototype);
-    }
-
     inline Heap* Heap::heap(JSValue v)
     {
         if (!v.isCell())
diff --git a/JavaScriptCore/runtime/JSFunction.h b/JavaScriptCore/runtime/JSFunction.h
index a9ac63e..fcac9aa 100644
--- a/JavaScriptCore/runtime/JSFunction.h
+++ b/JavaScriptCore/runtime/JSFunction.h
@@ -61,17 +61,20 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags)); 
         }
 
         NativeFunction nativeFunction()
         {
-            return *reinterpret_cast<NativeFunction*>(m_data);
+            return *WTF::bitwise_cast<NativeFunction*>(m_data);
         }
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
+    protected:
+        const static unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | OverridesGetPropertyNames | InternalFunction::StructureFlags;
+
     private:
         JSFunction(NonNullPassRefPtr<Structure>);
 
@@ -94,7 +97,7 @@ namespace JSC {
         ScopeChain& scopeChain()
         {
             ASSERT(!isHostFunctionNonInline());
-            return *reinterpret_cast<ScopeChain*>(m_data);
+            return *WTF::bitwise_cast<ScopeChain*>(m_data);
         }
         void clearScopeChain()
         {
@@ -109,11 +112,11 @@ namespace JSC {
         void setScopeChain(const ScopeChain& sc)
         {
             ASSERT(!isHostFunctionNonInline());
-            *reinterpret_cast<ScopeChain*>(m_data) = sc;
+            *WTF::bitwise_cast<ScopeChain*>(m_data) = sc;
         }
         void setNativeFunction(NativeFunction func)
         {
-            *reinterpret_cast<NativeFunction*>(m_data) = func;
+            *WTF::bitwise_cast<NativeFunction*>(m_data) = func;
         }
         unsigned char m_data[sizeof(void*)];
     };
diff --git a/JavaScriptCore/runtime/JSGlobalData.h b/JavaScriptCore/runtime/JSGlobalData.h
index 3ad90ad..d2aa2da 100644
--- a/JavaScriptCore/runtime/JSGlobalData.h
+++ b/JavaScriptCore/runtime/JSGlobalData.h
@@ -30,6 +30,7 @@
 #define JSGlobalData_h
 
 #include "Collector.h"
+#include "DateInstanceCache.h"
 #include "ExecutableAllocator.h"
 #include "JITStubs.h"
 #include "JSValue.h"
@@ -116,7 +117,8 @@ namespace JSC {
         const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
         NumericStrings numericStrings;
-
+        DateInstanceCache dateInstanceCache;
+        
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;
 #endif
diff --git a/JavaScriptCore/runtime/JSGlobalObject.cpp b/JavaScriptCore/runtime/JSGlobalObject.cpp
index 3bb281e..cf3f1d1 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -89,7 +89,7 @@ static inline void markIfNeeded(MarkStack& markStack, JSValue v)
 static inline void markIfNeeded(MarkStack& markStack, const RefPtr<Structure>& s)
 {
     if (s)
-        s->markAggregate(markStack);
+        markIfNeeded(markStack, s->storedPrototype());
 }
 
 JSGlobalObject::~JSGlobalObject()
@@ -394,6 +394,21 @@ void JSGlobalObject::markChildren(MarkStack& markStack)
     markIfNeeded(markStack, d()->methodCallDummy);
 
     markIfNeeded(markStack, d()->errorStructure);
+    markIfNeeded(markStack, d()->argumentsStructure);
+    markIfNeeded(markStack, d()->arrayStructure);
+    markIfNeeded(markStack, d()->booleanObjectStructure);
+    markIfNeeded(markStack, d()->callbackConstructorStructure);
+    markIfNeeded(markStack, d()->callbackFunctionStructure);
+    markIfNeeded(markStack, d()->callbackObjectStructure);
+    markIfNeeded(markStack, d()->dateStructure);
+    markIfNeeded(markStack, d()->emptyObjectStructure);
+    markIfNeeded(markStack, d()->errorStructure);
+    markIfNeeded(markStack, d()->functionStructure);
+    markIfNeeded(markStack, d()->numberObjectStructure);
+    markIfNeeded(markStack, d()->prototypeFunctionStructure);
+    markIfNeeded(markStack, d()->regExpMatchesArrayStructure);
+    markIfNeeded(markStack, d()->regExpStructure);
+    markIfNeeded(markStack, d()->stringObjectStructure);
 
     // No need to mark the other structures, because their prototypes are all
     // guaranteed to be referenced elsewhere.
@@ -448,11 +463,7 @@ void JSGlobalObject::copyGlobalsTo(RegisterFile& registerFile)
 
 void* JSGlobalObject::operator new(size_t size, JSGlobalData* globalData)
 {
-#ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-    return globalData->heap.inlineAllocate(size);
-#else
     return globalData->heap.allocate(size);
-#endif
 }
 
 void JSGlobalObject::destroyJSGlobalObjectData(void* jsGlobalObjectData)
diff --git a/JavaScriptCore/runtime/JSGlobalObject.h b/JavaScriptCore/runtime/JSGlobalObject.h
index 2106783..720d3a5 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/JavaScriptCore/runtime/JSGlobalObject.h
@@ -267,10 +267,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
+
         struct GlobalPropertyInfo {
             GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
                 : identifier(i)
diff --git a/JavaScriptCore/runtime/JSNotAnObject.h b/JavaScriptCore/runtime/JSNotAnObject.h
index 0d9aca6..a271c4e 100644
--- a/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/JavaScriptCore/runtime/JSNotAnObject.h
@@ -62,10 +62,13 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
      private:
+        
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSObject::StructureFlags;
+
         // JSValue methods
         virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
         virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
diff --git a/JavaScriptCore/runtime/JSNumberCell.h b/JavaScriptCore/runtime/JSNumberCell.h
index 6a48081..309488f 100644
--- a/JavaScriptCore/runtime/JSNumberCell.h
+++ b/JavaScriptCore/runtime/JSNumberCell.h
@@ -68,23 +68,15 @@ namespace JSC {
 
         void* operator new(size_t size, ExecState* exec)
         {
-    #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-            return exec->heap()->inlineAllocateNumber(size);
-    #else
             return exec->heap()->allocateNumber(size);
-    #endif
         }
 
         void* operator new(size_t size, JSGlobalData* globalData)
         {
-    #ifdef JAVASCRIPTCORE_BUILDING_ALL_IN_ONE_FILE
-            return globalData->heap.inlineAllocateNumber(size);
-    #else
             return globalData->heap.allocateNumber(size);
-    #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion | HasDefaultMark)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
diff --git a/JavaScriptCore/runtime/JSONObject.h b/JavaScriptCore/runtime/JSONObject.h
index 65c9803..ec3fa40 100644
--- a/JavaScriptCore/runtime/JSONObject.h
+++ b/JavaScriptCore/runtime/JSONObject.h
@@ -41,11 +41,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
         static void markStringifiers(MarkStack&, Stringifier*);
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+
     private:
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
diff --git a/JavaScriptCore/runtime/JSObject.cpp b/JavaScriptCore/runtime/JSObject.cpp
index db2a9b2..6932ded 100644
--- a/JavaScriptCore/runtime/JSObject.cpp
+++ b/JavaScriptCore/runtime/JSObject.cpp
@@ -42,6 +42,25 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
+static inline void getEnumerablePropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+{
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->propHashTable(exec);
+        if (!table)
+            continue;
+        table->initializeIfNeeded(exec);
+        ASSERT(table->table);
+
+        int hashSizeMask = table->compactSize - 1;
+        const HashEntry* entry = table->table;
+        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
+            if (entry->key() && !(entry->attributes() & DontEnum))
+                propertyNames.add(entry->key());
+        }
+    }
+}
+
 void JSObject::markChildren(MarkStack& markStack)
 {
 #ifndef NDEBUG
@@ -424,12 +443,29 @@ bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyNa
 
 void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
+    getOwnPropertyNames(exec, propertyNames);
+
+    if (prototype().isNull())
+        return;
+
+    JSObject* prototype = asObject(this->prototype());
+    while(1) {
+        if (prototype->structure()->typeInfo().overridesGetPropertyNames()) {
+            prototype->getPropertyNames(exec, propertyNames);
+            break;
+        }
+        prototype->getOwnPropertyNames(exec, propertyNames);
+        JSValue nextProto = prototype->prototype();
+        if (nextProto.isNull())
+            break;
+        prototype = asObject(nextProto);
+    }
 }
 
 void JSObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    m_structure->getOwnEnumerablePropertyNames(exec, propertyNames, this);
+    m_structure->getEnumerablePropertyNames(propertyNames);
+    getEnumerablePropertyNames(exec, classInfo(), propertyNames);
 }
 
 bool JSObject::toBoolean(ExecState*) const
diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index 84b5f4b..5a89c40 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -202,15 +202,17 @@ namespace JSC {
         void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
         bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
 
-        static const size_t inlineStorageCapacity = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 4 : 3;
-        static const size_t nonInlineBaseStorageCapacity = 16;
+        static const unsigned inlineStorageCapacity = sizeof(EncodedJSValue) == 2 * sizeof(void*) ? 4 : 3;
+        static const unsigned nonInlineBaseStorageCapacity = 16;
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = 0;
+
         void addAnonymousSlots(unsigned count);
         void putAnonymousValue(unsigned index, JSValue value)
         {
@@ -368,7 +370,7 @@ ALWAYS_INLINE bool JSObject::getOwnPropertySlot(ExecState* exec, const Identifie
 
 ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (structure()->typeInfo().hasStandardGetOwnPropertySlot())
+    if (!structure()->typeInfo().overridesGetOwnPropertySlot())
         return asObject(this)->inlineGetOwnPropertySlot(exec, propertyName, slot);
     return getOwnPropertySlot(exec, propertyName, slot);
 }
@@ -682,7 +684,7 @@ ALWAYS_INLINE void JSObject::markChildrenDirect(MarkStack& markStack)
 {
     JSCell::markChildren(markStack);
 
-    m_structure->markAggregate(markStack);
+    markStack.append(prototype());
     
     PropertyStorage storage = propertyStorage();
     size_t storageSize = m_structure->propertyStorageSize();
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index e08a3d9..6fd0344 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -29,26 +29,61 @@
 #include "config.h"
 #include "JSPropertyNameIterator.h"
 
+#include "JSGlobalObject.h"
+
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSPropertyNameIterator);
 
-JSPropertyNameIterator::~JSPropertyNameIterator()
+JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject* o)
 {
+    ASSERT(!o->structure()->enumerationCache() ||
+            o->structure()->enumerationCache()->cachedStructure() != o->structure() ||
+            o->structure()->enumerationCache()->cachedPrototypeChain() != o->structure()->prototypeChain(exec));
+
+    PropertyNameArray propertyNames(exec);
+    o->getPropertyNames(exec, propertyNames);
+    size_t numCacheableSlots = 0;
+    if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
+        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        numCacheableSlots = o->structure()->propertyStorageSize();
+
+    JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
+
+    if (o->structure()->isDictionary())
+        return jsPropertyNameIterator;
+
+    if (o->structure()->typeInfo().overridesGetPropertyNames())
+        return jsPropertyNameIterator;
+    
+    size_t count = normalizePrototypeChain(exec, o);
+    StructureChain* structureChain = o->structure()->prototypeChain(exec);
+    RefPtr<Structure>* structure = structureChain->head();
+    for (size_t i = 0; i < count; ++i) {
+        if (structure[i]->typeInfo().overridesGetPropertyNames())
+            return jsPropertyNameIterator;
+    }
+
+    jsPropertyNameIterator->setCachedPrototypeChain(structureChain);
+    jsPropertyNameIterator->setCachedStructure(o->structure());
+    o->structure()->setEnumerationCache(jsPropertyNameIterator);
+    return jsPropertyNameIterator;
 }
 
-void JSPropertyNameIterator::markChildren(MarkStack& markStack)
+JSValue JSPropertyNameIterator::get(ExecState* exec, JSObject* base, size_t i)
 {
-    JSCell::markChildren(markStack);
-    if (m_object)
-        markStack.append(m_object);
+    JSValue& identifier = m_jsStrings[i];
+    if (m_cachedStructure == base->structure() && m_cachedPrototypeChain == base->structure()->prototypeChain(exec))
+        return identifier;
+
+    if (!base->hasProperty(exec, Identifier(exec, asString(identifier)->value())))
+        return JSValue();
+    return identifier;
 }
 
-void JSPropertyNameIterator::invalidate()
+void JSPropertyNameIterator::markChildren(MarkStack& markStack)
 {
-    ASSERT(m_position == m_end);
-    m_object = 0;
-    m_data.clear();
+    markStack.appendValues(m_jsStrings.get(), m_jsStringsSize, MayContainNullValues);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSPropertyNameIterator.h b/JavaScriptCore/runtime/JSPropertyNameIterator.h
index d2849a8..529ae8b 100644
--- a/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -31,6 +31,7 @@
 
 #include "JSObject.h"
 #include "JSString.h"
+#include "Operations.h"
 #include "PropertyNameArray.h"
 
 namespace JSC {
@@ -39,73 +40,63 @@ namespace JSC {
     class JSObject;
 
     class JSPropertyNameIterator : public JSCell {
+        friend class JIT;
+
     public:
-        static JSPropertyNameIterator* create(ExecState*, JSValue);
+        static JSPropertyNameIterator* create(ExecState*, JSObject*);
+        
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(CompoundType, OverridesMarkChildren));
+        }
 
-        virtual ~JSPropertyNameIterator();
+        virtual bool isPropertyNameIterator() const { return true; }
 
         virtual void markChildren(MarkStack&);
 
-        JSValue next(ExecState*);
-        void invalidate();
-        
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        bool getOffset(size_t i, int& offset)
         {
-            return Structure::create(prototype, TypeInfo(CompoundType));
+            if (i >= m_numCacheableSlots)
+                return false;
+            offset = i;
+            return true;
         }
+
+        JSValue get(ExecState*, JSObject*, size_t i);
+        size_t size() { return m_jsStringsSize; }
+
+        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
+        Structure* cachedStructure() { return m_cachedStructure; }
+
+        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
+        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
+
     private:
-        JSPropertyNameIterator(ExecState*);
-        JSPropertyNameIterator(ExecState*, JSObject*, PassRefPtr<PropertyNameArrayData> propertyNameArrayData);
+        JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
 
-        JSObject* m_object;
-        RefPtr<PropertyNameArrayData> m_data;
-        PropertyNameArrayData::const_iterator m_position;
-        PropertyNameArrayData::const_iterator m_end;
+        Structure* m_cachedStructure;
+        RefPtr<StructureChain> m_cachedPrototypeChain;
+        uint32_t m_numCacheableSlots;
+        uint32_t m_jsStringsSize;
+        OwnArrayPtr<JSValue> m_jsStrings;
     };
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec)
+inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlots)
     : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_object(0)
-    , m_position(0)
-    , m_end(0)
+    , m_cachedStructure(0)
+    , m_numCacheableSlots(numCacheableSlots)
+    , m_jsStringsSize(propertyNameArrayData->propertyNameVector().size())
+    , m_jsStrings(new JSValue[m_jsStringsSize])
 {
+    PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
+    for (size_t i = 0; i < m_jsStringsSize; ++i)
+        m_jsStrings[i] = jsOwnedString(exec, propertyNameVector[i].ustring());
 }
 
-inline JSPropertyNameIterator::JSPropertyNameIterator(ExecState* exec, JSObject* object, PassRefPtr<PropertyNameArrayData> propertyNameArrayData)
-    : JSCell(exec->globalData().propertyNameIteratorStructure.get())
-    , m_object(object)
-    , m_data(propertyNameArrayData)
-    , m_position(m_data->begin())
-    , m_end(m_data->end())
-{
-}
-
-inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
+inline void Structure::setEnumerationCache(JSPropertyNameIterator* enumerationCache)
 {
-    if (v.isUndefinedOrNull())
-        return new (exec) JSPropertyNameIterator(exec);
-
-    JSObject* o = v.toObject(exec);
-    PropertyNameArray propertyNames(exec);
-    o->getPropertyNames(exec, propertyNames);
-    return new (exec) JSPropertyNameIterator(exec, o, propertyNames.releaseData());
-}
-
-inline JSValue JSPropertyNameIterator::next(ExecState* exec)
-{
-    if (m_position == m_end)
-        return JSValue();
-
-    if (m_data->cachedStructure() == m_object->structure() && m_data->cachedPrototypeChain() == m_object->structure()->prototypeChain(exec))
-        return jsOwnedString(exec, (*m_position++).ustring());
-
-    do {
-        if (m_object->hasProperty(exec, *m_position))
-            return jsOwnedString(exec, (*m_position++).ustring());
-        m_position++;
-    } while (m_position != m_end);
-
-    return JSValue();
+    ASSERT(!isDictionary());
+    m_enumerationCache = enumerationCache;
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSStaticScopeObject.h b/JavaScriptCore/runtime/JSStaticScopeObject.h
index 5eb0e4b..2542878 100644
--- a/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -57,7 +57,10 @@ namespace JSC{
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | NeedsThisConversion | OverridesMarkChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
 
     private:
         JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index 91ddaeb..20ba868 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -139,45 +139,4 @@ bool JSString::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Proper
     return JSString::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSString* jsString(JSGlobalData* globalData, const UString& s)
-{
-    int size = s.size();
-    if (!size)
-        return globalData->smallStrings.emptyString(globalData);
-    if (size == 1) {
-        UChar c = s.data()[0];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, s);
-}
-    
-JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
-{
-    ASSERT(offset <= static_cast<unsigned>(s.size()));
-    ASSERT(length <= static_cast<unsigned>(s.size()));
-    ASSERT(offset + length <= static_cast<unsigned>(s.size()));
-    if (!length)
-        return globalData->smallStrings.emptyString(globalData);
-    if (length == 1) {
-        UChar c = s.data()[offset];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
-}
-
-JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
-{
-    int size = s.size();
-    if (!size)
-        return globalData->smallStrings.emptyString(globalData);
-    if (size == 1) {
-        UChar c = s.data()[0];
-        if (c <= 0xFF)
-            return globalData->smallStrings.singleCharacterString(globalData, c);
-    }
-    return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
-}
-
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSString.h b/JavaScriptCore/runtime/JSString.h
index 1e46551..39dfe75 100644
--- a/JavaScriptCore/runtime/JSString.h
+++ b/JavaScriptCore/runtime/JSString.h
@@ -92,7 +92,7 @@ namespace JSC {
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion | HasDefaultMark)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -169,6 +169,47 @@ namespace JSC {
         return jsSingleCharacterSubstring(globalData, m_value, i);
     }
 
+    inline JSString* jsString(JSGlobalData* globalData, const UString& s)
+    {
+        int size = s.size();
+        if (!size)
+            return globalData->smallStrings.emptyString(globalData);
+        if (size == 1) {
+            UChar c = s.data()[0];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, s);
+    }
+        
+    inline JSString* jsSubstring(JSGlobalData* globalData, const UString& s, unsigned offset, unsigned length)
+    {
+        ASSERT(offset <= static_cast<unsigned>(s.size()));
+        ASSERT(length <= static_cast<unsigned>(s.size()));
+        ASSERT(offset + length <= static_cast<unsigned>(s.size()));
+        if (!length)
+            return globalData->smallStrings.emptyString(globalData);
+        if (length == 1) {
+            UChar c = s.data()[offset];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, UString::Rep::create(s.rep(), offset, length));
+    }
+
+    inline JSString* jsOwnedString(JSGlobalData* globalData, const UString& s)
+    {
+        int size = s.size();
+        if (!size)
+            return globalData->smallStrings.emptyString(globalData);
+        if (size == 1) {
+            UChar c = s.data()[0];
+            if (c <= 0xFF)
+                return globalData->smallStrings.singleCharacterString(globalData, c);
+        }
+        return new (globalData) JSString(globalData, s, JSString::HasOtherOwner);
+    }
+
     inline JSString* jsEmptyString(ExecState* exec) { return jsEmptyString(&exec->globalData()); }
     inline JSString* jsString(ExecState* exec, const UString& s) { return jsString(&exec->globalData(), s); }
     inline JSString* jsSingleCharacterString(ExecState* exec, UChar c) { return jsSingleCharacterString(&exec->globalData(), c); }
diff --git a/JavaScriptCore/runtime/JSTypeInfo.h b/JavaScriptCore/runtime/JSTypeInfo.h
index 279510b..7c89600 100644
--- a/JavaScriptCore/runtime/JSTypeInfo.h
+++ b/JavaScriptCore/runtime/JSTypeInfo.h
@@ -40,9 +40,9 @@ namespace JSC {
     static const unsigned OverridesHasInstance = 1 << 2;
     static const unsigned ImplementsDefaultHasInstance = 1 << 3;
     static const unsigned NeedsThisConversion = 1 << 4;
-    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
-    static const unsigned HasDefaultMark = 1 << 6;
-    static const unsigned HasDefaultGetPropertyNames = 1 << 7;
+    static const unsigned OverridesGetOwnPropertySlot = 1 << 5;
+    static const unsigned OverridesMarkChildren = 1 << 6;
+    static const unsigned OverridesGetPropertyNames = 1 << 7;
 
     class TypeInfo {
         friend class JIT;
@@ -63,9 +63,9 @@ namespace JSC {
         bool implementsHasInstance() const { return m_flags & ImplementsHasInstance; }
         bool overridesHasInstance() const { return m_flags & OverridesHasInstance; }
         bool needsThisConversion() const { return m_flags & NeedsThisConversion; }
-        bool hasStandardGetOwnPropertySlot() const { return m_flags & HasStandardGetOwnPropertySlot; }
-        bool hasDefaultMark() const { return m_flags & HasDefaultMark; }
-        bool hasDefaultGetPropertyNames() const { return m_flags & HasDefaultGetPropertyNames; }
+        bool overridesGetOwnPropertySlot() const { return m_flags & OverridesGetOwnPropertySlot; }
+        bool overridesMarkChildren() const { return m_flags & OverridesMarkChildren; }
+        bool overridesGetPropertyNames() const { return m_flags & OverridesGetPropertyNames; }
         unsigned flags() const { return m_flags; }
 
     private:
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index 3c511d8..1063cdc 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -373,6 +373,14 @@ namespace JSC {
         return static_cast<uint32_t>(val);
     }
 
+    // FIXME: We should deprecate this and just use JSValue::asCell() instead.
+    JSCell* asCell(JSValue);
+
+    inline JSCell* asCell(JSValue value)
+    {
+        return value.asCell();
+    }
+
     ALWAYS_INLINE int32_t JSValue::toInt32(ExecState* exec) const
     {
         if (isInt32())
diff --git a/JavaScriptCore/runtime/JSVariableObject.h b/JavaScriptCore/runtime/JSVariableObject.h
index 66e78c3..d8b1479 100644
--- a/JavaScriptCore/runtime/JSVariableObject.h
+++ b/JavaScriptCore/runtime/JSVariableObject.h
@@ -60,10 +60,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
         
     protected:
+        static const unsigned StructureFlags = OverridesGetPropertyNames | JSObject::StructureFlags;
         // Subclasses of JSVariableObject can subclass this struct to add data
         // without increasing their own size (since there's a hard limit on the
         // size of a JSCell).
diff --git a/JavaScriptCore/runtime/JSWrapperObject.h b/JavaScriptCore/runtime/JSWrapperObject.h
index 723b75d..191ff3b 100644
--- a/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/JavaScriptCore/runtime/JSWrapperObject.h
@@ -38,7 +38,7 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     private:
diff --git a/JavaScriptCore/runtime/MarkStack.h b/JavaScriptCore/runtime/MarkStack.h
index ba00057..ea09f54 100644
--- a/JavaScriptCore/runtime/MarkStack.h
+++ b/JavaScriptCore/runtime/MarkStack.h
@@ -47,7 +47,7 @@ namespace JSC {
         }
 
         ALWAYS_INLINE void append(JSValue);
-        ALWAYS_INLINE void append(JSCell*);
+        void append(JSCell*);
         
         ALWAYS_INLINE void appendValues(Register* values, size_t count, MarkSetProperties properties = NoNullValues)
         {
diff --git a/JavaScriptCore/runtime/MathObject.h b/JavaScriptCore/runtime/MathObject.h
index fee5ec5..7f474b8 100644
--- a/JavaScriptCore/runtime/MathObject.h
+++ b/JavaScriptCore/runtime/MathObject.h
@@ -37,8 +37,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/NumberConstructor.h b/JavaScriptCore/runtime/NumberConstructor.h
index 908c55f..cf19b6f 100644
--- a/JavaScriptCore/runtime/NumberConstructor.h
+++ b/JavaScriptCore/runtime/NumberConstructor.h
@@ -39,11 +39,14 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
         enum { NaNValue, NegInfinity, PosInfinity, MaxValue, MinValue };
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | InternalFunction::StructureFlags;
+
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
diff --git a/JavaScriptCore/runtime/NumberObject.h b/JavaScriptCore/runtime/NumberObject.h
index ca3923d..8223a90 100644
--- a/JavaScriptCore/runtime/NumberObject.h
+++ b/JavaScriptCore/runtime/NumberObject.h
@@ -30,17 +30,19 @@ namespace JSC {
         explicit NumberObject(NonNullPassRefPtr<Structure>);
 
         static const ClassInfo info;
-#if USE(JSVALUE32)
+
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
+
+    protected:
+#if USE(JSVALUE32)
+        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
 #else
-        static PassRefPtr<Structure> createStructure(JSValue prototype)
-        {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
-        }
+        static const unsigned StructureFlags = JSWrapperObject::StructureFlags;
 #endif
+
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index a456423..837d5a6 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -125,6 +125,7 @@ JSValue JSC_HOST_CALL objectConstructorGetOwnPropertyDescriptor(ExecState* exec,
     return description;
 }
 
+// FIXME: Use the enumeration cache.
 JSValue JSC_HOST_CALL objectConstructorKeys(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (!args.at(0).isObject())
diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index 5da9e38..1aa68b3 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -224,15 +224,15 @@ namespace JSC {
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValue baseValue, const PropertySlot& slot)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase)
     {
-        JSCell* cell = asCell(baseValue);
+        JSCell* cell = asCell(base);
         size_t count = 0;
 
-        while (slot.slotBase() != cell) {
+        while (slotBase != cell) {
             JSValue v = cell->structure()->prototypeForLookup(callFrame);
 
-            // If we didn't find slotBase in baseValue's prototype chain, then baseValue
+            // If we didn't find slotBase in base's prototype chain, then base
             // must be a proxy for another object.
 
             if (v.isNull())
@@ -252,6 +252,25 @@ namespace JSC {
         return count;
     }
 
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSCell* base)
+    {
+        size_t count = 0;
+        while (1) {
+            JSValue v = base->structure()->prototypeForLookup(callFrame);
+            if (v.isNull())
+                return count;
+
+            base = asCell(v);
+
+            // Since we're accessing a prototype in a loop, it's a good bet that it
+            // should not be treated as a dictionary.
+            if (base->structure()->isDictionary())
+                asObject(base)->setStructure(Structure::fromDictionaryTransition(base->structure()));
+
+            ++count;
+        }
+    }
+
     ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
     {
         ScopeChainIterator iter = scopeChain->begin();
diff --git a/JavaScriptCore/runtime/PropertyNameArray.cpp b/JavaScriptCore/runtime/PropertyNameArray.cpp
index 0878e73..c28b6a4 100644
--- a/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -21,6 +21,9 @@
 #include "config.h"
 #include "PropertyNameArray.h"
 
+#include "Structure.h"
+#include "StructureChain.h"
+
 namespace JSC {
 
 static const size_t setThreshold = 20;
@@ -44,7 +47,7 @@ void PropertyNameArray::add(UString::Rep* identifier)
             return;
     }
 
-    m_data->propertyNameVector().append(Identifier(m_globalData, identifier));
+    addKnownUnique(identifier);
 }
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/PropertyNameArray.h b/JavaScriptCore/runtime/PropertyNameArray.h
index afcc83f..3dbcc9d 100644
--- a/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/JavaScriptCore/runtime/PropertyNameArray.h
@@ -23,45 +23,35 @@
 
 #include "CallFrame.h"
 #include "Identifier.h"
-#include "Structure.h"
 #include <wtf/HashSet.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
+    
+    class Structure;
+    class StructureChain;
 
+    // FIXME: Rename to PropertyNameArray.
     class PropertyNameArrayData : public RefCounted<PropertyNameArrayData> {
     public:
         typedef Vector<Identifier, 20> PropertyNameVector;
-        typedef PropertyNameVector::const_iterator const_iterator;
 
         static PassRefPtr<PropertyNameArrayData> create() { return adoptRef(new PropertyNameArrayData); }
 
-        const_iterator begin() const { return m_propertyNameVector.begin(); }
-        const_iterator end() const { return m_propertyNameVector.end(); }
-
         PropertyNameVector& propertyNameVector() { return m_propertyNameVector; }
 
-        void setCachedStructure(Structure* structure) { m_cachedStructure = structure; }
-        Structure* cachedStructure() const { return m_cachedStructure; }
-
-        void setCachedPrototypeChain(NonNullPassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
-        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
-
     private:
         PropertyNameArrayData()
-            : m_cachedStructure(0)
         {
         }
 
         PropertyNameVector m_propertyNameVector;
-        Structure* m_cachedStructure;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
     };
 
+    // FIXME: Rename to PropertyNameArrayBuilder.
     class PropertyNameArray {
     public:
-        typedef PropertyNameArrayData::const_iterator const_iterator;
-
         PropertyNameArray(JSGlobalData* globalData)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(globalData)
@@ -82,21 +72,18 @@ namespace JSC {
         void add(UString::Rep*);
         void addKnownUnique(UString::Rep* identifier) { m_data->propertyNameVector().append(Identifier(m_globalData, identifier)); }
 
-        size_t size() const { return m_data->propertyNameVector().size(); }
-
         Identifier& operator[](unsigned i) { return m_data->propertyNameVector()[i]; }
         const Identifier& operator[](unsigned i) const { return m_data->propertyNameVector()[i]; }
 
-        const_iterator begin() const { return m_data->begin(); }
-        const_iterator end() const { return m_data->end(); }
-
         void setData(PassRefPtr<PropertyNameArrayData> data) { m_data = data; }
         PropertyNameArrayData* data() { return m_data.get(); }
-
         PassRefPtr<PropertyNameArrayData> releaseData() { return m_data.release(); }
 
-        void setShouldCache(bool shouldCache) { m_shouldCache = shouldCache; }
-        bool shouldCache() const { return m_shouldCache; }
+        // FIXME: Remove these functions.
+        typedef PropertyNameArrayData::PropertyNameVector::const_iterator const_iterator;
+        size_t size() const { return m_data->propertyNameVector().size(); }
+        const_iterator begin() const { return m_data->propertyNameVector().begin(); }
+        const_iterator end() const { return m_data->propertyNameVector().end(); }
 
     private:
         typedef HashSet<UString::Rep*, PtrHash<UString::Rep*> > IdentifierSet;
diff --git a/JavaScriptCore/runtime/Protect.h b/JavaScriptCore/runtime/Protect.h
index 224164d..a0d5443 100644
--- a/JavaScriptCore/runtime/Protect.h
+++ b/JavaScriptCore/runtime/Protect.h
@@ -22,8 +22,8 @@
 #ifndef Protect_h
 #define Protect_h
 
-#include "JSCell.h"
 #include "Collector.h"
+#include "JSValue.h"
 
 namespace JSC {
 
diff --git a/JavaScriptCore/runtime/RegExpConstructor.cpp b/JavaScriptCore/runtime/RegExpConstructor.cpp
index dbf2d44..c609e08 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -90,28 +90,6 @@ const ClassInfo RegExpConstructor::info = { "Function", &InternalFunction::info,
 @end
 */
 
-struct RegExpConstructorPrivate : FastAllocBase {
-    // Global search cache / settings
-    RegExpConstructorPrivate()
-        : lastNumSubPatterns(0)
-        , multiline(false)
-        , lastOvectorIndex(0)
-    {
-    }
-
-    const Vector<int, 32>& lastOvector() const { return ovector[lastOvectorIndex]; }
-    Vector<int, 32>& lastOvector() { return ovector[lastOvectorIndex]; }
-    Vector<int, 32>& tempOvector() { return ovector[lastOvectorIndex ? 0 : 1]; }
-    void changeLastOvector() { lastOvectorIndex = lastOvectorIndex ? 0 : 1; }
-
-    UString input;
-    UString lastInput;
-    Vector<int, 32> ovector[2];
-    unsigned lastNumSubPatterns : 30;
-    bool multiline : 1;
-    unsigned lastOvectorIndex : 1;
-};
-
 RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structure> structure, RegExpPrototype* regExpPrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, "RegExp"))
     , d(new RegExpConstructorPrivate)
@@ -123,30 +101,6 @@ RegExpConstructor::RegExpConstructor(ExecState* exec, NonNullPassRefPtr<Structur
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly | DontDelete | DontEnum);
 }
 
-/* 
-  To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
-  expression matching through the performMatch function. We use cached results to calculate, 
-  e.g., RegExp.lastMatch and RegExp.leftParen.
-*/
-void RegExpConstructor::performMatch(RegExp* r, const UString& s, int startOffset, int& position, int& length, int** ovector)
-{
-    position = r->match(s, startOffset, &d->tempOvector());
-
-    if (ovector)
-        *ovector = d->tempOvector().data();
-
-    if (position != -1) {
-        ASSERT(!d->tempOvector().isEmpty());
-
-        length = d->tempOvector()[1] - d->tempOvector()[0];
-
-        d->input = s;
-        d->lastInput = s;
-        d->changeLastOvector();
-        d->lastNumSubPatterns = r->numSubpatterns();
-    }
-}
-
 RegExpMatchesArray::RegExpMatchesArray(ExecState* exec, RegExpConstructorPrivate* data)
     : JSArray(exec->lexicalGlobalObject()->regExpMatchesArrayStructure(), data->lastNumSubPatterns + 1)
 {
diff --git a/JavaScriptCore/runtime/RegExpConstructor.h b/JavaScriptCore/runtime/RegExpConstructor.h
index f8bccf4..f9ca9cf 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/JavaScriptCore/runtime/RegExpConstructor.h
@@ -22,6 +22,7 @@
 #define RegExpConstructor_h
 
 #include "InternalFunction.h"
+#include "RegExp.h"
 #include <wtf/OwnPtr.h>
 
 namespace JSC {
@@ -30,13 +31,35 @@ namespace JSC {
     class RegExpPrototype;
     struct RegExpConstructorPrivate;
 
+    struct RegExpConstructorPrivate : FastAllocBase {
+        // Global search cache / settings
+        RegExpConstructorPrivate()
+            : lastNumSubPatterns(0)
+            , multiline(false)
+            , lastOvectorIndex(0)
+        {
+        }
+
+        const Vector<int, 32>& lastOvector() const { return ovector[lastOvectorIndex]; }
+        Vector<int, 32>& lastOvector() { return ovector[lastOvectorIndex]; }
+        Vector<int, 32>& tempOvector() { return ovector[lastOvectorIndex ? 0 : 1]; }
+        void changeLastOvector() { lastOvectorIndex = lastOvectorIndex ? 0 : 1; }
+
+        UString input;
+        UString lastInput;
+        Vector<int, 32> ovector[2];
+        unsigned lastNumSubPatterns : 30;
+        bool multiline : 1;
+        unsigned lastOvectorIndex : 1;
+    };
+
     class RegExpConstructor : public InternalFunction {
     public:
         RegExpConstructor(ExecState*, NonNullPassRefPtr<Structure>, RegExpPrototype*);
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance | HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
         virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
@@ -59,6 +82,9 @@ namespace JSC {
         JSValue getLeftContext(ExecState*) const;
         JSValue getRightContext(ExecState*) const;
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | InternalFunction::StructureFlags;
+
     private:
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
@@ -78,6 +104,30 @@ namespace JSC {
         return static_cast<RegExpConstructor*>(asObject(value));
     }
 
+    /* 
+      To facilitate result caching, exec(), test(), match(), search(), and replace() dipatch regular
+      expression matching through the performMatch function. We use cached results to calculate, 
+      e.g., RegExp.lastMatch and RegExp.leftParen.
+    */
+    inline void RegExpConstructor::performMatch(RegExp* r, const UString& s, int startOffset, int& position, int& length, int** ovector)
+    {
+        position = r->match(s, startOffset, &d->tempOvector());
+
+        if (ovector)
+            *ovector = d->tempOvector().data();
+
+        if (position != -1) {
+            ASSERT(!d->tempOvector().isEmpty());
+
+            length = d->tempOvector()[1] - d->tempOvector()[0];
+
+            d->input = s;
+            d->lastInput = s;
+            d->changeLastOvector();
+            d->lastNumSubPatterns = r->numSubpatterns();
+        }
+    }
+
 } // namespace JSC
 
 #endif // RegExpConstructor_h
diff --git a/JavaScriptCore/runtime/RegExpObject.cpp b/JavaScriptCore/runtime/RegExpObject.cpp
index 877d7b6..679d072 100644
--- a/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/JavaScriptCore/runtime/RegExpObject.cpp
@@ -159,7 +159,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
     }
 
     int position;
-    int length;
+    int length = 0;
     regExpConstructor->performMatch(d->regExp.get(), input, static_cast<int>(d->lastIndex), position, length);
     if (position < 0) {
         d->lastIndex = 0;
diff --git a/JavaScriptCore/runtime/RegExpObject.h b/JavaScriptCore/runtime/RegExpObject.h
index f5a9340..3117c86 100644
--- a/JavaScriptCore/runtime/RegExpObject.h
+++ b/JavaScriptCore/runtime/RegExpObject.h
@@ -49,9 +49,12 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasDefaultMark | HasDefaultGetPropertyNames));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
+    protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
+
     private:
         bool match(ExecState*, const ArgList&);
 
diff --git a/JavaScriptCore/runtime/StringObject.h b/JavaScriptCore/runtime/StringObject.h
index 944f6ba..84e1ad2 100644
--- a/JavaScriptCore/runtime/StringObject.h
+++ b/JavaScriptCore/runtime/StringObject.h
@@ -48,10 +48,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType));
+            return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames | JSWrapperObject::StructureFlags;
         StringObject(NonNullPassRefPtr<Structure>, JSString*);
   };
 
diff --git a/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 0cba83d..69e1939 100644
--- a/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -44,9 +44,11 @@ namespace JSC {
 
         static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
-            return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined | HasDefaultMark)); 
+            return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
         }
 
+        static const unsigned StructureFlags = OverridesGetOwnPropertySlot | MasqueradesAsUndefined | OverridesGetPropertyNames | StringObject::StructureFlags;
+
         virtual bool toBoolean(ExecState*) const { return false; }
     };
  
diff --git a/JavaScriptCore/runtime/StringPrototype.cpp b/JavaScriptCore/runtime/StringPrototype.cpp
index b57732a..a0713b8 100644
--- a/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/JavaScriptCore/runtime/StringPrototype.cpp
@@ -25,6 +25,7 @@
 #include "CachedCall.h"
 #include "Error.h"
 #include "Executable.h"
+#include "JSGlobalObjectFunctions.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -72,6 +73,10 @@ static JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*, JSObject*, JSVa
 static JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*, JSObject*, JSValue, const ArgList&);
 static JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*, JSObject*, JSValue, const ArgList&);
 
+static JSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState*, JSObject*, JSValue, const ArgList&);
+
 }
 
 #include "StringPrototype.lut.h"
@@ -117,6 +122,9 @@ const ClassInfo StringPrototype::info = { "String", &StringObject::info, 0, Exec
     fontsize              stringProtoFuncFontsize          DontEnum|Function       1
     anchor                stringProtoFuncAnchor            DontEnum|Function       1
     link                  stringProtoFuncLink              DontEnum|Function       1
+    trim                  stringProtoFuncTrim              DontEnum|Function       0
+    trimLeft              stringProtoFuncTrimLeft          DontEnum|Function       0
+    trimRight             stringProtoFuncTrimRight         DontEnum|Function       0
 @end
 */
 
@@ -249,7 +257,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
                 return jsNull();
             while (true) {
                 int matchIndex;
-                int matchLen;
+                int matchLen = 0;
                 int* ovector;
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
@@ -290,7 +298,7 @@ JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue
         } else {
             do {
                 int matchIndex;
-                int matchLen;
+                int matchLen = 0;
                 int* ovector;
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
@@ -485,7 +493,7 @@ JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue t
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
-    int matchLength;
+    int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
     if (!(reg->global())) {
         // case without 'g' flag is handled like RegExp.prototype.exec
@@ -535,7 +543,7 @@ JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
-    int matchLength;
+    int matchLength = 0;
     regExpConstructor->performMatch(reg.get(), u, 0, pos, matchLength);
     return jsNumber(exec, pos);
 }
@@ -899,4 +907,51 @@ JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue th
     return jsNontrivialString(exec, UString(buffer, bufferSize, false));
 }
 
+enum {
+    TrimLeft = 1,
+    TrimRight = 2
+};
+
+static inline bool isTrimWhitespace(UChar c)
+{
+    return isStrWhiteSpace(c) || c == 0x200b;
+}
+
+static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
+{
+    UString str = thisValue.toThisString(exec);
+    int left = 0;
+    if (trimKind & TrimLeft) {
+        while (left < str.size() && isTrimWhitespace(str[left]))
+            left++;
+    }
+    int right = str.size();
+    if (trimKind & TrimRight) {
+        while (right > left && isTrimWhitespace(str[right - 1]))
+            right--;
+    }
+
+    // Don't gc allocate a new string if we don't have to.
+    if (left == 0 && right == str.size() && thisValue.isString())
+        return thisValue;
+
+    return jsString(exec, str.substr(left, right - left));
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrim(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimLeft | TrimRight);
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrimLeft(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimLeft);
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncTrimRight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    return trimString(exec, thisValue, TrimRight);
+}
+    
+    
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/Structure.cpp b/JavaScriptCore/runtime/Structure.cpp
index 7209b5f..65b62f9 100644
--- a/JavaScriptCore/runtime/Structure.cpp
+++ b/JavaScriptCore/runtime/Structure.cpp
@@ -28,9 +28,10 @@
 
 #include "Identifier.h"
 #include "JSObject.h"
+#include "JSPropertyNameIterator.h"
+#include "Lookup.h"
 #include "PropertyNameArray.h"
 #include "StructureChain.h"
-#include "Lookup.h"
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/RefPtr.h>
 
@@ -159,9 +160,9 @@ Structure::~Structure()
             m_previous->table.removeAnonymousSlotTransition(m_anonymousSlotsInPrevious);
 
     }
-
-    if (m_cachedPropertyNameArrayData)
-        m_cachedPropertyNameArrayData->setCachedStructure(0);
+    
+    if (m_enumerationCache)
+        m_enumerationCache->setCachedStructure(0);
 
     if (m_propertyTable) {
         unsigned entryCount = m_propertyTable->keyCount + m_propertyTable->deletedSentinelCount;
@@ -282,59 +283,6 @@ void Structure::materializePropertyMap()
     }
 }
 
-void Structure::getOwnEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
-{
-    getEnumerableNamesFromPropertyTable(propertyNames);
-    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
-}
-
-void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
-{
-    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || isDictionary());
-
-    if (shouldCache && m_cachedPropertyNameArrayData) {
-        if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
-            propertyNames.setData(m_cachedPropertyNameArrayData);
-            return;
-        }
-        clearEnumerationCache();
-    }
-
-    baseObject->getOwnPropertyNames(exec, propertyNames);
-
-    if (m_prototype.isObject()) {
-        propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
-        JSObject* prototype = asObject(m_prototype);
-        while(1) {
-            if (!prototype->structure()->typeInfo().hasDefaultGetPropertyNames()) {
-                prototype->getPropertyNames(exec, propertyNames);
-                break;
-            }
-            prototype->getOwnPropertyNames(exec, propertyNames);
-            JSValue nextProto = prototype->prototype();
-            if (!nextProto.isObject())
-                break;
-            prototype = asObject(nextProto);
-        }
-    }
-
-    if (shouldCache) {
-        StructureChain* protoChain = prototypeChain(exec);
-        m_cachedPropertyNameArrayData = propertyNames.data();
-        if (!protoChain->isCacheable())
-            return;
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(protoChain);
-        m_cachedPropertyNameArrayData->setCachedStructure(this);
-    }
-}
-
-void Structure::clearEnumerationCache()
-{
-    if (m_cachedPropertyNameArrayData)
-        m_cachedPropertyNameArrayData->setCachedStructure(0);
-    m_cachedPropertyNameArrayData.clear();
-}
-
 void Structure::growPropertyStorageCapacity()
 {
     if (m_propertyStorageCapacity == JSObject::inlineStorageCapacity)
@@ -427,6 +375,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
     transition->m_specificValueInPrevious = specificValue;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -469,6 +418,7 @@ PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure,
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -485,6 +435,7 @@ PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structur
 
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -516,6 +467,7 @@ PassRefPtr<Structure> Structure::addAnonymousSlotsTransition(Structure* structur
     transition->m_specificValueInPrevious = 0;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     if (structure->m_propertyTable) {
         if (structure->m_isPinnedPropertyTable)
@@ -544,6 +496,7 @@ PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = transition->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
 
     // Don't set m_offset, as one can not transition to this.
 
@@ -562,6 +515,7 @@ PassRefPtr<Structure> Structure::toDictionaryTransition(Structure* structure, Di
     transition->m_dictionaryKind = kind;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+    transition->m_hasNonEnumerableProperties = structure->m_hasNonEnumerableProperties;
     
     structure->materializePropertyMapIfNecessary();
     transition->m_propertyTable = structure->copyPropertyTable();
@@ -598,25 +552,28 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
 
 size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
+    ASSERT(!m_enumerationCache);
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
+    if (attributes & DontEnum)
+        m_hasNonEnumerableProperties = true;
+
     size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
-    clearEnumerationCache();
     return offset;
 }
 
 size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName)
 {
     ASSERT(isUncacheableDictionary());
+    ASSERT(!m_enumerationCache);
 
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
     size_t offset = remove(propertyName);
-    clearEnumerationCache();
     return offset;
 }
 
@@ -1057,7 +1014,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
+void Structure::getEnumerablePropertyNames(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -1114,25 +1071,6 @@ void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyN
     }
 }
 
-void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
-{
-    // Add properties from the static hashtables of properties
-    for (; classInfo; classInfo = classInfo->parentClass) {
-        const HashTable* table = classInfo->propHashTable(exec);
-        if (!table)
-            continue;
-        table->initializeIfNeeded(exec);
-        ASSERT(table->table);
-
-        int hashSizeMask = table->compactSize - 1;
-        const HashEntry* entry = table->table;
-        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
-                propertyNames.add(entry->key());
-        }
-    }
-}
-
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
 void Structure::checkConsistency()
diff --git a/JavaScriptCore/runtime/Structure.h b/JavaScriptCore/runtime/Structure.h
index ed9f6e5..f355c53 100644
--- a/JavaScriptCore/runtime/Structure.h
+++ b/JavaScriptCore/runtime/Structure.h
@@ -30,6 +30,8 @@
 #include "JSType.h"
 #include "JSValue.h"
 #include "PropertyMapHashTable.h"
+#include "PropertyNameArray.h"
+#include "Protect.h"
 #include "StructureChain.h"
 #include "StructureTransitionTable.h"
 #include "JSTypeInfo.h"
@@ -76,8 +78,6 @@ namespace JSC {
 
         ~Structure();
 
-        void markAggregate(MarkStack&);
-
         // These should be used with caution.  
         size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
@@ -95,8 +95,8 @@ namespace JSC {
         Structure* previousID() const { return m_previous.get(); }
 
         void growPropertyStorageCapacity();
-        size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
-        size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        unsigned propertyStorageCapacity() const { return m_propertyStorageCapacity; }
+        unsigned propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + m_propertyTable->anonymousSlotCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
         bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
@@ -116,17 +116,22 @@ namespace JSC {
             return hasTransition(propertyName._ustring.rep(), attributes);
         }
 
-        void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
-        void getOwnEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
-
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
 
+        bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
+
+        bool hasAnonymousSlots() const { return m_propertyTable && m_propertyTable->anonymousSlotCount; }
+        
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
         JSCell* specificValue() { return m_specificValueInPrevious; }
         void despecifyDictionaryFunction(const Identifier& propertyName);
 
+        void setEnumerationCache(JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
+        JSPropertyNameIterator* enumerationCache() { return m_enumerationCache.get(); }
+        void getEnumerablePropertyNames(PropertyNameArray&);
+
     private:
         Structure(JSValue prototype, const TypeInfo&);
         
@@ -140,8 +145,6 @@ namespace JSC {
         size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
         void addAnonymousSlots(unsigned slotCount);
-        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
-        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -162,8 +165,6 @@ namespace JSC {
             materializePropertyMap();
         }
 
-        void clearEnumerationCache();
-
         signed char transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
@@ -189,16 +190,17 @@ namespace JSC {
 
         StructureTransitionTable table;
 
-        RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
+        ProtectedPtr<JSPropertyNameIterator> m_enumerationCache;
 
         PropertyMapHashTable* m_propertyTable;
 
-        size_t m_propertyStorageCapacity;
+        uint32_t m_propertyStorageCapacity;
         signed char m_offset;
 
         unsigned m_dictionaryKind : 2;
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
+        bool m_hasNonEnumerableProperties : 1;
 #if COMPILER(WINSCW)
         // Workaround for Symbian WINSCW compiler that cannot resolve unsigned type of the declared 
         // bitfield, when used as argument in make_pair() function calls in structure.ccp.
diff --git a/JavaScriptCore/runtime/StructureChain.cpp b/JavaScriptCore/runtime/StructureChain.cpp
index 6e8a0ee..085876c 100644
--- a/JavaScriptCore/runtime/StructureChain.cpp
+++ b/JavaScriptCore/runtime/StructureChain.cpp
@@ -46,18 +46,4 @@ StructureChain::StructureChain(Structure* head)
     m_vector[i] = 0;
 }
 
-bool StructureChain::isCacheable() const
-{
-    uint32_t i = 0;
-    
-    while (m_vector[i]) {
-        // Both classes of dictionary structure may change arbitrarily so we can't cache them
-        if (m_vector[i]->isDictionary())
-            return false;
-        if (!m_vector[i++]->typeInfo().hasDefaultGetPropertyNames())
-            return false;
-    }
-    return true;
-}
-
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/StructureChain.h b/JavaScriptCore/runtime/StructureChain.h
index c48749d..816b66d 100644
--- a/JavaScriptCore/runtime/StructureChain.h
+++ b/JavaScriptCore/runtime/StructureChain.h
@@ -36,10 +36,11 @@ namespace JSC {
     class Structure;
 
     class StructureChain : public RefCounted<StructureChain> {
+        friend class JIT;
+
     public:
         static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
-        bool isCacheable() const;
 
     private:
         StructureChain(Structure* head);
diff --git a/JavaScriptCore/wtf/CurrentTime.cpp b/JavaScriptCore/wtf/CurrentTime.cpp
index 45c724a..6751995 100644
--- a/JavaScriptCore/wtf/CurrentTime.cpp
+++ b/JavaScriptCore/wtf/CurrentTime.cpp
@@ -63,6 +63,10 @@ extern "C" time_t mktime(struct tm *t);
 #include <sys/time.h>
 #endif
 
+#if PLATFORM(CHROMIUM)
+#error Chromium uses a different timer implementation
+#endif
+
 namespace WTF {
 
 const double msPerSecond = 1000.0;
diff --git a/JavaScriptCore/wtf/DateMath.cpp b/JavaScriptCore/wtf/DateMath.cpp
index 0386494..2110432 100644
--- a/JavaScriptCore/wtf/DateMath.cpp
+++ b/JavaScriptCore/wtf/DateMath.cpp
@@ -501,13 +501,13 @@ double gregorianDateTimeToMS(const GregorianDateTime& t, double milliSeconds, bo
     return result;
 }
 
+// input is UTC
 void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
 {
-    // input is UTC
     double dstOff = 0.0;
-    const double utcOff = getUTCOffset();
-
-    if (!outputIsUTC) {  // convert to local time
+    double utcOff = 0.0;
+    if (!outputIsUTC) {
+        utcOff = getUTCOffset();
         dstOff = getDSTOffset(ms, utcOff);
         ms += dstOff + utcOff;
     }
@@ -522,8 +522,7 @@ void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
     tm.month    =  monthFromDayInYear(tm.yearDay, isLeapYear(year));
     tm.year     =  year - 1900;
     tm.isDST    =  dstOff != 0.0;
-
-    tm.utcOffset = outputIsUTC ? 0 : static_cast<long>((dstOff + utcOff) / msPerSecond);
+    tm.utcOffset = static_cast<long>((dstOff + utcOff) / msPerSecond);
     tm.timeZone = NULL;
 }
 
diff --git a/JavaScriptCore/wtf/FastMalloc.h b/JavaScriptCore/wtf/FastMalloc.h
index ca0961c..541b05d 100644
--- a/JavaScriptCore/wtf/FastMalloc.h
+++ b/JavaScriptCore/wtf/FastMalloc.h
@@ -26,13 +26,19 @@
 #include <stdlib.h>
 #include <new>
 
+#if COMPILER(GCC)
+#define WTF_FAST_MALLOC_EXPORT __attribute__((visibility("default")))
+#else
+#define WTF_FAST_MALLOC_EXPORT
+#endif
+
 namespace WTF {
 
     // These functions call CRASH() if an allocation fails.
-    void* fastMalloc(size_t);
+    void* fastMalloc(size_t) WTF_FAST_MALLOC_EXPORT;
     void* fastZeroedMalloc(size_t);
-    void* fastCalloc(size_t numElements, size_t elementSize);
-    void* fastRealloc(void*, size_t);
+    void* fastCalloc(size_t numElements, size_t elementSize) WTF_FAST_MALLOC_EXPORT;
+    void* fastRealloc(void*, size_t) WTF_FAST_MALLOC_EXPORT;
 
     struct TryMallocReturnValue {
         TryMallocReturnValue(void* data)
@@ -71,7 +77,7 @@ namespace WTF {
     TryMallocReturnValue tryFastCalloc(size_t n_elements, size_t element_size);
     TryMallocReturnValue tryFastRealloc(void* p, size_t n);
 
-    void fastFree(void*);
+    void fastFree(void*) WTF_FAST_MALLOC_EXPORT;
 
 #ifndef NDEBUG    
     void fastMallocForbid();
diff --git a/JavaScriptCore/wtf/MathExtras.h b/JavaScriptCore/wtf/MathExtras.h
index 324300d..556230e 100644
--- a/JavaScriptCore/wtf/MathExtras.h
+++ b/JavaScriptCore/wtf/MathExtras.h
@@ -102,6 +102,8 @@ inline bool signbit(double x) { struct ieee_double *p = (struct ieee_double *)&x
 
 #if COMPILER(MSVC) || COMPILER(RVCT)
 
+inline long long llround(double num) { return static_cast<long long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
+inline long long llroundf(float num) { return static_cast<long long>(num > 0 ? num + 0.5f : ceil(num - 0.5f)); }
 inline long lround(double num) { return static_cast<long>(num > 0 ? num + 0.5 : ceil(num - 0.5)); }
 inline long lroundf(float num) { return static_cast<long>(num > 0 ? num + 0.5f : ceilf(num - 0.5f)); }
 inline double round(double num) { return num > 0 ? floor(num + 0.5) : ceil(num - 0.5); }
diff --git a/JavaScriptCore/wtf/MessageQueue.h b/JavaScriptCore/wtf/MessageQueue.h
index 12291cc..9c9a4a78 100644
--- a/JavaScriptCore/wtf/MessageQueue.h
+++ b/JavaScriptCore/wtf/MessageQueue.h
@@ -55,9 +55,13 @@ namespace WTF {
         bool waitForMessage(DataType&);
         template<typename Predicate>
         MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
-        void kill();
+
+        template<typename Predicate>
+        void removeIf(Predicate&);
 
         bool tryGetMessage(DataType&);
+
+        void kill();
         bool killed() const;
 
         // The result of isEmpty() is only valid if no other thread is manipulating the queue at the same time.
@@ -149,6 +153,17 @@ namespace WTF {
     }
 
     template<typename DataType>
+    template<typename Predicate>
+    inline void MessageQueue<DataType>::removeIf(Predicate& predicate)
+    {
+        MutexLocker lock(m_mutex);
+        DequeConstIterator<DataType> found = m_queue.end();
+        while ((found = m_queue.findIf(predicate)) != m_queue.end()) {
+            m_queue.remove(found);
+       }
+    }
+
+    template<typename DataType>
     inline bool MessageQueue<DataType>::isEmpty()
     {
         MutexLocker lock(m_mutex);
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index 75a0bc4..cde4c17 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -493,6 +493,7 @@
 #if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && defined(__x86_64__)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
@@ -510,6 +511,7 @@
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #endif
 
 #if PLATFORM(IPHONE)
@@ -526,6 +528,7 @@
 #define HAVE_READLINE 1
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #endif
 
 #if PLATFORM(WIN)
@@ -539,6 +542,7 @@
 #if PLATFORM(GTK)
 #if HAVE(PTHREAD_H)
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #endif
 #endif
 
@@ -546,6 +550,7 @@
 #define HAVE_POSIX_MEMALIGN 1
 #define WTF_USE_CURL 1
 #define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #define USE_SYSTEM_MALLOC 1
 #define ENABLE_NETSCAPE_PLUGIN_API 0
 #endif
@@ -742,7 +747,7 @@
 #endif
 
 #if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
-#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX))
+#if PLATFORM(X86_64) && (PLATFORM(DARWIN) || PLATFORM(LINUX) || PLATFORM(WIN_OS))
 #define WTF_USE_JSVALUE64 1
 #elif PLATFORM(ARM) || PLATFORM(PPC64)
 #define WTF_USE_JSVALUE32 1
@@ -769,8 +774,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
 #elif PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)
-    /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */
-    #define ENABLE_JIT 0
+    #define ENABLE_JIT 1
     #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
 #elif PLATFORM(X86) && PLATFORM(WIN)
@@ -836,8 +840,7 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 /* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
 #if (PLATFORM(X86) && PLATFORM(MAC)) \
  || (PLATFORM(X86_64) && PLATFORM(MAC)) \
- /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */ \
- || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE) && 0) \
+ || (PLATFORM(ARM_THUMB2) && PLATFORM(IPHONE)) \
  || (PLATFORM(X86) && PLATFORM(WIN))
 #define ENABLE_YARR 1
 #define ENABLE_YARR_JIT 1
@@ -903,6 +906,10 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #define WARN_UNUSED_RETURN
 #endif
 
+#if !ENABLE(NETSCAPE_PLUGIN_API) || (ENABLE(NETSCAPE_PLUGIN_API) && ((PLATFORM(UNIX) && (PLATFORM(QT) || PLATFORM(WX))) || PLATFORM(GTK)))
+#define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
+#endif
+
 /* Set up a define for a common error that is intended to cause a build error -- thus the space after Error. */
 #define WTF_PLATFORM_CFNETWORK Error USE_macro_should_be_used_with_CFNETWORK
 
diff --git a/JavaScriptCore/wtf/StdLibExtras.h b/JavaScriptCore/wtf/StdLibExtras.h
index d21d1ff..c9b5742 100644
--- a/JavaScriptCore/wtf/StdLibExtras.h
+++ b/JavaScriptCore/wtf/StdLibExtras.h
@@ -32,6 +32,7 @@
 // Use these to declare and define a static local variable (static T;) so that
 //  it is leaked so that its destructors are not called at exit. Using this
 //  macro also allows workarounds a compiler bug present in Apple's version of GCC 4.0.1.
+#ifndef DEFINE_STATIC_LOCAL
 #if COMPILER(GCC) && defined(__APPLE_CC__) && __GNUC__ == 4 && __GNUC_MINOR__ == 0 && __GNUC_PATCHLEVEL__ == 1
 #define DEFINE_STATIC_LOCAL(type, name, arguments) \
     static type* name##Ptr = new type arguments; \
@@ -40,6 +41,7 @@
 #define DEFINE_STATIC_LOCAL(type, name, arguments) \
     static type& name = *new type arguments
 #endif
+#endif
 
 // OBJECT_OFFSETOF: Like the C++ offsetof macro, but you can use it with classes.
 // The magic number 0x4000 is insignificant. We use it to avoid using NULL, since
diff --git a/JavaScriptCore/wtf/StringExtras.h b/JavaScriptCore/wtf/StringExtras.h
index 559e3f2..1120d65 100644
--- a/JavaScriptCore/wtf/StringExtras.h
+++ b/JavaScriptCore/wtf/StringExtras.h
@@ -75,12 +75,12 @@ inline char* strdup(const char* strSource)
 
 inline int strncasecmp(const char* s1, const char* s2, size_t len)
 {
-    return strnicmp(s1, s2, len);
+    return _strnicmp(s1, s2, len);
 }
 
 inline int strcasecmp(const char* s1, const char* s2)
 {
-    return stricmp(s1, s2);
+    return _stricmp(s1, s2);
 }
 
 #endif
diff --git a/JavaScriptCore/wtf/Threading.cpp b/JavaScriptCore/wtf/Threading.cpp
index 56bf438..1d4185c 100644
--- a/JavaScriptCore/wtf/Threading.cpp
+++ b/JavaScriptCore/wtf/Threading.cpp
@@ -51,7 +51,7 @@ static void* threadEntryPoint(void* contextData)
 
     setThreadNameInternal(context->name);
 
-    // Block until our creating thread has completed any extra setup work
+    // Block until our creating thread has completed any extra setup work.
     {
         MutexLocker locker(context->creationMutex);
     }
diff --git a/JavaScriptCore/wtf/ThreadingPthreads.cpp b/JavaScriptCore/wtf/ThreadingPthreads.cpp
index abefb40..38faa61 100644
--- a/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -272,7 +272,10 @@ void Mutex::unlock()
 }
 
 #if HAVE(PTHREAD_RWLOCK)
+<<<<<<< HEAD:JavaScriptCore/wtf/ThreadingPthreads.cpp
 
+=======
+>>>>>>> webkit.org at r50258.:JavaScriptCore/wtf/ThreadingPthreads.cpp
 ReadWriteLock::ReadWriteLock()
 {
     pthread_rwlock_init(&m_readWriteLock, NULL);
diff --git a/JavaScriptCore/yarr/RegexInterpreter.cpp b/JavaScriptCore/yarr/RegexInterpreter.cpp
index aafea3c..d088086 100644
--- a/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -1490,7 +1490,7 @@ public:
         closeBodyAlternative();
     }
 
-    void alterantiveBodyDisjunction()
+    void alternativeBodyDisjunction()
     {
         int newAlternativeIndex = m_bodyDisjunction->terms.size();
         m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
@@ -1499,7 +1499,7 @@ public:
         m_currentAlternativeIndex = newAlternativeIndex;
     }
 
-    void alterantiveDisjunction()
+    void alternativeDisjunction()
     {
         int newAlternativeIndex = m_bodyDisjunction->terms.size();
         m_bodyDisjunction->terms[m_currentAlternativeIndex].alternative.next = newAlternativeIndex - m_currentAlternativeIndex;
@@ -1515,9 +1515,9 @@ public:
 
             if (alt) {
                 if (disjunction == m_pattern.m_body)
-                    alterantiveBodyDisjunction();
+                    alternativeBodyDisjunction();
                 else
-                    alterantiveDisjunction();
+                    alternativeDisjunction();
             }
 
             PatternAlternative* alternative = disjunction->m_alternatives[alt];
diff --git a/JavaScriptCore/yarr/RegexJIT.cpp b/JavaScriptCore/yarr/RegexJIT.cpp
index d777424..5ce579a 100644
--- a/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/JavaScriptCore/yarr/RegexJIT.cpp
@@ -1264,7 +1264,7 @@ class RegexGenerator : private MacroAssembler {
         // complex here in compilation, and in the common case we should end up coallescing the checks.
         //
         // FIXME: a nice improvement here may be to stop trying to match sooner, based on the least
-        // of the minimum-alterantive-lengths.  E.g. if I have two alternatives of length 200 and 150,
+        // of the minimum-alternative-lengths.  E.g. if I have two alternatives of length 200 and 150,
         // and a string of length 100, we'll end up looping index from 0 to 100, checking whether there
         // is sufficient input to run either alternative (constantly failing).  If there had been only
         // one alternative, or if the shorter alternative had come first, we would have terminated
@@ -1309,9 +1309,6 @@ class RegexGenerator : private MacroAssembler {
         loadPtr(Address(X86Registers::ebp, 2 * sizeof(void*)), output);
     #endif
 #elif PLATFORM(ARM)
-#if PLATFORM(ARM_TRADITIONAL)
-        push(ARMRegisters::lr);
-#endif
         push(ARMRegisters::r4);
         push(ARMRegisters::r5);
         push(ARMRegisters::r6);
@@ -1400,14 +1397,6 @@ void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const
     }
 }
 
-int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
-{
-    if (JSRegExp* fallback = jitObject.getFallback())
-        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
-
-    return jitObject.execute(input, start, length, output);
-}
-
 }}
 
 #endif
diff --git a/JavaScriptCore/yarr/RegexJIT.h b/JavaScriptCore/yarr/RegexJIT.h
index 5b0df9d..1872f21 100644
--- a/JavaScriptCore/yarr/RegexJIT.h
+++ b/JavaScriptCore/yarr/RegexJIT.h
@@ -82,7 +82,14 @@ private:
 };
 
 void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
-int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize);
+
+inline int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
+{
+    if (JSRegExp* fallback = jitObject.getFallback())
+        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
+
+    return jitObject.execute(input, start, length, output);
+}
 
 } } // namespace JSC::Yarr
 
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index 87f87f0..7a8598a 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,62 @@
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Updated for JavaScriptCore export changes.
+
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Updated for JavaScriptCore export changes.
+
+        * ForwardingHeaders/wtf/DateMath.h: Added.
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated license
+
+        * LICENSE:
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * UserObjectImp.h:
+        (UserObjectImp::createStructure):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * UserObjectImp.h:
+        (UserObjectImp::createStructure):
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * UserObjectImp.h:
+        (UserObjectImp::createStructure):
+
 2009-09-28  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Sam Weinig.
diff --git a/JavaScriptGlue/Configurations/DebugRelease.xcconfig b/JavaScriptGlue/Configurations/DebugRelease.xcconfig
index 5161969..a0ca127 100644
--- a/JavaScriptGlue/Configurations/DebugRelease.xcconfig
+++ b/JavaScriptGlue/Configurations/DebugRelease.xcconfig
@@ -28,6 +28,7 @@ ARCHS_ = $(ARCHS_1040);
 ARCHS_1040 = $(NATIVE_ARCH);
 ARCHS_1050 = $(NATIVE_ARCH);
 ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -36,5 +37,6 @@ MACOSX_DEPLOYMENT_TARGET_ = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
diff --git a/JavaScriptGlue/Configurations/Version.xcconfig b/JavaScriptGlue/Configurations/Version.xcconfig
index 66d574b..fabc009 100644
--- a/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 2;
+MINOR_VERSION = 4;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -36,6 +36,7 @@ SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_V
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
 SYSTEM_VERSION_PREFIX_1060 = 6;
+SYSTEM_VERSION_PREFIX_1070 = 7;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/DateInstanceCache.h b/JavaScriptGlue/ForwardingHeaders/wtf/DateInstanceCache.h
new file mode 100644
index 0000000..dbc18a0
--- /dev/null
+++ b/JavaScriptGlue/ForwardingHeaders/wtf/DateInstanceCache.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/DateInstanceCache.h>
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/DateMath.h b/JavaScriptGlue/ForwardingHeaders/wtf/DateMath.h
new file mode 100644
index 0000000..becafe1
--- /dev/null
+++ b/JavaScriptGlue/ForwardingHeaders/wtf/DateMath.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/DateMath.h>
diff --git a/JavaScriptGlue/LICENSE b/JavaScriptGlue/LICENSE
index 47dee86..f29b41c 100644
--- a/JavaScriptGlue/LICENSE
+++ b/JavaScriptGlue/LICENSE
@@ -1,25 +1,21 @@
-Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
-
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
-3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-    its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    documentation and/or other materials provided with the distribution.
 
-THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/JavaScriptGlue/UserObjectImp.h b/JavaScriptGlue/UserObjectImp.h
index 98c9276..6bb5792 100644
--- a/JavaScriptGlue/UserObjectImp.h
+++ b/JavaScriptGlue/UserObjectImp.h
@@ -61,7 +61,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, OverridesGetOwnPropertySlot | OverridesMarkChildren | OverridesGetPropertyNames));
     }
 
 private:
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 459204d..1727089 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,8753 @@
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA: add support for 'option' role
+        https://bugs.webkit.org/show_bug.cgi?id=30843
+
+        Test: accessibility/aria-option-role.html
+
+        * accessibility/AccessibilityListBoxOption.h:
+        (WebCore::AccessibilityListBoxOption::canHaveChildren):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+
+2009-10-28  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix GCC compiler warnings in WebCore, and enable -Wall and -Werror for Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=30716
+
+        * WebCore.gyp/WebCore.gyp:  Enable "chromium_code" flag, just on Mac build for now.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::createARIARoleMap):  Fix struct visibiity warning.
+        * bindings/v8/ScriptCallStack.h:  Fix out-of-order member initialization warning.
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):  Function in header should not be 'static' (fixes unused-static warning.)
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):  Fix signed/unsigned comparison warning.
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::applyGrouping):  Fix unused-variable warning.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):  Enable ListButtonPart case to avoid
+            warning about missing cases in 'switch' statement.
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):  Fix struct visibiity warning.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):  Fix out-of-order member initialization warning.
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart):  Add empty 'default' case in
+            'switch' statement to avoid missing-case warning.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):  Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::createFunctionMap):  Fix struct visibiity warning.
+
+2009-10-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION: crashes in WebCore::RedirectScheduler::timerFired(WebCore::Timer<WebCore::RedirectScheduler>*)
+        https://bugs.webkit.org/show_bug.cgi?id=30839
+
+        Added null check for the case when the frame is detached from the page.
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30817
+        Use parentObjectUnignored instead of parentObject in webkit_accessible_get_parent
+
+        Also removes the hack I had originally added to solve bug 25411, because
+        the fix here is what I should have done in the first place.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30805
+        Add MessageQueue::removeIf(Predicate&) to remove certain tasks without pulling them from the queue.
+        Existing Database tests cover this, no change in functionality.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::SameDatabasePredicate::SameDatabasePredicate): Added predicate that flags the tasks belonging to a specified database.
+        (WebCore::SameDatabasePredicate::operator()):
+        (WebCore::DatabaseThread::unscheduleDatabaseTasks): changed to use the new removeIf method.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Glue subsequent timeline records with same category
+        and title together.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30885
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineRecordTreeElement.prototype.refresh):
+
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fails new test fast/js/navigator-language.html
+        https://bugs.webkit.org/show_bug.cgi?id=30440
+
+        Reimplement WebCore::defaultLanguage to account for changes in
+        locale done by setLocale.
+
+        Already existing test: fast/js/navigator-language.html
+
+        * platform/gtk/Language.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+            Exit from fullscreen if necessary.
+        * html/HTMLMediaElement.h:
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - a trivial fix to get Windows bots running.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::setHeaderFields): Don't try to
+        access empty vector's data.
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Remove the extraneous object of ROLE_PANEL.
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+
+2009-10-28  Jonathan Dixon  <joth@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 30547: (Chromium) searchbox not rendered properly due to the css property -webkit-border-radius
+        https://bugs.webkit.org/show_bug.cgi?id=30547
+
+        Test: fast/css/text-input-with-webkit-border-radius.html
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+          Implemented rounded border rendering in Chromium Windows theme renderer.
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pull items collections from resources panel and
+        timeline panel into AbstractTimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30875
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.AbstractTimelinePanel.prototype.createItemGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype._hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelinePanel.prototype.reset):
+        (WebInspector.AbstractTimelinePanel.prototype.get calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.set calculator):
+        (WebInspector.AbstractTimelinePanel.prototype.addItem):
+        (WebInspector.AbstractTimelinePanel.prototype.removeItem):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshItem):
+        (WebInspector.AbstractTimelinePanel.prototype.revealAndSelectItem):
+        (WebInspector.AbstractTimelinePanel.prototype.sortItems):
+        (WebInspector.AbstractTimelinePanel.prototype.adjustScrollPosition):
+        (WebInspector.AbstractTimelineCategory):
+        (WebInspector.AbstractTimelineCategory.prototype.toString):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.createItemTreeElement):
+        (WebInspector.ResourcesPanel.prototype.createItemGraph):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.get searchableViews):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction.sortFuction):
+        (WebInspector.ResourcesPanel.prototype.get searchResultsSortFunction):
+        (WebInspector.ResourcesPanel.prototype.searchMatchFound):
+        (WebInspector.ResourcesPanel.prototype.searchCanceled):
+        (WebInspector.ResourcesPanel.prototype.performSearch):
+        (WebInspector.ResourcesPanel.prototype.refresh):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.removeResource):
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource):
+        (WebInspector.ResourcesPanel.prototype.clearMessages):
+        (WebInspector.ResourcesPanel.prototype.refreshResource):
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.showResource):
+        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        (WebInspector.ResourcesPanel.prototype.get _resources):
+        (WebInspector.ResourceTimeCalculator.prototype._upperBound):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.createItemTreeElement):
+        (WebInspector.TimelinePanel.prototype.createItemGraph):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelineCategory):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Resets InspectorFrontend in InspectorTimelineAgent instead of removing it so
+        that it remains active on refreshs and page transitions.
+        https://bugs.webkit.org/show_bug.cgi?id=30874
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::resetFrontendProxyObject):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Expose WebCore::counterValueForElement as a WebCore API.
+
+        * WebCore.base.exp:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeCounterValuesFromChildren):
+        (WebCore::counterValueForElement):
+        * rendering/RenderTreeAsText.h:
+
+2009-10-28  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, Chromium build fix for r50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds InspectorTimelineAgent  instrumentation for encountering a
+        <SCRIPT> tag when parsing an HTML document. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30861
+
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        (WebCore::ScriptSourceCode::url):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::willScriptTag):
+        (WebCore::InspectorTimelineAgent::didScriptTag):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createScriptTagTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Makes sure that Geolocation watch IDs remain positive on overflow.
+        https://bugs.webkit.org/show_bug.cgi?id=30122
+
+        No new tests possible.
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::watchPosition): Modified. Reset the watch ID to 1 on overflow.
+
+2009-10-28  George Staikos  <george.staikos@torchmobile.com>
+
+        Attempt to fix the Mac debug build after 50225.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+
+2009-10-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30841
+        <rdar://problem/7342730> WebKit should not pass Referer header through a redirect to a non-secure site
+
+        Tests: http/tests/ssl/referer-301.html
+               http/tests/ssl/referer-303.html
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        Remove Referer header if redirecting from https to another protocol.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::clearHTTPReferrer): Update request counterparts, as it is
+        always done when changing or adding header fields.
+        (WebCore::ResourceRequestBase::clearHTTPOrigin): Ditto.
+
+        * platform/network/ResourceRequestBase.h: clearHTTPReferrer() and clearHTTPOrigin() are
+        no longer inline, since they have non-trivial implementations.
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Fixed to synchronize header field removals.
+        (WebCore::ResourceRequest::doUpdateResourceRequest): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::setHeaderFields):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        Match Mac changes.
+        
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Add FrameLoader::defaultObjectContentType, containing common code for
+        implementing FrameLoaderClient::objectContentType.  (Currently the gtk
+        and win ports have copied this code, and the qt port uses similar code
+        with a few extra clauses.  Moving this to a utility function cuts down
+        on copied code.)   This causes no behavioural change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30868
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Enforce the versioning, by ignoring any version different
+        from 1.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up fix to InspectorControllerStub.
+        Define it after inspector.js due to namespace
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * inspector/front-end/inspector.html:
+
+2009-10-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add InspectorController stub in order to
+        support opening in standalone mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30866
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/InspectorControllerStub.js: Added.
+        (.WebInspector.InspectorControllerStub):
+        (.WebInspector.InspectorControllerStub.prototype.wrapCallback):
+        (.WebInspector.InspectorControllerStub.prototype.isWindowVisible):
+        (.WebInspector.InspectorControllerStub.prototype.platform):
+        (.WebInspector.InspectorControllerStub.prototype.closeWindow):
+        (.WebInspector.InspectorControllerStub.prototype.attach):
+        (.WebInspector.InspectorControllerStub.prototype.detach):
+        (.WebInspector.InspectorControllerStub.prototype.storeLastActivePanel):
+        (.WebInspector.InspectorControllerStub.prototype.clearMessages):
+        (.WebInspector.InspectorControllerStub.prototype.searchingForNode):
+        (.WebInspector.InspectorControllerStub.prototype.search):
+        (.WebInspector.InspectorControllerStub.prototype.toggleNodeSearch):
+        (.WebInspector.InspectorControllerStub.prototype.setAttachedWindowHeight):
+        (.WebInspector.InspectorControllerStub.prototype.moveByUnrestricted):
+        (.WebInspector.InspectorControllerStub.prototype.addResourceSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.addSourceToFrame):
+        (.WebInspector.InspectorControllerStub.prototype.getResourceDocumentNode):
+        (.WebInspector.InspectorControllerStub.prototype.highlightDOMNode):
+        (.WebInspector.InspectorControllerStub.prototype.hideDOMNodeHighlight):
+        (.WebInspector.InspectorControllerStub.prototype.inspectedWindow):
+        (.WebInspector.InspectorControllerStub.prototype.loaded):
+        (.WebInspector.InspectorControllerStub.prototype.localizedStringsURL):
+        (.WebInspector.InspectorControllerStub.prototype.windowUnloading):
+        (.WebInspector.InspectorControllerStub.prototype.hiddenPanels):
+        (.WebInspector.InspectorControllerStub.prototype.debuggerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.disableResourceTracking):
+        (.WebInspector.InspectorControllerStub.prototype.resourceTrackingEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.disableDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.addBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.removeBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.updateBreakpoint):
+        (.WebInspector.InspectorControllerStub.prototype.pauseInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.pauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.setPauseOnExceptions):
+        (.WebInspector.InspectorControllerStub.prototype.resumeDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.profilerEnabled):
+        (.WebInspector.InspectorControllerStub.prototype.enableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.disableProfiler):
+        (.WebInspector.InspectorControllerStub.prototype.startProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.stopProfiling):
+        (.WebInspector.InspectorControllerStub.prototype.getProfileHeaders):
+        (.WebInspector.InspectorControllerStub.prototype.getProfile):
+        (.WebInspector.InspectorControllerStub.prototype.takeHeapSnapshot):
+        (.WebInspector.InspectorControllerStub.prototype.databaseTableNames):
+        (.WebInspector.InspectorControllerStub.prototype.stepIntoStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOutOfFunctionInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.stepOverStatementInDebugger):
+        (.WebInspector.InspectorControllerStub.prototype.setSetting):
+        (.WebInspector.InspectorControllerStub.prototype.dispatchOnInjectedScript):
+        (.WebInspector.InspectorControllerStub.prototype.releaseWrapperObjectGroup):
+        (.WebInspector.InspectorControllerStub.prototype.setting):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.UIString):
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+
+        Expands upon the new funtionality which allows platforms to indicate
+        that a particular object should not be ignored, so that they can
+        specify that an object should be ignored or that it should be left up
+        to the default handling to decide.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+
+2009-10-28  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        Expose the table summary as the accessible description because there is no summary object.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_description):
+
+2009-10-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds ScriptController::intializeThreading(), with both JSC and V8 implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=30678
+
+        This new method is used from common code, rather than calling JSC::initializeThreading() (or the V8 equivalent) directly.
+
+        Build fix, no new tests required.
+
+        * bindings/js/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/js/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * bindings/v8/ScriptController.cpp: Modified.
+        (WebCore::ScriptController::initializeThreading): Added.
+        * bindings/v8/ScriptController.h: Modified. Adds ScriptController::initializeThreading().
+        * loader/icon/IconDatabase.cpp: Modified.
+        (WebCore::iconDatabase): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+        * storage/Database.cpp: Modified.
+        (WebCore::Database::Database): Call ScriptController::initializeThreading(), rather than JSC::initializeThreading().
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Document a feature of the m_liveDecodedResources list.
+        https://bugs.webkit.org/show_bug.cgi?id=30209
+
+        The code made the assumption that the list is sorted by
+        the m_lastDecodedAccessTime property of the CachedResource.
+        The above is not true when CachedResource::setDecodedSize
+        is called and the item is inserted the first time. In this
+        case the m_lastDecodedAccessTime is still zero and the
+        m_liveDecodedResources list becomes unsorted.
+
+        It is impossible that Cache::pruneLiveResources will
+        stop to process the list too early due this feature and
+        the alternatives of updating m_lastDecodedAccessTime in
+        CachedResource::setDecodedSize or changing the insert
+        to search the right position have a negative impact on
+        performance. The best solution for now is to document
+        this feature.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setDecodedSize):
+
+2009-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+
+        Make text controls always implement the text interface, and the
+        editable text interface when they are not read only. This is what
+        ATK-users expect.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getInterfaceMaskFromObject):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The current HitTestResult methods are not using the (3d)
+        transformation aware routines. This can lead to an assertion
+        SVGRenderBase::mapLocalToContainer method.
+
+        Change HitTestResult::imageRect to use the (3d) transformation
+        aware RenderBox::absoluteContentQuad to avoid running into
+        an assertion with SVG content.
+
+        Remove HitTestResult::boundingBox() as it is only used in
+        two places and conceptually doesn't belong into a HitTest
+        which is operating on points.
+
+        A classic test case is not possible as the methods are not excercised
+        from within HTML/SVG but from the WebKit API Layer. A unittest
+        for Qt/Gtk+/Mac would need to be written but Qt/Gtk+ currently
+        do not support 3d transformations making it impossible to write
+        a reliable test case and the Mac port is currently not doing
+        unit testing.
+
+
+        * rendering/HitTestResult.cpp: Remove boundingBox() method
+        (WebCore::HitTestResult::imageRect): Use transformation aware method
+        * rendering/HitTestResult.h: Remove boundingBox()
+
+2009-10-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Custom Cursor doesn't use hotspot.
+        https://bugs.webkit.org/show_bug.cgi?id=30820
+
+        Cursors loaded from a QPixmap didn't specifiy the
+        hotspot. Take the hotspot values from the mac
+        implementation.
+
+        * platform/qt/CursorQt.cpp:
+
+2009-10-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Initial revision of the Timeline grid.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30834
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype.populateSidebar):
+        (WebInspector.AbstractTimelinePanel.prototype.refresh):
+        (WebInspector.AbstractTimelineCalculator):
+        * inspector/front-end/Images/timelineBarBlue.png: Added.
+        * inspector/front-end/Images/timelineBarGray.png: Added.
+        * inspector/front-end/Images/timelineBarGreen.png: Added.
+        * inspector/front-end/Images/timelineBarOrange.png: Added.
+        * inspector/front-end/Images/timelineBarPurple.png: Added.
+        * inspector/front-end/Images/timelineBarRed.png: Added.
+        * inspector/front-end/Images/timelineBarYellow.png: Added.
+        * inspector/front-end/Images/timelineCheckmarks.png: Added.
+        * inspector/front-end/Images/timelineDots.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.get categories):
+        (WebInspector.TimelinePanel.prototype.populateSidebar):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype.refresh):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButtonClick):
+        (WebInspector.TimelinePanel.prototype.reset):
+        (WebInspector.TimelinePanel.prototype._formatRecord):
+        (WebInspector.TimelinePanel.prototype.showCategory):
+        (WebInspector.TimelinePanel.prototype.hideCategory):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computePercentageFromEventTime):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        (WebInspector.TimelineGraph):
+        (WebInspector.TimelineGraph.prototype.get graphElement):
+        (WebInspector.TimelineGraph.prototype.refreshLabelPositions):
+        (WebInspector.TimelineGraph.prototype.refresh):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Move runAfterPendingDispatches to TestController for Clarity
+        https://bugs.webkit.org/show_bug.cgi?id=30844
+
+        * inspector/front-end/TestController.js:
+        (WebInspector.TestController.prototype.runAfterPendingDispatches):
+        * inspector/front-end/inspector.js: moved runAfterPendingDispatches
+
+2009-10-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing forward declaration of FramelessScrollView.
+        https://bugs.webkit.org/show_bug.cgi?id=30824
+
+        * platform/chromium/FramelessScrollViewClient.h:
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        WAI-ARIA: add support for 'presentation' role
+        https://bugs.webkit.org/show_bug.cgi?id=30806
+
+        Test: accessibility/aria-presentational-role.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::RoleEntry::):
+
+2009-10-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ARIA menu/menu item need AXRoleDescription
+        https://bugs.webkit.org/show_bug.cgi?id=30804
+
+        Make sure that role descriptions will default to the system's first, before
+        returning an unknown role.
+
+        Test: platform/mac/accessibility/aria-menu-role-descriptions.html
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper roleDescription]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Qt build fix: migrated away from API that no longer exists.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Fix wording in comment.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+
+2009-10-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        We allocate an autorelease pool but then store it off the stack. In a
+        GC environment this led to it being collected, and thus caused badness
+        to ensue.  To work around this we simply avoid using a pool at all in
+        a GC environment as it would be a no-op anyway.
+
+        * bridge/objc/objc_instance.mm:
+        (allocateAutoReleasePool):
+        (ObjcInstance::virtualBegin):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When a Geolocation method is called, immediately calls the error calback asynchronously if permissions
+        have already been denied.
+        https://bugs.webkit.org/show_bug.cgi?id=27944.
+
+        Tests: fast/dom/Geolocation/permission-denied-already-error.html
+               fast/dom/Geolocation/permission-denied-already-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. GeoNotifier takes Geolocation object as constructor argument.
+        (WebCore::Geolocation::GeoNotifier::setFatalError): Added. Sets a fatal error for this notifier, causing it to terminate immediately and call the error callback asynchronously.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Added. Used to call the error callback asynchronously on fatal error.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::watchPosition): Modified. Calls startRequest.
+        (WebCore::Geolocation::startRequest): Added. Common functionality for starting a one-shot or watch request. Sets a fatal error on the notifier if permissions have already been denied.
+        (WebCore::Geolocation::fatalErrorOccurred): Added. Registers that a notifier has encountered a fatal error and should be destroyed.
+        (WebCore::Geolocation::setIsAllowed): Modified. Uses a standard error message for the error callback when permissions are denied.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::isDenied): Added. Determines whether permissions have been denied.
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a bug where I was using the wrong Canvas pointer to do a cross-domain check
+        https://bugs.webkit.org/show_bug.cgi?id=30840
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGStyledElement::getPresentationAttribute() can return a shared CSSValue (some SVG tests randomly fail on the bot, and in release builds)
+        https://bugs.webkit.org/show_bug.cgi?id=29620
+
+        SVG was modifying CSSValues cached of off CSSMappedAttributeDeclarations.
+        This patch fixes the check to make sure that a new CSSMappedAttributeDeclaration is
+        created before returning a CSSValue that JavaScript can modify.
+
+        Test: svg/dom/getPresentationAttribute-cache-corruption.svg
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Incomplete repaint of text field in relative positioned inline at imdb.com
+        https://bugs.webkit.org/show_bug.cgi?id=30047
+
+        Test: fast/repaint/inline-relative-positioned.html
+
+        Implemented offsetFromContainer(), mapLocalToContainer() and
+        mapAbsoluteToLocalPoint() in RenderInline.
+
+        * rendering/RenderBox.h: Fixed argument names in the declaration of
+        mapLocalToContainer().
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::offsetFromContainer):
+        (WebCore::RenderInline::mapLocalToContainer):
+        (WebCore::RenderInline::mapAbsoluteToLocalPoint):
+        * rendering/RenderInline.h:
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Speculative build fix for Chromium.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-10-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        Make WebGL context failure more robust and make it succeed in more cases
+        https://bugs.webkit.org/show_bug.cgi?id=30349
+
+        Bubble a failure to get a CGLContext up to HTMLContextElement so it can
+        return null from getContext. Also added a more robust pixel format choosing 
+        mechanism and can render correctly when a SW renderer is chosen.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasRenderingContext.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        (WebCore::CanvasRenderingContext3D::cleanupAfterGraphicsCall):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyCGLPixelFormatForDisplayMask:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::setPixelFormat):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::ensureContext):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: a forwarding header.
+
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Added.
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Making fontWeightIsBold static to fix Snow Leopard build.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+
+2009-10-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit cannot remove nested bold tags
+        https://bugs.webkit.org/show_bug.cgi?id=30784
+
+        This patch modifies getPropertiesNotInComputedStyle so that it compares font-weight
+        more flexibly. Instead of comparing cssText, it uses fontWeightIsBold which converts
+        all font weights to either bold or unbold state.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontWeightIsBold):
+        (WebCore::getPropertiesNotInComputedStyle): Removes font-weight property
+        if two style have the same value under getFontWeightValue
+
+2009-10-27  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Give an ability to WebKit to free statically allocated pointers
+        before quit.
+        https://bugs.webkit.org/show_bug.cgi?id=27980
+
+        No new tests for this as the change does not affect WebKit
+        functionality, but only memory usage.
+
+        * JavaScriptCore/wtf/StdLibExtras.h:
+        Allowed for the override of DEFINE_STATIC_LOCAL via compiler 
+        commandline options or elsewhere in the code. Useful for 
+        implementing custom builds that free resources allocated via
+        DEFINE_STATIC_LOCAL.
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Build fix, no review needed.
+
+        Fixing the BUILD. m_estimatedSize in Database.h should be of type
+        'unsigned long' instead of 'unsigned long long'.
+
+        No tests required.
+
+        * storage/Database.h:
+
+2009-10-27  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Refactoring the Database class to not depend on
+        OriginQuotaManager. Also, adding a SecurityOrigin copy to each
+        Database instance, that is safe to use on the file
+        thread. Finally, adding new simple fields and getters to the
+        Database object for storing/getting the display name and estimated
+        size specified by the user in the openDatabase() call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30548
+
+        * page/SecurityOrigin.h:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Storing the display name and
+        the estimated size in the Database object.
+        (WebCore::Database::Database): Storing the display name and the
+        estimated size in the Database object, as well as a SecurityOrigin
+        instance that is safe to use on the DB thread.
+        (WebCore::Database::maximumSize): Delegate the call to
+        DatabaseTracker::getMaxSizeForDatabase().
+        (WebCore::Database::databaseThreadSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the DB thread.
+        (WebCore::Database::threadSafeSecurityOrigin): Return the
+        SecurityOrigin instance that's safe to use on the current thread.
+        (WebCore::Database::displayName): Return the display name
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::estimatedSize): Return the estimated size
+        specified by the user in the openDatabase() call.
+        (WebCore::Database::fileName): Return the name of the file where
+        the current Database is tored.
+        * storage/Database.h:
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::getMaxSizeForDatabase): Returns the
+        maximum size for a DB file based on the current size of that file
+        and the space available for that origin.
+        * storage/DatabaseTracker.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didCommitTransaction): Use the
+        correct SecurityOrigin instance.
+
+2009-10-27  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Pretty Print all HTML Collection Types like we do for NodeList
+        https://bugs.webkit.org/show_bug.cgi?id=30709
+
+        Test: inspector/console-format-collections.html
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type): check for instances of HTMLCollection like we do for NodeList
+        * inspector/front-end/inspector.js: added WebInspector.pendingDispatches counter
+        (WebInspector.dispatch): increment and decrement dispatch counter
+        (WebInspector.runAfterPendingDispatches): run when there are no more dispatches
+
+2009-10-27  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Adds XMLHttpRequest support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30578
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord):
+        (WebCore::TimelineRecordFactory::createXHRLoadTimelineRecord):
+        * inspector/TimelineRecordFactory.h:
+        * inspector/front-end/TimelineAgent.js:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2009-10-27  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (Safari 4.0.3-ToT): After pressing Shift-PageDown, pressing Shift-Up 
+        extends the top of the selection upwards (but should shrink the selection instead)
+        <rdar://problem/7269075>
+        https://bugs.webkit.org/show_bug.cgi?id=29981
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modify): Added setting m_lastChangeWasHorizontalExtension.
+
+2009-10-27  Brian Weinstein  <bweinstein@apple.com>
+
+        Rubber-stamped by Tim Hatcher.
+        
+        Removed an extra console.log from ElementsTreeOutline.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Rewrote JavaScriptSourceSyntaxHighlighter to be more accurate
+        https://bugs.webkit.org/show_bug.cgi?id=27147
+
+        Tests: LayoutTests/inspector/javascript-syntax-highlight.html
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.process): Added. Processes 100 tokens at a time.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.lex): Added. Scans for a token.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.appendNonToken): Added. Appends the non-token characters that lex ignored.
+        (WebInspector.JavaScriptSourceSyntaxHighlighter.syntaxHighlightNode): Added. To syntax highlight node in ElementsTreeOutline.
+
+2009-10-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Missing null check after string conversion in error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=30774
+
+        Add null check after string conversion in error reporting code.
+        ToString conversion can fail for instance when an exception is
+        thrown during conversion.
+
+        Test: fast/dom/error-to-string-stack-overflow.html
+
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use a pair of maps to store Geolocation watchers.
+        https://bugs.webkit.org/show_bug.cgi?id=29178
+
+        The pair of maps allows us to look up a watcher either by its ID or by its GeoNotifier object.
+        The ability to look up by a watcher by its GeoNotifier object will be required when implementing
+        Geolocation::fatalErrorOccurred. See https://bugs.webkit.org/show_bug.cgi?id=27944
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::Watchers::set): Added. Adds a watcher with the given ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by ID.
+        (WebCore::Geolocation::Watchers::remove): Added. Removes a watcher by GeoNotifier object.
+        (WebCore::Geolocation::Watchers::clear): Added. Removes all watchers.
+        (WebCore::Geolocation::Watchers::isEmpty): Added. Determines if there are no watchers.
+        (WebCore::Geolocation::Watchers::getNotifiersVector): Added. Gets a vector of the GeoNotifier objects.
+        (WebCore::Geolocation::watchPosition): Modified. Rename watcher identifier static variable.
+        (WebCore::Geolocation::stopTimersForWatchers): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::handleError): Modified. Use Watchers::getNotifiersVector.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Use Watchers::getNotifiersVector.
+        * page/Geolocation.h: Modified. Adds Geolocation::Watchers class.
+
+2009-10-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] DOM Storage runtime flag should default to on
+        https://bugs.webkit.org/show_bug.cgi?id=30828
+
+        The DOM Storage runtime flag was supposed to default to on.  I accidentally
+        changed the logic to default to false when I moved the flag.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+
+2009-10-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix crash found in chromium test_shell.
+        https://bugs.webkit.org/show_bug.cgi?id=30808
+
+        When WebSocket is deleted without close, webkit would crash
+        when it handles didClose.
+
+        Check scriptExecutionContext before post task for event.
+        Use WebSocketChannel::disconnect() instead of close() in WebSocket
+        destructor, so that WebSocketChannel should not call deleted WebSocket
+        back in didClose().
+        To make sure WebSocketChannel alive while it is processing WebSocket
+        protocol over SocketStreamHandle, ref() in connect() and deref() in
+        didClose().
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::~WebSocket):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::disconnect):
+        (WebCore::WebSocketChannel::didClose):
+        (WebCore::WebSocketChannel::didReceiveData):
+        * websockets/WebSocketChannel.h:
+
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated Apple license
+
+        * LICENSE-APPLE:
+
+2009-10-27  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig.
+
+        Re-enable the check that disallows pages with unload handlers in the page cache.
+
+        <rdar://problem/7196485> and http://webkit.org/b/29021 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove more empty files that didn't get removed earlier.
+
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+
+2009-10-27  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix assertion crashes introduced by changes made in r50110.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement): only call popCurrentNode() if there are nodes left in the stack.
+
+2009-10-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove empty files that didn't get removed earlier.
+
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+
+2009-10-27  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25534
+        [GTK] Objects of ROLE_TABLE should implement the accessible table interface
+
+        First part of the implementation of AtkTable.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getCell):
+        (getCellIndex):
+        (webkit_accessible_table_ref_at):
+        (webkit_accessible_table_get_index_at):
+        (webkit_accessible_table_get_n_columns):
+        (webkit_accessible_table_get_n_rows):
+        (webkit_accessible_table_get_column_extent_at):
+        (webkit_accessible_table_get_row_extent_at):
+        (webkit_accessible_table_get_row_header):
+        (atk_table_interface_init):
+        (AtkInterfacesInitFunctions):
+        (GetAtkInterfaceTypeFromWAIType):
+
+2009-10-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        [Qt] Don't lose remainder when computing wheel event deltas
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-10-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix QtWebKit build for WIN_OS if Netscape plug-in support
+        is turned off and refactor some related code
+        https://bugs.webkit.org/show_bug.cgi?id=30786
+
+        No new tests as there is no new functionality introduced.
+
+        * platform/FileSystem.h: Refactor to make sure that each different
+        type definition is only repeated once.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compareFileVersion): Move it out from the
+        ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH guard and combine it with the
+        function body from PluginPackageWin.
+
+        * plugins/win/PluginPackageWin.cpp: Remove compareFileVersion as
+        it is now in PluginPackage.cpp.
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27011
+        [Gtk] Implement support for get_index_in_parent
+
+        Implement atk_object_get_index_in_parent.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_index_in_parent):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r50131.
+        http://trac.webkit.org/changeset/50131
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30491
+
+        Fixes an issue where pressing return/enter on the keyboard 
+        in <isindex> does not submit it if is not within a <form>.
+
+        According to the HTML 2.0 thru HTML 4.01 spec 
+        (http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5), the 
+        <isindex> element does not need to be within a <form> element in 
+        order to submit it. It can submitted on its own. Also, if present,
+        the href property of the <base> element will dictate where to submit
+        the value of the <isindex> element (this is analogous to the action 
+        property of the <form> element).
+
+        Tests: http/tests/misc/isindex-with-no-form-base-href.html
+               http/tests/misc/isindex-with-no-form.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Calls createTemporaryFormForIsIndex()
+        to create a <form> if none is present and we are an <isindex> element.
+        (WebCore::HTMLInputElement::createTemporaryFormForIsIndex): Added.
+        * html/HTMLInputElement.h:
+
+2009-10-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash occurs after launching Newsfire 1.6 for the first time
+        https://bugs.webkit.org/show_bug.cgi?id=30807
+
+        Use a RetainPtr in ObjcBinding to ensure that we adequately
+        protect the autorelease pool from GC in GC'd applications.
+
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::ObjcInstance):
+        (ObjcInstance::virtualEnd):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50125.
+
+        * WebCore.pro: Rename TimelineItem to TimelineRecord.
+
+2009-10-26  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Refactor synchronizable property handling to store one shouldSynchronize flag per set of properties rather than one per property.
+
+        Fixes reading uninitialized memory in SynchronizableProperty hash function as well as simplifying the code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30658
+
+        Covered by running various svg tests under valgrind, ex:
+        LayoutTests/svg/custom/js-late-mask-and-object-creation.svg
+
+        * svg/SynchronizablePropertyController.cpp:
+        (WebCore::SynchronizableProperties::addProperty):
+        (WebCore::SynchronizableProperties::synchronize):
+        (WebCore::SynchronizableProperties::startAnimation):
+        (WebCore::SynchronizableProperties::stopAnimation):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h:
+        (WebCore::SynchronizableProperties::SynchronizableProperties):
+        (WebCore::SynchronizableProperties::setNeedsSynchronization):
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Renames TimelineItem to TimelineRecord and updates all call sites.
+        https://bugs.webkit.org/show_bug.cgi?id=30785
+
+        * GNUmakefile.am: 
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addRecordToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        (WebCore::InspectorTimelineAgent::RecordEntry::RecordEntry):
+        * inspector/TimelineItemFactory.cpp: Removed.
+        * inspector/TimelineItemFactory.h: Removed.
+        * inspector/TimelineRecordFactory.cpp: Added.
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        (WebCore::TimelineRecordFactory::createDOMDispatchRecord):
+        (WebCore::TimelineRecordFactory::createGenericTimerRecord):
+        (WebCore::TimelineRecordFactory::createTimerInstallRecord):
+        * inspector/TimelineRecordFactory.h: Added.
+        (WebCore::TimelineRecordFactory::TimelineRecordFactory):
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addRecordToTimeline):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.addRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype.getRecordTypeName):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+
+2009-10-26  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] Windowless Plugins : Print preview shows only part of flash when view is scrolled
+        
+        When printing, QPrinter's preview mode uses a QPicture to capture the output. The
+        QPicture holds a reference to the X Pixmap. As a result, the print preview would
+        update itself when the X Pixmap changes. To prevent the print preview from updating
+        whenever m_drawable is updated (i.e when the view updates), we create a copy.
+        
+        We require that a QPixmap::copy() result in a QPixmap backed by a XPixmap
+        regardless of the graphicssystem. This is taken care of by
+        commit d310f7c710ecb331a9689861f0551eabd38e946e in Qt (4.6)
+        
+        The beauty of this patch is that the newly created X Pixmap is managed by Qt and
+        it will free the Pixmap whenever the user closes the print preview dialog and
+        handles the case of displaying multiple preview dialogs nicely.
+        
+        All credit to Samuel Rødal for suggesting usage of QPixmap::copy().
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30714
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-26  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Don't store properties in the MediaPlayerPrivate class
+
+        Access them via the MediaPlayer class instead.
+        https://bugs.webkit.org/show_bug.cgi?id=30462
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30801>.
+        Web Inspector: Control + ]/[ on Windows doesn't change Panels.
+        
+        In my testing, Windows uses "U+00DB" and "U+00DD" to represent
+        [ and ], so we should honor those as well.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * WebCore.vcproj/QTMovieWin.rc: Use winresrc.h because it exists 
+        even when MFC is not installed, and is all that's needed here.
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Build corrections for ENABLE_FILTERS in Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30797
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * platform/graphics/filters/FEColorMatrix.cpp: Use MathExtras.h and
+          its piDouble constant.
+        * platform/graphics/filters/FEGaussianBlur.cpp: Use MathExtras.h and
+          its piDouble constant.  Remove unnecessary call to floor used in
+          the division of an unsigned, converting to int.
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp: Correct include
+          style for MathExtras.h.
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7289467> and http://webkit.org/b/30798 - REGRESSION (r48687): www.myuhc.com doesn't load.
+
+        Test: fast/loader/grandparent-completion-starts-redirect.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::completed): Notify all descendants that the load completed, not just direct children.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Re-add CSSPropertyWebkitBackgroundSize in one more place
+
+        Fixes transitions/multiple-background-size-transitions.html, transitions/background-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+
+2009-10-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Tidy up the DOM Storage runtime flag stuff
+        https://bugs.webkit.org/show_bug.cgi?id=30794
+
+        Clean up the DOM Storage runtime flag stuff to match the new way of doing
+        things.  No behavioral changes.
+
+        * bindings/v8/RuntimeEnabledFeatures.cpp:
+        * bindings/v8/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::setLocalStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::localStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::setSessionStorageEnabled):
+        (WebCore::RuntimeEnabledFeatures::sessionStorageEnabled):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+
+2009-10-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7308952> and http://webkit.org/b/30424 - REGRESSION (r48687): Pages on ucas.com appear blank.
+
+        Test: fast/loader/history-forward-in-head.html
+
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation): Restore the moved canGoBackOrForward() check.
+          This restores the side effect of an invalid history navigation canceling previous scheduled redirects
+          and also fixes the bug of scheduling an invalid history navigation canceling parsing of the current document.
+        (WebCore::RedirectScheduler::timerFired): Removed the canGoBackOrForward() check as it is now made before
+          the redirect is scheduled.
+
+2009-10-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30049
+        <rdar://problem/7286002> Manipulating DOM from a script while parsing XHTML can cause a crash
+
+        Tests: fast/parser/remove-current-node-parent-x-2.xhtml
+               fast/parser/remove-current-node-parent-x.xhtml
+
+        * dom/XMLTokenizer.h: Store the whole stack of parent nodes - element.parentNode() is
+        unreliable after DOM manipulation.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::pushCurrentNode): Push the new node onto stack.
+        (WebCore::XMLTokenizer::popCurrentNode): This is now called instead of setCurrentNode when
+        exiting a node.
+        (WebCore::XMLTokenizer::clearCurrentNodeStack): We're aborting; or just done parsing. This
+        replaces setCurrentNode(0).
+        (WebCore::XMLTokenizer::enterText): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::exitText): Call popCurrentNode(), removing a long-standing FIXME
+        (not sure if it was ever practical though - how can a parent become null while adding text?)
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer): Call clearCurrentNodeStack().
+        (WebCore::XMLTokenizer::startElementNs): Call pushCurrentNode().
+        (WebCore::XMLTokenizer::endElementNs): Call popCurrentNode() to safely get to a parent. Also
+        added a check fo script element still being in document - Firefox parses those that aren't,
+        but doesn't execute them.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        Match libxml2 version changes.
+
+2009-10-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        background-size: X treated as background-size: X X, not background-size: X auto
+        https://bugs.webkit.org/show_bug.cgi?id=28440
+
+        Updated fast/backgrounds/size/resources/parsing-background-size-values.js
+        and fast/backgrounds/size/resources/parsing-inherit.js
+
+        Reinstated -webkit-background-size and kept its behavior of filling in
+        the second value with the first one; and changed background-size to have
+        the behavior of filling in the second value with 'auto'.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (computedProperties): Re-added CSSPropertyWebkitBackgroundSize.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Ditto.
+        (WebCore::CSSParser::parseFillSize): Adapted for the new parsing rule.
+        (WebCore::CSSParser::parseFillProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+        (WebCore::cssPropertyID): Removed mapping of -webkit-background-size to
+        background-size.
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in: Re-added -webkit-background-size.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Re-added
+        CSSPropertyWebkitBackgroundSize.
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Use "%lli" to format "long long" on WIN_OS to fix HTML5 WebDB crash
+        https://bugs.webkit.org/show_bug.cgi?id=30777
+
+        No new tests as the crash can be reproduced by existing storage
+        LayoutTests (by hitting an assert in debug mode Webkit on WIN_OS).
+
+        * platform/text/String.cpp:
+        (WebCore::String::number): Qt's QString::vsprintf does not
+        understand the "%I64u" format string. Always use the "%lli"
+        format string for Qt port.
+
+2009-10-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Roll back r50073 because r50041-50043 were reverted.  r50073 was
+        a chromium side fix for r50041.
+        https://bugs.webkit.org/show_bug.cgi?id=30789
+
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-10-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=30765
+        REGRESSION (r48701): Removing an event listener causes the one added just after it not to fire
+        
+        and related bugs.
+
+        If the event listener being removed is prior to the current firing event
+        iterator, we need to decrement the current firing event iterator in
+        addition to the endpoint. (Otherwise, shrinking the event listener vector
+        by one implicity moves the current firing event iterator forward by one.
+        It's like relativity, only without the planets.)
+        
+        Also took the opportunity to change some pointers to references, since
+        they can't be null.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::removeAllEventListeners): Update iterator in addition
+        to end, if need be.
+        (WebCore::EventTarget::fireEventListeners): Updated for interface changes.
+        Added a comment to explain a behavior that was implicit enough to be
+        confusing.
+
+        * dom/EventTarget.h:
+        (WebCore::FiringEventIterator::FiringEventIterator):
+        (WebCore::EventTarget::isFiringEventListeners): Updated for interface changes.
+
+2009-10-26  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30792>.
+        Web Inspector: When changing resource scope, resource graph can get in weird state.
+        
+        If the user was scrolled down while looking at All resources, and then just
+        selects Fonts, or something that doesn't have many resources, then the graph
+        will stay scrolled down, even when there is no content there.
+        
+        When the filter is updated, scroll to the top of the graph view, so this won't
+        happen.
+
+        * inspector/front-end/AbstractTimelinePanel.js:
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Fix mac clean build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Extract AbstractTimelinePanel that will be a base
+        class for ResourcesPanel and TimelinePanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30776
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/AbstractTimelinePanel.js: Added.
+        (WebInspector.AbstractTimelinePanel):
+        (WebInspector.AbstractTimelinePanel.prototype.get categories):
+        (WebInspector.AbstractTimelinePanel.prototype.showCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.hideCategory):
+        (WebInspector.AbstractTimelinePanel.prototype.createTimelinePanels):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel.createFilterElement):
+        (WebInspector.AbstractTimelinePanel.prototype._createFilterPanel):
+        (WebInspector.AbstractTimelinePanel.prototype.filter):
+        (WebInspector.AbstractTimelinePanel.prototype._updateFilter):
+        (WebInspector.AbstractTimelinePanel.prototype._createGraph):
+        (WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype._updateSummaryGraph):
+        (WebInspector.AbstractTimelinePanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.AbstractTimelinePanel.prototype.get needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.set needsRefresh):
+        (WebInspector.AbstractTimelinePanel.prototype.refreshIfNeeded):
+        (WebInspector.AbstractTimelinePanel.prototype.show):
+        (WebInspector.AbstractTimelinePanel.prototype.resize):
+        (WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.computeSummaryValues):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.TimelineCalculator.prototype.get boundarySpan):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineCalculator.prototype.reset):
+        (WebInspector.TimelineCalculator.prototype._value):
+        (WebInspector.TimelineCalculator.prototype.formatValue):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.get categories):
+        (WebInspector.ResourcesPanel.prototype.showCategory):
+        (WebInspector.ResourcesPanel.prototype.hideCategory):
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible):
+        (WebInspector.ResourcesPanel.prototype.populateSidebar):
+        (WebInspector.ResourcesPanel.prototype.createPanelEnabler):
+        (WebInspector.ResourcesPanel.prototype.createStatusbarButtons):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype.resize):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype.updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth):
+        (WebInspector.ResourceTimeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator):
+        (WebInspector.ResourceTransferSizeCalculator.prototype.computeBarGraphLabels):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar.prototype.update):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-26  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Adler.
+
+        Use Helvetica in the Inspector as intended.
+        https://bugs.webkit.org/show_bug.cgi?id=30787
+
+        * inspector/front-end/inspector.css:
+
+2009-10-26  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't set window.opener to 0 for the current FrameLoader if a noreferrer link was clicked, only suppress opener in a new frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30781
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Don't suppress opener in the current frame for noreferrer navigations.
+
+2009-10-26  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Data loss occurs when unbolding nested bold tags.
+        https://bugs.webkit.org/show_bug.cgi?id=30083
+
+        Fixes the loop in swapInNodePreservingAttributesAndChildren by saving nextSibling() of child
+        to a temporary valuable.  It was originally calling nextSibling() after appending the child
+        to new parent, in which case, nextSibling is always 0.
+
+        Test: editing/style/unbolding-nested-b.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Storage events should use Document::url() rather than documentURI()
+        https://bugs.webkit.org/show_bug.cgi?id=30535
+
+        Storage events should use Document::url() rather than Document::documentURI()
+        per http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        Test: storage/domstorage/documentURI.html
+
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
+        inherit from HTMLCollection.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionFunctions.h: Removed.
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        * bindings/objc/DOMHTML.mm:
+        (kitClass):
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for ENABLE_FILTERS under Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=30762
+
+        Build correction for ENABLE_FILTERS feature.  No new tests needed.
+
+        * WebCore.vcproj/WebCore.vcproj:  Make the following changes:
+          (1) Create a new 'filters' sub-folder of the platform/graphics 
+              folder to properly show the sources held in this directory.
+          (2) Move the files that are currently shown in svn/graphics/filters
+              to platform/graphics/filters (where they actually live on disk).
+          (3) Add the missing SVGFilter, SVGFilterBuilder, and SVGFETile to
+              the project so they are built.
+          (4) Remove SVGFEFloodElement.cpp from the build, since it is already
+              being compiled by SVGAllInOne.cpp.  Its presence as a separate
+              entity is causing a linker warning for duplicate symbols.
+          (5) Add ImageBuffer.cpp to the build to support color space
+              calculations for non-CG builds.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Add the platform/graphics/filters
+          path to the search paths in the project.
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        console.assert should prefix messages with "Assertion failed: "
+        https://bugs.webkit.org/show_bug.cgi?id=19135
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Append "Assertion failed: " for AssertMessageType.
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * page/Console.cpp:
+        (WebCore::Console::assertCondition): Use AssertMessageType.
+        * page/Console.h:
+        (WebCore::MessageType): Added AssertMessageType.
+
+2009-10-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Prevent crash when optgroup element is empty by adding a NULL check.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30365
+
+        Test: fast/forms/select-empty-optgroup.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::appendFormData):
+
+2009-10-21  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Refactor gyp for separate webcore_bindings{,_sources} targets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-26  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        Make the number of connections for chromium controlled by
+        chromium rather than by ResourceRequestBase.
+        https://bugs.webkit.org/show_bug.cgi?id=30661
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/chromium/ResourceRequest.cpp:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. make distcheck build fixes.
+
+        * GNUmakefile.am:
+
+2009-10-26  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Unbreak Chromium build: that requires adding custom implementations
+        for HTMLOptionsCollection's item and namedItem.  Keep v8 binding
+        close to JSC bindings as well.
+        https://bugs.webkit.org/show_bug.cgi?id=30780
+
+        * bindings/v8/V8Collection.h:
+        (WebCore::getNamedItemsFromCollection):
+        (WebCore::getItemFromCollection):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30723
+        <rdar://problem/6189415> Input names added to multipart/form-data headers need to be escaped.
+
+        Test: http/tests/security/escape-form-data-field-names.html
+
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::appendQuotedString):
+        (WebCore::FormDataBuilder::beginMultiPartHeader):
+        (WebCore::FormDataBuilder::addFilenameToMultiPartHeader):
+        Percent-escape line breaks and quotation marks.
+
+2009-10-26  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Adds DOMTimer support to InspectorTimelineAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=30467
+
+        * inspector/InspectorTimelineAgent.cpp: Added timer support and fixed some method names.
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer): Added.
+        (WebCore::InspectorTimelineAgent::didRemoveTimer): Added.
+        (WebCore::InspectorTimelineAgent::willFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::didFireTimer): Added.
+        (WebCore::InspectorTimelineAgent::addItemToTimeline): Added.
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentTimelineItem): Renamed.
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::):
+        * inspector/TimelineItemFactory.cpp: Add methods for timer-related ScriptObjects.
+        (WebCore::TimelineItemFactory::createGenericTimerTimelineItem):
+        (WebCore::TimelineItemFactory::createTimerInstallTimelineItem):
+        * inspector/TimelineItemFactory.h:
+        * page/DOMTimer.cpp: Added instrumentation points.
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        Add a method that gets called when snapshotting Canvas3DLayers for page snapshots,
+        that allows the layer to return a CGImageRef of its contents.
+        
+        * platform/graphics/mac/Canvas3DLayer.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer copyImageSnapshotWithColorSpace:]):
+
+2009-10-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Pass "console" as object group when evaluating selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30738
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._evalSelectionInCallFrame):
+
+2009-10-26  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix for Console not showing repeat count when repeatedly logging an Event
+        https://bugs.webkit.org/show_bug.cgi?id=30324
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole): Added.
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Calls updateRepeatCountInConsole if it is a repeating message.
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addConsoleMessage): Renamed WebCore::InspectorFrontend::addMessageToConsole
+        (WebCore::InspectorFrontend::updateConsoleMessageRepeatCount): Added. Called when repeatCount is incremented.
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage): Removed calls to msg.isEqual.
+        (WebInspector.ConsoleView.prototype.updateMessageRepeatCount): Added.
+        (WebInspector.ConsoleView.prototype._incrementErrorWarningCount): Added. Updates the error/warning count.
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Use ConsoleMessage._updateRepeatCount
+        (WebInspector.ConsoleMessage.prototype._updateRepeatCount):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addConsoleMessage): Renamed WebInspector.addMessageToConsole.
+        (WebInspector.updateConsoleMessageRepeatCount): Added.
+
+2009-10-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        crash with AX on when an image map contains an anchor tag
+        https://bugs.webkit.org/show_bug.cgi?id=30739
+
+        Tests: accessibility/crashing-a-tag-in-map.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::addChildren):
+
+2009-10-26  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds feature ENABLE guards to V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30697
+
+        This adds guards for the following features to the V8 bindings,
+        to allow builds with V8 to succeed when these features are not enabled.
+        - DATABASE
+        - WORKERS
+        - SHARED_WORKERS
+        - SVG
+        - XPATH
+        - XSLT
+        - INSPECTOR
+
+        This is a build fix only, no new tests required.
+
+        * bindings/v8/DOMObjectsInclude.h: Modified.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Modified.
+        * bindings/v8/V8Index.cpp: Modified.
+        * bindings/v8/V8Index.h: Modified.
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25679
+        [Gtk] Improve accessibility of focusable lists
+
+        Fixes the issues with the Atk states exposed for ListBoxOption
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
+
+2009-10-26  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27085
+        [Gtk] Incorrect rendering of list
+
+        Adds a way for platforms to indicate that a particular object
+        should not be ignored.
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/chromium/AccessibilityObjectChromium.cpp:
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        * accessibility/qt/AccessibilityObjectQt.cpp:
+        * accessibility/win/AccessibilityObjectWin.cpp:
+        * accessibility/wx/AccessibilityObjectWx.cpp:
+        (AccessibilityObject::accessibilityPlatformIncludesObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-10-26  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by Jan Alonzo.
+
+        Bug 30619: [Linux] Menu key doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=30619
+
+        Test: manual-tests/keyboard-menukey-event.html
+        No new layout tests: testing this will require changes in the test
+        controller in a platform-specific way.
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return VKEY_APPS instead of VKEY_MENU.
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent): changed switch-case code for
+        GDK_Menu to return V_APPS instead of VK_MENU.
+
+2009-10-25  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Reuse already fetched proxy.
+        https://bugs.webkit.org/show_bug.cgi?id=30747
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-25  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed build fix.
+
+        Build fix for WIN_OS if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30753
+
+        * plugins/PluginDatabase.cpp:
+
+2009-10-25  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        A quick fix for Bug 29103.
+        Since String::startsWith() cannot fold non-ASCII characters, this change folds the prefix string
+        and the option string before calling String::startsWith().
+        https://bugs.webkit.org/show_bug.cgi?id=29103
+
+        Tests: fast/forms/listbox-typeahead-cyrillic.html
+               fast/forms/listbox-typeahead-greek.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::typeAheadFind):
+
+2009-10-25  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expanding a node in the Console should not show the element in Elements panel
+        https://bugs.webkit.org/show_bug.cgi?id=30749
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Check if inside disclosure triangle.
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30751
+        HTMLOptionsCollection should not inherit from HTMLCollection
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLOptionsCollection::getCallData):
+        (WebCore::JSHTMLOptionsCollection::canGetItemsForName):
+        (WebCore::JSHTMLOptionsCollection::nameGetter):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::item):
+        (WebCore::JSHTMLOptionsCollection::namedItem):
+        Refactor to use generic implementation of HTMLCollection bindings functions
+        from JSHTMLCollectionFunctions.h
+
+        * bindings/js/JSHTMLCollectionFunctions.h: Added.
+        (WebCore::getCollectionNamedItems):
+        (WebCore::getCollectionItems):
+        (WebCore::callHTMLCollectionGeneric):
+        Added generic functions that JSHTMLCollection, JSHTMLAllCollection and
+        JSHTMLOptionsCollection can all use.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp: Add include of JSHTMLAllCollection.h
+        for toJS on document.all.
+
+        * bindings/objc/DOMHTML.mm:
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        Remove special cases for HTMLOptionsCollection.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/HTMLAllCollection.idl:
+        * html/HTMLCollection.idl:
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-24  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fixed issue with IME inside console
+        https://bugs.webkit.org/show_bug.cgi?id=30660
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._promptKeyDown):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._promptKeyDown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        (WebInspector.searchKeyDown): Moved performSearch here from WebInspector.searchKeyUp.
+        (WebInspector.startEditing.element.handleKeyEvent):
+        (WebInspector.startEditing):
+        * inspector/front-end/utilities.js:
+        (isEnterKey): Added. Check if in IME.
+
+2009-10-24  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30752>.
+        Web Inspector: Multiple Selection on Scope Bars by default Conflicts with other behavior on OSX.
+        
+        Have the scope bars select one scope by default, but if the multiple selection key
+        is pressed, allow for multiple selection.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make the scope bars in the Web Inspector match other scope bars in Mac OS X.
+        Also cleans up the CSS to use classes instead of ID selectors.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28186
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/front-end/ResourcesPanel.js: Add the scope-bar class.
+        * inspector/front-end/inspector.css: Lots of changes to make it look right.
+        * inspector/front-end/inspector.html: Add the scope-bar class.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix selecting Resources in the Web Inspector's Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30743
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.isCategoryVisible): Added.
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable): Call
+        isCategoryVisible on the ResourcesPanel.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the Scope Bar in the Web Inspector's Resource panel, so that selecting
+        All will deselect the other filters.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30744
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.createFilterElement): Better syntax.
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter): Use a normal for loop,
+        and the child variable instead of target in the loop. Other clean up.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Make resizing the Web Inspector's Elements panel sidebar work again.
+        Also makes Resources panel use the sidebar code in Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30742
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel): Don't create the sidebar with an argument.
+        (WebInspector.Panel.prototype.show): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.handleKeyEvent): Call handleSidebarKeyEvent.
+        (WebInspector.Panel.prototype.handleSidebarKeyEvent): Added.
+        (WebInspector.Panel.prototype.createSidebar): Renamed from _createSidebar.
+        (WebInspector.Panel.prototype._sidebarDragging): Call updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateSidebarWidth): Renamed from _updateSidebarWidth.
+        (WebInspector.Panel.prototype.setSidebarWidth): Added. Called by updateSidebarWidth.
+        (WebInspector.Panel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel): Call createSidebar.
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show): Remove call to _updateSidebarWidth.
+        (WebInspector.ResourcesPanel.prototype.showResource): Call updateSidebarWidth
+        (WebInspector.ResourcesPanel.prototype.closeVisibleResource): Ditto.
+        (WebInspector.ResourcesPanel.prototype.setSidebarWidth): Added.
+        (WebInspector.ResourcesPanel.prototype.updateMainViewWidth): Added.
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel): Call createSidebar.
+        (WebInspector.StoragePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel): Call createSidebar.
+        (WebInspector.TimelinePanel.prototype.updateMainViewWidth): Renamed from setMainViewWidth.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Call updateSelection() in a few places so hovering in the Web Inspector's
+        Elements panel always has the correct row selection height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30735
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton): Call updateSelection().
+        (WebInspector.ElementsTreeElement.prototype._insertInLastAttributePosition): Ditto.
+        * inspector/front-end/inspector.css: Prevent text wrapping in the middle of the add attribute text.
+
+2009-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the re-root tree feature from the Web Inspector's
+        Elements panel. This feature wasn't super useful and gets
+        in the way of double-click to edit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30736
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-10-24  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Implements ReturnsNew hint for V8 bindings generation code.
+        https://bugs.webkit.org/show_bug.cgi?id=30745
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object):
+
+2009-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Missing images at 350.org due to wrong URLs
+        https://bugs.webkit.org/show_bug.cgi?id=30748
+
+        Test: fast/dom/HTMLImageElement/parse-src.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Pass the attribute value through deprecateParseURL().
+        This matches what the Objective-C bindings do, as well as what HTMLImageLoader::sourceURI()
+        and SVGImageLoader::sourceURI() do.
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r50013.
+
+        * WebCore.pro:
+
+2009-10-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Fix up to accommodate for HTMLAllCollection changes in
+        http://trac.webkit.org/changeset/49998.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/7294131> Assertion failure in AuthenticationMac at
+        mac(const Credential&) after authenticating to MobileMe Gallery movie
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::Credential): Initialize m_persistence.
+        (WebCore::Credential::isEmpty): Made this method const.
+        * platform/network/Credential.h:
+        * platform/network/mac/AuthenticationMac.mm:
+        (WebCore::mac): Return nil if the Credential is empty.
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30617>.
+        Web Inspector: Resources Scope Bar Should Allow Combinations.
+        
+        Refactor the filtering in ResourcePanel to make it match ConsoleView,
+        and add a divider between All, and the other choices of Resource types.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.filter):
+        (WebInspector.ResourcesPanel.prototype._updateFilter):
+        * inspector/front-end/inspector.css:
+
+2009-10-23  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Ignore the Refresh header if we're in view source mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27239
+
+        Test: http/tests/security/view-source-no-refresh.html
+
+        * loader/FrameLoader.cpp: ignore Refresh in view-source mode.
+
+2009-10-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30734
+        Remove XMLTokenizer::m_currentNodeIsReferenced
+
+        No change in behavior, no tests.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::setCurrentNode):
+        * dom/XMLTokenizer.h:
+        Don't store a boolean for the current node being the document - we can always check for that.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        A fragment passed to XMLTokenizer is never null - in fact, the first thing we do is dereference
+        it unconditionally, and then begin checking it for null, as if it could help.
+
+2009-10-23  Beth Dakin  <bdakin@apple.com>
+
+        No review since this is a build fix.
+
+        Build fix for the Mac. (Build is only broken when SVG filters are 
+        enabled.)
+
+        Labelled these function static.
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Implement a Timeline panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30725
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Images/timelineIcon.png: Added.
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+        * inspector/front-end/TimelinePanel.js: Added.
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.toolbarItemClass.get toolbarItemLabel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype.handleKeyEvent):
+        (WebInspector.TimelinePanel.prototype.timelineWasStarted):
+        (WebInspector.TimelinePanel.prototype.timelineWasStopped):
+        (WebInspector.TimelinePanel.prototype.addItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._innerAddItemToTimeline):
+        (WebInspector.TimelinePanel.prototype._toggleTimelineButton):
+        (WebInspector.TimelinePanel.prototype.setMainViewWidth):
+        (WebInspector.TimelinePanel.prototype.getItemTypeName):
+        (WebInspector.TimelineRecordTreeElement):
+        (WebInspector.TimelineRecordTreeElement.prototype.onattach):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2009-10-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Clash Between Search's onkeyup and incremental search events
+        https://bugs.webkit.org/show_bug.cgi?id=30731
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.performSearch): prevent incremental search event from clobbering a forced search
+
+2009-10-23  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the need for C++ Timeline types in InspectorTimelineAgent in favor
+        of ScriptObjects.
+        https://bugs.webkit.org/show_bug.cgi?id=30707
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMDispatchTimelineItem.cpp: Removed.
+        * inspector/DOMDispatchTimelineItem.h: Removed.
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentTimelineItem):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineItemEntry::TimelineItemEntry):
+        * inspector/TimelineItem.cpp: Removed.
+        * inspector/TimelineItem.h: Removed.
+        * inspector/TimelineItemFactory.cpp: Added.
+        (WebCore::TimelineItemFactory::createGenericTimelineItem):
+        (WebCore::TimelineItemFactory::createDOMDispatchTimelineItem):
+        * inspector/TimelineItemFactory.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItemFactory::TimelineItemFactory):
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::globalObject):
+        * bindings/js/ScriptController.h:
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes style problems in Android-specific files.
+        https://bugs.webkit.org/show_bug.cgi?id=30717
+
+        Style changes only, no new tests possible.
+
+        * page/android/EventHandlerAndroid.cpp: Modified.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passWheelEventToWidget): Fixes whitespace in method signature.
+        (WebCore::EventHandler::passMouseMoveEventToSubframe): Fixes whitespace in method signature.
+        * platform/android/ClipboardAndroid.h: Modified. Fixes header include order and indenting.
+        * platform/android/CursorAndroid.cpp: Modified. 
+        (WebCore::grabCursor): Fixes function braces.
+        (WebCore::grabbingCursor): Fixes function braces.
+        * platform/android/FileChooserAndroid.cpp: Modified.
+        (WebCore::FileChooser::basenameForWidth): Fixes braces on while statement, and updates String::copy to String::threadsafeCopy.
+        * platform/android/FileSystemAndroid.cpp: Modified. Fixes header include order.
+        (WebCore::unloadModule): Fixes zero test.
+        (WebCore::writeToFile): Fixes if statement structure.
+        * platform/android/KeyEventAndroid.cpp: Modified.
+        (WebCore::windowsKeyCodeForKeyEvent): Fixes switch statement indenting.
+        (WebCore::keyIdentifierForAndroidKeyCode): Fixes switch statement indenting.
+        * platform/android/ScreenAndroid.cpp: Modified. Fixes header include order and switch statement indenting.
+        * platform/android/TemporaryLinkStubs.cpp: Modified. Fixes header include order.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * DerivedSources.cpp:
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Another shot at a fixed build.
+
+        * html/HTMLOptionsCollection.idl:
+
+2009-10-23  Brady Eidson  <beidson@apple.com>
+
+        50,000!
+
+        * ChangeLog: Point out revision 50,000.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=30695
+        Drop .tags() support from HTMLCollection
+
+        - Make .tags() only work for HTMLAllCollections in JS. .tags() is still
+          available for all HTMLCollection like objects in Objective-C since that
+          is API.
+        - Auto-generate HTMLAllCollection.
+
+        Test: fast/dom/HTMLDocument/document-all.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSHTMLAllCollection.cpp: Removed.
+        * bindings/js/JSHTMLAllCollection.h: Removed.
+        * bindings/js/JSHTMLAllCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::getCallData):
+        (WebCore::JSHTMLAllCollection::canGetItemsForName):
+        (WebCore::JSHTMLAllCollection::nameGetter):
+        (WebCore::JSHTMLAllCollection::item):
+        (WebCore::JSHTMLAllCollection::namedItem):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        * dom/HTMLAllCollection.idl: Removed.
+        * html/HTMLAllCollection.cpp: Added.
+        (WebCore::HTMLAllCollection::create):
+        (WebCore::HTMLAllCollection::HTMLAllCollection):
+        (WebCore::HTMLAllCollection::~HTMLAllCollection):
+        * html/HTMLAllCollection.h: Added.
+        * html/HTMLAllCollection.idl: Added.
+        * html/HTMLCollection.h:
+        * html/HTMLCollection.idl:
+        * html/HTMLDocument.idl:
+        * page/DOMWindow.idl:
+
+2009-10-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: pull basic sidebar implementation into the Panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30720
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel):
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult):
+        (WebInspector.Panel.prototype.handleKeyEvent):
+        (WebInspector.Panel.prototype._createSidebar):
+        (WebInspector.Panel.prototype._startSidebarDragging):
+        (WebInspector.Panel.prototype._sidebarDragging):
+        (WebInspector.Panel.prototype._endSidebarDragging):
+        (WebInspector.Panel.prototype._updateSidebarWidth):
+        (WebInspector.Panel.prototype.setCenterViewWidth):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.setCenterViewWidth):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.setCenterViewWidth):
+
+2009-10-23  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Slight optimizations to object returning and exception handling in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30599
+
+        * bindings/scripts/CodeGeneratorV8.pm: Generate better code
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertToV8Object): Added overload that takes a Ref<>
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Remove unnecessary template param to prevent compile error
+
+2009-10-23  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Volume slider always starts at half volume
+        https://bugs.webkit.org/show_bug.cgi?id=28322
+
+        Sets the value attribute of volume slider to the volume attribute
+        of the media element. Also update the value attribute of the
+        input element for the volume slider when the volume attribute
+        of the media element is updated.
+
+        Test: media/video-volume-slider.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::update):
+        Set the value attribute of the input element for the volume slider
+        using the current volume of the media element.
+        * rendering/MediaControlElements.h:
+        Add method definition of update().
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+        Creates a volume slider with value attribute equals to the current
+        volume attribute of the media element.
+
+2009-10-23  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Chrome Linux: fix caret positioning in LTR complex languages
+        The caret is positioned off by one in languages like Thai.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28284
+
+        A group of us spent a while trying various approaches to write a test
+        for this; however, since it is only that the blinking cursor is
+        displayed incorrectly, we concluded it can not be tested.
+
+        (Patch by Hironori Bono.)
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-10-23  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium build after IsoldatedWorld change (r49963).
+        https://bugs.webkit.org/show_bug.cgi?id=30719
+
+        * bindings/ScriptControllerBase.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInIsolatedWorld):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::mainThreadNormalWorld):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+        * xml/XMLHttpRequest.cpp:
+        * xml/XMLHttpRequest.h:
+
+2009-10-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix caretRangeFromPoint()/elementFromPoint() returns wrong result 
+        for a zoomed and scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30689.
+
+        The real cause is the wrong calculation of event.clientX/Y when
+        page is zoomed and scolled.
+        After Sam fixed the event.clientX/Y in r49551, the hit test point
+        should be recalculated (revert r49490).
+
+        Test: fast/dom/Document/CaretRangeFromPoint/caretRangeFromPoint-in-zoom-and-scroll.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point
+        relative to document when page is zoomed and scrolled.
+
+2009-10-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Adding a class that allows us to enable/disable features at
+        runtime. Adding a flag to enable database support.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30653
+
+        * WebCore.gypi:
+        * bindings/v8/RuntimeEnabledFeatures.cpp: Added.
+        * bindings/v8/RuntimeEnabledFeatures.h: Added.
+        (WebCore::RuntimeEnabledFeatures::setDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::databaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+
+2009-10-23  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector injects _inspectorCommandLineAPI into global object when opened
+        https://bugs.webkit.org/show_bug.cgi?id=30675
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled): Moved _inspectorCommandLineAPI from window to console.
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] don't undef NULL in Symbian emulator
+
+        npapi.h way of defining mwerks compiler,__intel__
+        and win32 are all true for Symbian emulator.
+        Changed the definions so that NULL won't be undefined
+        when compiling for Symbian emulator nor target HW.
+
+        * bridge/npapi.h:
+
+2009-10-23  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Correct linking of sqlite3 for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30569
+
+        ".lib" will try to include library as static library
+        causing the library to be searched from wrong directory and if found
+        will be statically linked instead of the inteded dynamic linking.
+
+        * WebCore.pro:
+
+2009-10-23  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION: Copy is copying incorrect background-color
+        <rdar://problem/7248529>
+        https://bugs.webkit.org/show_bug.cgi?id=29697
+
+        Test: editing/execCommand/indent-paragraphs.html
+
+        This change removes the BackgroundColor from the list 
+        of inheritable CSS properties and changes significantly
+        the way we perform indentation.
+        The new implementation of IndentOutdentCommand uses a new method
+        defined in CompositeEditCommand called moveParagraphWithClones.
+        This is an improved version of the original moveParagraph that
+        is aimed at preserving the original markup of the paragraph being
+        moved.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::): removed CSSPropertyBackgroundColor from editingStyleProperties.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::CompositeEditCommand): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::cloneParagraphUnderNewElement): Added.
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Added.
+        (WebCore::CompositeEditCommand::moveParagraphWithClones): Added.
+        (WebCore::CompositeEditCommand::moveParagraphs): Modified to use cleanupAfterDeletion.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Removed trailing blanks.
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary): Removed trailing blanks.
+        * editing/CompositeEditCommand.h: Added three new methods.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Changed to use moveParagraphWithClones.
+        (WebCore::IndentOutdentCommand::indentRegion): Removed comment.
+        * editing/IndentOutdentCommand.h: Removed prepareBlockquoteLevelForInsertion method.
+
+2009-10-23  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Adds missing UnusedParam.h includes, required when INSPECTOR is not enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=30677
+
+        Build fix, no new tests required.
+
+        * page/Console.cpp: Modified. Added UnusedParam.h include.
+        * workers/WorkerContext.cpp: Modified. Added UnusedParam.h include.
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Plugins : Use window's winId() instead of the widget's.
+
+        As per, https://developer.mozilla.org/en/NPN_GetValue
+        NPNVnetscapeWindow on Unix/X11: "Gets the browser toplevel window in which the
+        plug-in is displayed; returns Window".
+
+        The issue was found because NPNVNetscapeWindow winId() ends up creating
+        a native window resulting in flicker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30706
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+
+2009-10-23  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowless Plugins : Don't use m_clipRect when painting.
+
+        Though it works, it is not correct to use m_clipRect for painting
+        in Windowless mode. Instead, the rect paramater that is passed
+        as a part of PluginView::paint() must be used. This change will
+        also result in some speedup since previously we used to paint all
+        the visible parts of a windowless plugin (even if those parts were
+        not dirty).
+
+        Also, fix invalidateRect() to compute the correct width and height.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30711
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins : Use test.swf in the plugins manual tests.
+
+        They previously referenced youtube videos which among other things are
+        cumbersome to use without internet connection. The old youtube link is
+        just commented out so that testing with youtube can be done with
+        little effort.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30662
+
+        * manual-tests/plugins/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+        * manual-tests/plugins/windowed.html:
+        * manual-tests/plugins/windowless.html:
+        * manual-tests/qt/plugin-sibling-frame-include.html:
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix the Windows Release build by moving Accessibility files
+        into all-in-one file and excluding them from the build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * accessibility/AccessibilityAllInOne.cpp: Added.
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Add support for IsolatedWorlds to JSC bindings.
+
+        An IsolatedWorld is basically a parallel, separate copy of the window shells and DOM wrapper objects for
+        a given document.  To support isolation this patch:
+
+            * Adds support to the ScriptController to track multiple window shells, one per world.
+            * Adds support to Document to support multiple separate wrapper-maps, one per world.
+            * Replaces the single global DOM wrapper map (on the WebCoreJSClientData) with separate maps,
+              stored on the (new) IsolatedWorld objects.
+
+        In addition to supporting separate copies of these objects, two other features are supported:
+
+            * It is necessary to track the current world on entry into JSC, so that within callbacks out to WebCore
+              we can determine which world (and as such, set of DOM bindings) we should be operating on.
+            * EventListeners & Callbacks are run in the world they were registered in.
+              This requires the handler to retain a reference to the world.
+
+        No new tests. (Enabled existing isolated world layout tests.)
+
+        * WebCore.base.exp:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h:
+        (WebCore::JSCallbackData::JSCallbackData):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::removeWrappers):
+        (WebCore::DOMObjectWrapperMap::get):
+        (WebCore::DOMObjectWrapperMap::set):
+        (WebCore::DOMObjectWrapperMap::remove):
+        (WebCore::DOMObjectWrapperMap::take):
+        (WebCore::IsolatedWorld::IsolatedWorld):
+        (WebCore::IsolatedWorld::~IsolatedWorld):
+        (WebCore::EnterIsolatedWorld::EnterIsolatedWorld):
+        (WebCore::EnterIsolatedWorld::~EnterIsolatedWorld):
+        (WebCore::JSGlobalDataWorldIterator::JSGlobalDataWorldIterator):
+        (WebCore::JSGlobalDataWorldIterator::operator bool):
+        (WebCore::JSGlobalDataWorldIterator::operator*):
+        (WebCore::JSGlobalDataWorldIterator::operator->):
+        (WebCore::JSGlobalDataWorldIterator::operator++):
+        (WebCore::getCurrentWorld):
+        (WebCore::getNormalWorld):
+        (WebCore::commonNormalWorld):
+        (WebCore::commonCurrentWorld):
+        (WebCore::DOMObjectHashTableMap::mapFor):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        (WebCore::forgetDOMObject):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::forgetAllDOMNodesForDocument):
+        (WebCore::forgetWorldOfDOMNodesForDocument):
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument):
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::takeWrappers):
+        (WebCore::updateDOMNodeDocument):
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::allowsAccessFromFrame):
+        (WebCore::printErrorMessageForFrame):
+        (WebCore::JSC_DebuggerCallFrame_evaluateInWorld):
+        (WebCore::JSC_callInWorld):
+        (WebCore::JSC_constructInWorld):
+        (WebCore::JSC_evaluateInWorld):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::IsolatedWorld::rememberDocument):
+        (WebCore::IsolatedWorld::forgetDocument):
+        (WebCore::IsolatedWorld::rememberScriptController):
+        (WebCore::IsolatedWorld::forgetScriptController):
+        (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        (WebCore::DOMObjectHashTableMap::get):
+        (WebCore::WebCoreJSClientData::WebCoreJSClientData):
+        (WebCore::WebCoreJSClientData::currentWorld):
+        (WebCore::WebCoreJSClientData::normalWorld):
+        (WebCore::WebCoreJSClientData::rememberWorld):
+        (WebCore::WebCoreJSClientData::forgetWorld):
+        (WebCore::debuggerWorld):
+        (WebCore::pluginWorld):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::printErrorMessage):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindowShell):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        (WebCore::JSInspectorBackend::inspectedWindow):
+        (WebCore::JSInspectorBackend::nodeForId):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::markChildren):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::markChildren):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSharedWorkerCustom.cpp:
+        (WebCore::JSSharedWorker::markChildren):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::~ScriptController):
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::attachDebugger):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::createRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::windowShell):
+        (WebCore::ScriptController::existingWindowShell):
+        (WebCore::ScriptController::globalObject):
+        (WebCore::ScriptController::forgetWorld):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode):
+        (WebCore::scriptStateFromPage):
+        * bindings/js/ScriptState.h:
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        * dom/Document.cpp:
+        (WebCore::Document::createWrapperCache):
+        * dom/Document.h:
+        (WebCore::Document::wrapperCacheMap):
+        (WebCore::Document::getWrapperCache):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * platform/network/mac/AuthenticationMac.mm:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: EventListenersSidebarPane TODO No Longer Needed
+        https://bugs.webkit.org/show_bug.cgi?id=30705
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+
+2009-10-22  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30506
+        <rdar://problem/7319845> Resources that the server sent as 304 not modified are not shown
+        in the inspectors resource pane
+
+        I don't know how to make a test for this.
+
+        The issue here was that preloaded resources weren't added to DocLoader document resource set,
+        but Web Inspector asked DocLoader to fetch data from CachedResource. Even when (if) document
+        parser eventually requested the same resource for real and it got added to resource set, it
+        was too late - the Inspector wasn't updated.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::cachedResource):
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        Fix the issue by trying to fetch corresponding CachedResource harder - also look in global
+        cache. This seems safe, and easier than updating the Inspector on transitions between
+        resource states (revalidate vs. revalidate done and preload vs. non-preload).
+
+2009-10-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6942706> ER: Add a CSS property that allows 
+        shadows to work for SVG content
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=30479
+
+        This patch adds a new SVG-specific CSS property called -webkit-
+        shadow that has the same syntax as -webkit-box-shadow
+
+        Add CSSPropertyWebkitShadow to the list of SVG CSS properties, and 
+        make valueForShadow a member function rather than a static function 
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSComputedStyleDeclaration.h:
+
+        Call valueForShadow for CSSPropertyWebkitShadow
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+
+        Do standard CSS stuff for CSSPropertyWebkitShadow
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+
+        Set the appropriate shadow on the paint context if we have one. 
+        This seems to be all we have to do to have an SVG-shaped shadow.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+
+        Add shadow to SVGRenderStyle. I added a new macro that I don't like 
+        just because that's the way things are done here right now.
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::SVGRenderStyle):
+        (WebCore::SVGRenderStyle::operator==):
+        * rendering/style/SVGRenderStyle.h:
+        * rendering/style/SVGRenderStyleDefs.cpp:
+        (StyleShadowSVGData::StyleShadowSVGData):
+        (StyleShadowSVGData::operator==):
+        * rendering/style/SVGRenderStyleDefs.h:
+        (WebCore::StyleShadowSVGData::create):
+        (WebCore::StyleShadowSVGData::copy):
+        (WebCore::StyleShadowSVGData::operator!=):
+
+2009-10-22  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+ 
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25530
+        [Gtk] Implement LABEL_FOR/LABELLED_BY relationship pair for labels
+
+        Implements atk_object_ref_relation_set and LABEL_FOR/LABELLED_BY.
+        Also causes the accessible name for labeled controls to be based on
+        the label as expected, rather than based on the contents.
+
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (correspondingLabelForControlElement):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkRelationSetFromCoreObject):
+        (webkit_accessible_ref_relation_set):
+        (webkit_accessible_class_init):
+        (webkit_accessible_get_name):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: windowFocused and windowBlured Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+          Correctly handle focusing/blurring on inner <iframe>'s such as Source Frames.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused): fix for inner iframes
+        (WebInspector.windowBlurred): fix for inner iframes
+        (WebInspector.addMainEventListeners): change useCapture to false
+
+2009-10-22  Jaime Yap  <jaimeyap@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Makes a page reload optional when activating resource monitoring in
+        InspectorController. It leaves the default behavior as performing the reload.
+        Reload is an optional param so callsites do not have to change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30684
+
+        No new tests added.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableResourceTracking):
+        * inspector/InspectorController.h:
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix memory leak in QNetworkReplyHandler::abort().
+        In QNetworkReplyHandler::release(), m_reply should no longer point to its parent
+        after being released.
+        https://bugs.webkit.org/show_bug.cgi?id=30167
+
+        No layout test available as a non-functional fix.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2009-10-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOMAgent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::releaseDOMAgent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2009-10-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Rework event listeners to not hold references to frame or V8 context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30648
+
+        Covered by existing layout tests: fast/events/attribute-listener*
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added passing ScriptExecutionContext*
+            to event listener handling code.
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep): Changed to use currentContext().
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener): Reworked to match JSC logic.
+        (WebCore::getEventListenerHandlerBody): Added ScriptExecutionContext* param.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Removed Frame* param
+            and usage.
+        (WebCore::V8AbstractEventListener::handleEvent): Chaged to use ScriptExecutionContext*.
+        (WebCore::V8AbstractEventListener::invokeEventHandler): Ditto.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::getListenerObject): Ditto.
+        (WebCore::V8AbstractEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object):  Added ScriptExecutionContext* param.
+        (WebCore::V8DOMWrapper::getEventListener): Ditto.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Ditto.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper): Removed ContextType* template param,
+            because it's no longer needed.
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::sharedContext): Renamed from shared_context.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener): Removed Frame* param and usage.
+        (WebCore::V8LazyEventListener::callListenerFunction): Added ScriptExecutionContext* param.
+        (WebCore::V8LazyEventListener::prepareListenerObject): Ditto.
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create): Reordered params to match JSC impl.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy): Adjusted formatting to match WebKit style.
+        (WebCore::V8Proxy::evaluateInNewContext): Changed to use m_context directly.
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId): Ditto.
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase): Ditto.
+        (WebCore::V8Proxy::isContextInitialized): Ditto.
+        (WebCore::V8Proxy::updateDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::clearDocumentWrapperCache): Ditto.
+        (WebCore::V8Proxy::disposeContextHandles): Added explicit disposing of m_context. 
+        (WebCore::V8Proxy::clearForClose): Changed to use m_context directly.
+        (WebCore::V8Proxy::clearForNavigation): Ditto.
+        (WebCore::V8Proxy::setSecurityToken): Ditto.
+        (WebCore::V8Proxy::updateDocument): Ditto.
+        (WebCore::V8Proxy::initContextIfNeeded): Ditto.
+        (WebCore::V8Proxy::context): Changed to use v8::Local.
+        (WebCore::V8Proxy::mainWorldContext): Changed to use m_context directly. 
+        (WebCore::V8Proxy::setContextDebugId): Ditto.
+        (WebCore::toV8Context):
+        * bindings/v8/V8Proxy.h: Removed shared_context decl, changed to use straight
+            v8::Persistent for m_context.
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::workerProxy): Added.
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener): Removed
+            WorkerContextExecutionProxy* param.
+        (WebCore::V8WorkerContextEventListener::handleEvent): Started using ScriptExecutionContext*.
+        (WebCore::V8WorkerContextEventListener::reportError): Ditto.
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): Ditto.
+        (WebCore::V8WorkerContextEventListener::getReceiverObject): Ditto.
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create): Removed
+            WorkerContextExecutionProxy* param.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener): Removed ContextType*
+            template param.
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener): Removed Frame* param.
+        (WebCore::V8EventListener::getListenerFunction): Started using ScriptExecutionContext*.
+        (WebCore::V8EventListener::callListenerFunction): Ditto.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create): Removed Frame* param.
+
+2009-10-14  Gaurav Shah  <gauravsh@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Replaces temporary link stub for <keygen> tag handler for the Chromium
+        browser with a call via the Chromium Bridge.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30360
+
+        * platform/SSLKeyGenerator.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SSLKeyGeneratorChromium.cpp:
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/chromium/TemporaryLinkStubs.cpp:
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2009-10-22  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes Chromium Mac pasteboard handling to flow through the same code paths as other platforms.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30591
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make accelerated compositing debug indicators work in release builds
+        https://bugs.webkit.org/show_bug.cgi?id=30588
+        
+        Allow some debug indicators, that show which page elements go into compositing layers,
+        to work in release builds, when the runtime prefs are set.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        (WebCore::GraphicsLayer::setZPosition):
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::clearBorderColor):
+        (WebCore::GraphicsLayer::showRepaintCounter):
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::updateMasksToBounds):
+        (WebCore::GraphicsLayerCA::updateLayerDrawsContent):
+        (WebCore::GraphicsLayerCA::setDebugBorder):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setupContentsLayer):
+        * platform/graphics/mac/WebLayer.mm:
+
+2009-10-22  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Pavel Feldman.
+
+        Inspector should support monitorEvents/un monitorEvents() in the command line
+        https://bugs.webkit.org/show_bug.cgi?id=19879
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback): Ignores event listeners generated by monitorEvent
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled): Added _inspectorCommandLineAPI._logEvent, _allEventTypes, 
+        _normalizeEventTypes, monitorEvent, unmonitorEvent.
+
+2009-10-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: windowFocused and windowBlurred Fail to Clear/Mark Inspector as "inactive"
+        https://bugs.webkit.org/show_bug.cgi?id=30663
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.windowFocused):
+        (WebInspector.windowBlurred):
+
+2009-10-22  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Error - requestContentType [undefined] is not an object
+        https://bugs.webkit.org/show_bug.cgi?id=30666
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+
+2009-10-22  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [Haiku] Correction of the accented letter width (they were 2 characters long).
+        https://bugs.webkit.org/show_bug.cgi?id=30629
+
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-10-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7270320> Screenshots of off-screen plug-ins are blank
+        <rdar://problem/7270314> After halting a transparent PluginView on
+        Windows, the transparency is applied twice
+
+        Replace use of Frame::nodeImage() with a function that takes a snapshot
+        of a PluginView.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.h:
+        Made paintWindowedPluginIntoContext() non-const, as it now calls
+        paintIntoTransformedContext(). Declare paintIntoTransformedContext()
+        and snapshot() for Windows platforms.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintIntoTransformedContext):
+        Paints into the passed HDC without applying any coordinate translations.
+        Code moved from paintWindowedPluginIntoContext() and paint(). Removed
+        the memset() of windowpos in lieu of assignment.
+        (WebCore::PluginView::paintWindowedPluginIntoContext):
+        Code moved to paintIntoTransformedContext().
+        (WebCore::PluginView::paint):
+        Ditto.
+        (WebCore::PluginView::snapshot):
+        Create a context, and if the plug-in is windowless, translate it so the
+        plug-in will draw at the correct location. Create a bitmap, and select
+        it into the context. Paint the plug-in, and create a BitmapImage from
+        the bitmap.
+        (WebCore::PluginView::halt):
+        Use snapshot().
+
+2009-10-22  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix calculation of length in WebSocketChannel.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30656
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didReceiveData):
+
+2009-10-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding the ability to enable/disable functions in V8 at runtime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30650
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-21  Darin Adler  <darin@apple.com>
+
+        Swedish search (and other languages as well) is broken while fixing Japanese search
+        https://bugs.webkit.org/show_bug.cgi?id=30646
+
+        Rolled Japanese tailoring out that was done to fix
+        https://bugs.webkit.org/show_bug.cgi?id=30437 earlier.
+        It was overriding the locale-specific tailoring.
+        We'll land a fix once we figure out how to add the
+        Japanese tailoring without removing anything.
+
+        * editing/TextIterator.cpp: Rolled out r49924.
+
+2009-10-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: chromium build fix - add missing image to gypi.
+
+        * WebCore.gypi:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes part of <http://webkit.org/b/30522>.
+        Web Inspector: DOM Exceptions throughout the Inspector should be more human readable.
+
+        Expose the description attribute that is now a member of
+        ExceptionBase as of r49723, so when a user logs an exception, they
+        can see the description in the Web Inspector.
+
+        Test: fast/dom/dom-exception-description.html
+
+        * dom/DOMCoreException.idl:
+        * dom/EventException.idl:
+        * dom/RangeException.idl:
+        * svg/SVGException.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-10-21  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30616>.
+        REGRESSION (r49036): Web Inspector: Summary graph no longer switching to size summary.
+        
+        Add a check to make sure a function we need to calculate percentages is
+        defined before we use it.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+
+2009-10-21  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        REGRESSION: Clicking on nodes in the console should take you to the element in the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=27231
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode): Turns on ElementsTreeOutline.showInElementsPanelEnabled
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline): Added ElementsTreeOutline.showInElementsPanelEnabled
+        (WebInspector.ElementsTreeElement.prototype.onmousedown): Reveals the node in the Elements panel if 
+        treeOutline.showInElementsPanelEnabled is true.
+
+2009-10-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30637
+        Fix a compiler warning in windows.
+
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix the crash when a node not in a document receives dispatchEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=30611
+
+        Test: fast/events/dispatch-event-no-document.html
+
+        * dom/EventTarget.cpp: Check for scriptExecutionContext() at the moment of dispatchEvent; do nothing if no context.
+        (WebCore::EventTarget::dispatchEvent):
+
+2009-10-21  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Chromium Linux: disable subpixel text on layers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30635
+        http://code.google.com/p/chromium/issues/detail?id=25365
+
+        With the addition of layers for drawing rounded corners in r49641,
+        subpixel text on rounded rectangles broke. This is because the layer
+        only contains a single alpha channel and this is insufficient to
+        compose subpixel text correctly.
+
+        On Windows, a large body of code in TransparencyWin.cpp exists to try
+        to deal with this. Even then, in some cases, it downgrades to
+        anti-aliased text. We need a fix for the grevious effects quickly thus
+        this patch disables subpixel text when rendering into a layer.
+
+        This would be covered by existing tests except that subpixel text is
+        disabled for pixel tests on Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::isCanvasMultiLayered):
+        (WebCore::adjustTextRenderMode):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix, make sure we specify the Sqlite3 dependency correctly as otherwise
+        it will use the sqlite3 system library rather than WebCoreSQLite3.
+
+        * wscript:
+
+2009-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed background-clip parsing regressions introduced in r46240.
+
+        Test: fast/css/background-clip-text.html
+
+        * css/CSSParser.cpp:
+        (WebCore::parseBackgroundClip): Added this helper method.
+        (WebCore::CSSParser::parseFillShorthand): Use parseBackgroundClip() to
+        reparse the value. The old code called parseFillProperty() again, which
+        didn’t work, because parseFillProperty() advances the value list.
+        (WebCore::CSSParser::parseFillProperty): Changed to use
+        parseBackgroundClip().
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EFillBox): Added a case for
+        CSSValueWebkitText.
+
+2009-10-21  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enable creation of custom SidebarTreeElements for different ProfileTypes
+
+        ProfileTypes can now create sidebar tree elements of custom types.
+        https://bugs.webkit.org/show_bug.cgi?id=30520
+
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.CPUProfileType.prototype.createView):
+        (WebInspector.CPUProfile.prototype.get head):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfileType.prototype.viewForProfile):
+        (WebInspector.ProfileType.prototype.createView):
+        (WebInspector.ProfileType.prototype.createSidebarTreeElementForProfile):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Selectors in the Styles pane should trigger a search for that selector when clicked
+        https://bugs.webkit.org/show_bug.cgi?id=17126
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult): only change focusedDOMNode on a manual search
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection.prototype._clickSelector): trigger a search
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditing): correctly start editing attribute value instead of name
+
+2009-10-20  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix DOM Agent leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30615
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+
+2009-10-21  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        Plugins: Create manual tests for testing plugins
+        
+        Create two test files:
+        1. windowed.html - Test plugin in windowed mode.
+        2. windowless.html - Test plugin in windowless mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30503
+
+        * manual-tests/plugins/windowed.html: Added.
+        * manual-tests/plugins/windowless.html: Added.
+
+2009-10-21  Satoshi Nakagawa  <psychs@limechat.net>
+
+        Reviewed by Darin Adler.
+
+        Fixed Japanese text search problems.
+        Treat small kana letters and kana letters as different characters in search.
+        Do not ignore diacritic marks in search for Japanese texts.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30437
+
+        Test: fast/text/international/japanese-kana-letters.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::createCollator):
+        (WebCore::collator):
+        (WebCore::createSearcher):
+
+2009-10-20  Eric Z. Ayers  <zundel@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Changes TimelineItems to be created with raw timestamps as opposed
+        to a time relative to a start of session.  Normalized timestamps cause
+        problems when monitoring a browsing session across multiple page
+        transitions.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+
+2009-10-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix leak of WebSocketChannel by adopting the newly-created reference.
+
+        * websockets/WebSocketChannel.h:
+        (WebCore::WebSocketChannel::create):
+
+2009-10-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage runtime flag changes
+        https://bugs.webkit.org/show_bug.cgi?id=30602
+
+        Part 1/2.  Removing sessionStorageEnabled in next patch after the
+        Chromium side of the changes lands.
+
+        Revert my changes to Settings and instead implement DOM Storage enabling via
+        the methods agreed upon in https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        This stuff was (intentionally) never exposed to web pages or DRT, so there's no
+        LayoutTest visible changes and thus no tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * storage/Storage.cpp:
+        (WebCore::Storage::setLocalStorageAvailable):
+        (WebCore::Storage::localStorageAvailable):
+        (WebCore::Storage::setSessionStorageAvailable):
+        (WebCore::Storage::sessionStorageAvailable):
+        * storage/Storage.h:
+
+2009-10-20  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Need to turn off notifications properly at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=30409
+
+        This code only affects chromium, and is all behind a compile time
+        flag current turned off, so no new tests.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::setIsAvailable):
+        (WebCore::NotificationCenter::isAvailable):
+        * notifications/NotificationCenter.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.idl:
+
+2009-10-20  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes RefPtr initialization in the V8 implementation of WebCore::ScriptString to use the ::create() idiom and
+        use adoptRef() properly.  I failed to read the RefPtr docs the first time through :(
+
+        No new tests, error was caught by valgrind on the Chromium builders.
+
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator=):
+        * bindings/v8/ScriptStringImpl.h:
+        (WebCore::ScriptStringImpl::create):
+
+2009-10-20  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: populate child nodes before sorting them.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29673
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode): Swapped with BottomUpProfileDataGridTree to be consistent with TopDownProfileDataGridNode.
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort): Added missing parentheses.
+        (WebInspector.ProfileDataGridNode.prototype.get _parent):
+        (WebInspector.ProfileDataGridNode.prototype._populate):
+        * inspector/front-end/TopDownProfileDataGridTree.js:
+        (WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate):
+
+2009-10-20  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove redundant String ref/deref calls in generated V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=30579
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toString): Fix return type of 'toString' to make it truly a no-op
+            instead of constructing/destructing a String.
+
+2009-10-20  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25411
+        [GTK] ATK accessible ancestry broken
+
+        Work around for the problem of bogus additional objects in the ancestry.
+        We now set the parent when we ref the child, then ask the Atk child if
+        it knows its parent. This solves the bulk of the cases. For those it
+        doesn't, fall back to the existing logic.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+        (webkit_accessible_ref_child):
+
+2009-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Alice Liu.
+
+        Fixes <http://webkit.org/b/30421>.
+        Web Inpsector: Local Files can show up on Cookies List with Cookies from other Domain.
+
+        When a page like Google generates an about:blank, it shows up as a local file on
+        the list of Cookie domains, but has all of the cookies of Google. When we are adding
+        cookie domains to the inspector, we should only add the domain is the URL of the resource
+        is in the HTTP protocol family or a file URL.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+
+2009-10-20  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Use a version of libWebKitSystemInterface with global symbols marked
+        private_extern for Chromium Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30590
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/mac: Added.
+        * WebCore.gyp/mac/Empty.cpp: Added.
+        * WebCore.gyp/mac/adjust_visibility.sh: Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CSSProperty
+        https://bugs.webkit.org/show_bug.cgi?id=30564
+
+        Inherits CSSProperty class from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:367.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Hide Chromium's media slider thumb if no source has been loaded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30529
+
+        Covered by existing layout tests, notably:
+            LayoutTests/media/controls-rendering.html
+            LayoutTests/media/unsupported-tracks.html
+            LayoutTests/media/video-src-none.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::hasSource): Returns true if an HTMLMediaElement has a valid source set.
+        (WebCore::paintMediaMuteButton): Refactored to use hasSource().
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSliderThumb): Add call to hasSource() to determine if we should paint the thumb.
+
+2009-10-20  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Added getter for FrameLoader:m_suppressOpenerInNewFrame.
+        This will allow Chromium to more intelligently detect
+        noreferrer links and therefore open them in a new process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30581
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::suppressOpenerInNewFrame): Added.
+
+2009-10-20  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserFunction
+        https://bugs.webkit.org/show_bug.cgi?id=30563
+
+        Inherits CSSParserFunction struct from FastAllocBase because it has been
+        instantiated by 'new' in WebCore/css/CSSParser.cpp:4827.
+
+        * css/CSSProperty.h:
+
+2009-10-20  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Watched Expressions Buttons Do Not Match Inspector Styles
+        https://bugs.webkit.org/show_bug.cgi?id=30554
+
+        * inspector/front-end/inspector.css: added style to pane buttons
+
+2009-10-20  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Set debug id for contexts of isolated worlds to distinguish them in debugger.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30559
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInIsolatedWorld):
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::setInjectedScriptContextDebugId):
+        * bindings/v8/V8Proxy.h:
+
+2009-10-20  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Unreviewed buildfix.
+        [Qt] Add FEGaussianBlur.h and FEGaussianBlur.cpp which were refactored in r49778 to WebCore.pro.
+
+        * WebCore.pro:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Set EnabledAtRuntime for WebSocket in DOMWindow
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        Supported by chromium/v8 only.
+        Add WebSocket::isAvailable()/setIsAvailable(bool) to control v8
+        bindings.
+        Remove Settings::experimentalWebSocketsEnabled() and
+        setExperimentalWebSocketsEnabled(bool).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        * page/DOMWindow.idl:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::setIsAvailable):
+        (WebCore::WebSocket::isAvailable):
+        * websockets/WebSocket.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Whoops, make prototype bindings actually use the StructureFlags.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-10-19  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Better implementation of WebCore::ScriptString for the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29909
+
+        WebCore::ScriptString is used for XMLHttpRequest's responseText attribute which is
+        shared with JavaScript.  Thus, simply using a WebCore::String and copying the value
+        is pretty inefficient, especially since responseText is built up with a sequence of
+        operator+= calls.  JSC builds use a JSC::UString to share the buffer when possible,
+        this patch adopts a similar approach for V8.
+
+        No new tests, behavior is unchanged and covered by LayoutTests/http/tests/xmlhttprequest
+
+        * WebCore.gypi:
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::v8StringOrNull):
+        * bindings/v8/ScriptStringImpl.cpp: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::~ScriptStringImpl):
+        (WebCore::ScriptStringImpl::toString):
+        (WebCore::ScriptStringImpl::isNull):
+        (WebCore::ScriptStringImpl::size):
+        (WebCore::ScriptStringImpl::append):
+        * bindings/v8/ScriptStringImpl.h: Added.
+        (WebCore::ScriptStringImpl::ScriptStringImpl):
+        (WebCore::ScriptStringImpl::v8StringHandle):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        No review, rolling out r49837.
+        http://trac.webkit.org/changeset/49837
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        * page/Settings.h:
+        (WebCore::Settings::standardFontFamily):
+        (WebCore::Settings::fixedFontFamily):
+        (WebCore::Settings::serifFontFamily):
+        (WebCore::Settings::sansSerifFontFamily):
+        (WebCore::Settings::cursiveFontFamily):
+        (WebCore::Settings::fantasyFontFamily):
+        * platform/text/UScriptCode.h: Removed.
+
+2009-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Check COMPILER(MSVC) instead of PLATFORM(WIN_OS) to avoid the use of vasprintf.
+        https://bugs.webkit.org/show_bug.cgi?id=30473
+
+        vasprintf is missing in MSVC. Use COMPILER(MSVC) guards instead of
+        PLALTFORM(WIN_OS) guards.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-10-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20797
+
+        Make generic font family getters/setters accept an additional
+        argument (script code). It has a default value so that if an embedder
+        does not have/want a per-script font family setting, call-sites
+        don't have to be changed.
+        This is to prepare for fixing bug 10874 (font selection is not
+        language-dependent) and bug 18085.
+
+        There should be no change in layout and no new layout test
+        is added.
+
+        * WebCore.base.exp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+        * platform/text/UScriptCode.h: Added. This is for ports that
+          do not use ICU. the part of ICU's common/unicode/uscript.h
+          that defines script code enum was copied. To keep enums compatible
+          with those in ICU, we don't generate the list out of Scripts.txt
+          of the Unicode Data base or CLDR's data.
+
+2009-10-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clarify usage of SuddenTermination API. No code change.
+
+        * platform/SuddenTermination.h:
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        REGRESSION: Dromaeo DOM test is 14% slower
+        https://bugs.webkit.org/show_bug.cgi?id=30273
+
+        Make DOM bindings automatically inherit correct structure
+        flags rather than being needlessly conservative.  This is
+        done by making the bindings generator use the same model
+        for TypeInfo flags that we now use in JSC.
+
+        This gains us about 1% of this regression back.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-19  Robin Qiu  <robin.qiu@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fixed a bug on nested SVG <use> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=26117
+        When a <use> element refer to another <use> element which has
+        child/children, the instance tree built for this <use> element
+        is incorrect (more nodes than expected).
+
+        Test: svg/dom/use-on-use-with-child.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2009-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Small changes to fully invalidate and update the JavaScriptCallFrame.
+
+        <rdar://problem/7020755> JSDebugger crashes after reloading from a breakpoint
+        https://bugs.webkit.org/show_bug.cgi?id=27146
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::invalidate):
+        (WebCore::JavaScriptCallFrame::update):
+
+2009-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dmitri Titov.
+
+        Remove "source" from storage events
+        https://bugs.webkit.org/show_bug.cgi?id=30536
+
+        Remove "source" from storage events per
+        http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-October/023703.html
+
+        This was removed because it makes it introduces synchronous access that can
+        cross the event loop boundry (since a storage event can fire from one process
+        and be handled in another).
+
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::uri):
+        * storage/StorageEvent.idl:
+        * storage/StorageEventDispatcher.cpp:
+        (WebCore::StorageEventDispatcher::dispatch):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove ResourceLoadNotifier::activeDocumentLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30533
+
+        Removing this method from ResourceLoadNotifier better decouples the
+        notifier from FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::requestFromDelegate):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        * loader/ResourceLoadNotifier.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move sendRemainingDelegateMessages to ResourceLoadNotifier
+        https://bugs.webkit.org/show_bug.cgi?id=30531
+
+        This method is about notifying folks and doesn't interact with the rest
+        of FrameLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/FrameLoader.h:
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bypass popup blocker using click event
+        https://bugs.webkit.org/show_bug.cgi?id=21501
+
+        Keep track of which events were generated by JavaScript and use that
+        inforation when figuring out if we're processing a user gesture.
+
+        Test: http/tests/security/popup-blocked-from-fake-event.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGestureEvent):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+        (WebCore::Event::createdByDOM):
+        (WebCore::Event::setCreatedByDOM):
+
+2009-10-19  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixing a typo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30543
+
+        * platform/sql/SQLiteDatabase.h:
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Manual Test for crash caused by JS accessing DOMWindow which is disconnected from the Frame.
+        https://bugs.webkit.org/show_bug.cgi?id=30544
+
+        * manual-tests/crash-on-accessing-domwindow-without-frame.html: Added.
+
+2009-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Flash at end of opacity/transform transition sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=30501
+        
+        When a transition finishes, there window of time between when the animation is
+        removed, and the final style set on the GraphicsLayer. This caused the layer to revert
+        to its old appearance for one or two frames. To avoid this, we set the final
+        transform or opacity at the start of the transition; we know that the animation
+        will override the final value for as long as its running.
+        
+        No test because this is a very transient effect that can't be captured
+        in a test.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateLayerOpacity):
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+
+2009-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add more stop characters into console completions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30477
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Adam Roben.
+
+        implemented ClipboardWin::files()
+        https://bugs.webkit.org/show_bug.cgi?id=29666
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add support for link relations in HTMLAnchorElement and implement rel="noreferrer".
+
+        https://bugs.webkit.org/show_bug.cgi?id=28986
+
+        Tests: http/tests/navigation/no-referrer-reset.html
+               http/tests/navigation/no-referrer-same-window.html
+               http/tests/navigation/no-referrer-subframe.html
+               http/tests/navigation/no-referrer-target-blank.html
+
+        * WebCore.base.exp: Update FrameLoader::loadFrameRequest export symbol
+        * html/HTMLAnchorElement.cpp: Add support for link relations and implement noreferrer
+        (WebCore::HTMLAnchorElement::HTMLAnchorElement):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::hasRel):
+        (WebCore::HTMLAnchorElement::setRel):
+        * html/HTMLAnchorElement.h: Add support for link relations and implement noreferrer
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected): Add parameter for referrer policy
+        (WebCore::FrameLoader::loadFrameRequest): Add parameter for referrer policy
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Suppress opener if requested by ReferrerPolicy
+        * loader/FrameLoader.h: Update urlSelected and loadFrameRequest prototypes
+        * loader/FrameLoaderTypes.h: Add enum for referrer policy
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Update call to urlSelected()
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler): Update call to urlSelected()
+
+
+2009-10-19  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov (dglazkov@chromium.org).
+
+        [v8] typeof(HTMLMediaElement) should return undefined if media
+        engine is not available
+        https://bugs.webkit.org/show_bug.cgi?id=30343
+
+        Check for availability of the media engine to disable
+        HTMLMediaElement, HTMLAudioElement, HTMLVideoElement, MediaError
+        in runtime.
+
+        Try runs and review in Chromium:
+        http://codereview.chromium.org/276011
+
+        Test: manual-tests/chromium/media-player-not-available.html
+
+        The above test can work work in Chromium. Testing procedures:
+        1. Remove all media support libraries in Chromium (e.g. ffmpeg libraries)
+        2. Open Chromium with above test page
+        3. Verify the test results according to the test page
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        Declare enabler methods.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Report enabled only if media player is available.
+        * manual-tests/chromium/media-player-not-available.html: Added.
+        Manual test, following instruction in this test for procedures.
+        * page/DOMWindow.idl:
+        Mark HTMLMediaElement, HTMLAudioElement, HTMLVideElement, MediaError
+        as enabled at runtime.
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Refactor out some of the code in paint() into paintPanScrollIcon()
+        and paintScrollbars() in preparation of some Qt API changes.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Make the local static panScrollIcon into a Image* instead
+        of a RefPtr<Image>.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Forcefully set antialiasing for Chromium media controls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30521
+
+        Before it was nondeterministiacally being enabled based on the previous state of GraphicsContext.
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Added setShouldAntialias(true).
+
+2009-10-19  Jens Alfke  <jens@mooseyard.com>
+
+        Reviewed by Darin Adler.
+
+        Optimize string upper/lowercasing
+        https://bugs.webkit.org/show_bug.cgi?id=30261
+        
+        - Added AtomicString::upper() and lower()
+        - Further optimized StringImpl::lower()
+        - Removed StringImpl::isLower()
+        - Added QualifiedName::localNameUpper(), which is cached, thereby saving
+          thousands of upper() calls and string allocations.
+ 
+         * dom/Element.cpp:
+         (WebCore::Element::setAttribute): Call AtomicString::lower()
+         * dom/QualifiedName.cpp:
+         (WebCore::QualifiedName::localNameUpper): New method
+         * dom/QualifiedName.h: Added localNameUpper() method
+         * dom/StyledElement.cpp:
+         (WebCore::StyledElement::parseMappedAttribute):  Call AtomicString::lower()
+         * html/HTMLDocument.cpp:
+         (WebCore::HTMLDocument::createElement): Call AtomicString::lower()
+         * html/HTMLElement.cpp:
+         (WebCore::HTMLElement::nodeName): Call localNameUpper()
+         * platform/text/AtomicString.cpp:
+         (WebCore::AtomicString::lower): New method
+         (WebCore::AtomicString::upper): New method
+         * platform/text/AtomicString.h: Added lower() and upper()
+         * platform/text/StringImpl.cpp: Removed isLower()
+         (WebCore::StringImpl::lower): Further optimization of initial loop
+         * platform/text/StringImpl.h: Removed isLower()
+ 
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        If a call to a plugin's invokeMethod, invokeDefault or construct
+        returns false, throw an exception into JS.        
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        Test: plugins/netscape-invoke-failure.html
+
+        * bindings/v8/V8NPObject.cpp: Check return values of invokeMethod, invokeDefault and construct.
+        (npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod): Check return value
+        (JSC::Bindings::CInstance::invokeDefaultMethod): Check return value
+        (JSC::Bindings::CInstance::invokeConstruct): Check return value
+
+2009-10-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for chromium/skia canvas arc start/end positions, when the arc is
+        >= 360 degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=30449
+
+        Covered by new test:
+        LayoutTests/fast/canvas/arc360.html
+
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::addArc):
+
+2009-10-19  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix uninitialized variable reference in Element::removeAttribute().
+        https://bugs.webkit.org/show_bug.cgi?id=30502
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute):
+
+2009-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30463
+        Remove HTML5 media element 'loadend' event
+
+        * dom/EventNames.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Remove 'loadend'.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::noneSupported): Ditto.
+        (WebCore::HTMLMediaElement::mediaEngineError): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::userCancelledLoad): Ditto.
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Remove deletion of outgoing FormData object when reply is finished.
+        The buffers will be destroyed a bit later, when the QNetworkReply is deleted.
+        Bug: https://bugs.webkit.org/show_bug.cgi?id=29551
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-10-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix hard-to-reproduce crash in HTMLTokenizer by avoiding a rare
+        fastRealloc edge case.
+        https://bugs.webkit.org/show_bug.cgi?id=29313
+
+        No test, the crash shows up occasionally in crash dumps, we weren't able
+        to reproduce it locally.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Added an early exit to
+            avoid calling fastRealloc with the size of 0.
+
+2009-10-19  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Use fillRect() instead of drawRect() to fix Chromium media controls rendering.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30371
+
+        Chromium Mac layout tests will need to be rebaselined.  Existing layout tests for Linux/Win still pass.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Use fillRect() instead of drawRect().
+
+2009-10-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Crash in DOMWindow::clearTimeout etc when DOMWindow is not connected to a frame.
+        https://bugs.webkit.org/show_bug.cgi?id=29832
+
+        Need to make sure the script caches are reset when frame gets disconnected from still-alive DOMWindow.
+        This will prevent JS from calling DOMWindow methods that can not be completed w/o the frame.
+
+        I am not sure it's possible to test this since the only file that repros the problem need ~10 seconds to cause crash.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Right after frame disconnects from DOMWindow, clear WindowShell.
+
+2009-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed build warning fix.
+        [Qt] Apply changes to WebCore.pro introduced in r49778
+
+        * WebCore.pro: Removed svg/graphics/filters/SVGFEGaussianBlur.h from HEADERS
+
+2009-10-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move feGaussianBlur from WebCore/svg to WebCore/platform
+        [https://bugs.webkit.org/show_bug.cgi?id=30495]
+
+        This patch moves SVGFRGaussianBlur from svg/graphics/filters
+        to platform/graphics/filters/FEGaussianBlur. This is needed
+        for shadow support on Qt and Cairo.
+        No change in functionality, therfore no new test case needed.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp: Added.
+        * platform/graphics/filters/FEGaussianBlur.h: Added.
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp: Removed.
+        * svg/graphics/filters/SVGFEGaussianBlur.h: Removed.
+
+2009-10-19  Yael Aharon  <yael.aharon@nokia.com>
+
+        Unreviewed.
+
+        Added reviewer name to r49574.
+
+2009-10-19  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30489
+        [Gtk] The document frame/html container claims to be parentless
+
+        Work around for the parentless claim made by the accessible associated
+        with the embedded WebView. When we identify this condition, get the
+        widget's parent, and then get the AtkObject from that. Admittedly an ugly
+        hack, but we'll need it for Yelp and other Gtk+/GNOME applications which
+        plan to switch over to WebKit.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_parent):
+
+2009-10-19  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Handle duration queries properly
+        https://bugs.webkit.org/show_bug.cgi?id=29999
+
+        Previously duration queries failed to handle unknown duration
+        and didn't treat the returned duration as an unsigned.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-10-19  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Fix build on Windows.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::~PluginContainerQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+        Allow one to customize the minimal and maximal shrink factors used when printing.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::begin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPrintingMinimumShrinkFactor):
+        (WebCore::Settings::setPrintingMaximumShrinkFactor):
+        * page/Settings.h:
+        (WebCore::Settings::printingMinimumShrinkFactor):
+        (WebCore::Settings::printingMaximumShrinkFactor):
+
+2009-10-18  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fixes issue where doubleclicking a word could select following adjacent newlines.
+        https://bugs.webkit.org/show_bug.cgi?id=30234
+
+        Tests: platform/mac/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/mac/editing/selection/script-tests/TEMPLATE.html
+               platform/win/editing/selection/doubleclick-should-not-expand-across-lines.html
+               platform/win/editing/selection/script-tests/TEMPLATE.html
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix, use proper header name.
+
+        * platform/network/curl/ResourceHandleManager.h:
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Properties on Arrays and NodeLists are not logged correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30485
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._printArray):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: touching WebCore so that it
+        initiated inspector frontend deployment on Windows.
+
+        Web Inspector: frontend files are not deployed in Windows
+        incremental build.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+
+2009-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Title of dir(["test", "test2"]) should be Array
+
+        https://bugs.webkit.org/show_bug.cgi?id=30486
+
+        Test: inspector/console-tests.html
+
+        * inspector/front-end/InjectedScript.js:
+
+2009-10-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        REGRESSION: SVG Mask doesn't work for maskContentUnits="objectBoundingBox"
+        [https://bugs.webkit.org/show_bug.cgi?id=30480]
+
+        Patch for SVGMaskElement landed in r49598 should correct the location of
+        the mask image graphics context. It only corrects the location for userSpaceOnUse
+        mode in maskContentUnits but breaks objectBoundingBoxMode.
+        The maskDestRect shouldn't be moved. It is not responsible for the correct context
+        postioin but for the correct position of the mask image.
+        This patch calculates the context postion independently from the maskDestRect.
+        It also uses lineareRGB color space for masking on CG now. This is the default
+        color space for masking operations.
+        We already have tests for both maskContentUnits modes.
+
+            *svg/W3C-SVG-1.1/masking-intro-01-f.svg
+            *svg/custom/mask-with-default-value.svg
+
+        Some tests needed new pixel tests because of the new color space.
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-18  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Use v8::Integer::NewFromUnsigned when converting unsigneds into V8's numbers.
+        That is notably faster for small numbers (most common case).
+        https://bugs.webkit.org/show_bug.cgi?id=30493
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Add MathML to the build system
+        https://bugs.webkit.org/show_bug.cgi?id=30487
+
+        Add MathML sources if MathML support is enabled.
+
+        * GNUmakefile.am:
+
+2009-10-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-PCH build fix. Added missing header.
+
+        * bridge/runtime_root.h:
+
+2009-10-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layers not correctly updated after partial layout
+        https://bugs.webkit.org/show_bug.cgi?id=30425
+        
+        When a partial layout happened, for example as the result of a postion-change-only
+        layout, then some compositing layer positions were not correctly updated. To fix
+        this, updateLayerPositions() now carries along a flag that is set at the rootmost
+        layer being updated, and used to determine when we hit the first compositing layer
+        in this update. RenderLayerBacking::updateAfterLayout() makes use of this information
+        to do a full geometry update on that layer, which is thus the rootmost compositing
+        layer that is being updated.
+
+        Test: compositing/geometry/partial-layout-update.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        * rendering/RenderLayerBacking.h:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add support for proxies in CURL.
+ 
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setProxyInfo):
+        (WebCore::ResourceHandleManager::initializeHandle):
+        * platform/network/curl/ResourceHandleManager.h:
+        (WebCore::ResourceHandleManager::):
+
+2009-10-18  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez
+
+        https://bugs.webkit.org/show_bug.cgi?id=25901
+        Use ATK_ROLE_SECTION for divTag and ATK_ROLE_LABEL for labelTag
+
+        Replaces the use of ATK_ROLE_PANEL with the expected accessible roles.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-10-17  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Cleanup SVGElement code, preparing for animVal support
+        https://bugs.webkit.org/show_bug.cgi?id=30466
+
+        Add new SynchronizablePropertyController and move the code for SVG property <-> XML attribute synchronization
+        from SVGElement. This is a further preparation for animVal support, where SynchronizablePropertyController will
+        be used to control the start/end state of an animated property.
+
+        We're currently tracking animated properties that need synchronization, generalize this concept and use
+        it to track their creation (bound to certain SVG*Element classes) as well as a flag determing the need
+        of synchronization (no SVG DOM object wrappers, no synchronization needed).
+
+        No change in functionality, thus no tests.
+
+        * GNUmakefile.am: Add 'SynchronizablePropertyController.cpp/h' to build
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGAnimatedProperty.h: Add registerProperty() function 
+        (WebCore::::SVGAnimatedProperty): Call registerProperty() function  
+        (WebCore::::registerProperty): Add new registerProperty() function, announcing new properties to SynchronizablePropertyController.
+        * svg/SVGAnimatedTemplate.h: Use propertyController() method, to access the new functions moved from SVGElement.
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGElement.cpp: Adapt to code moving to SynchronizablePropertyController.
+        (WebCore::SVGElement::updateAnimatedSVGAttribute):
+        * svg/SVGElement.h: Move handling SVG property synchronization to SynchronizablePropertyController.
+        (WebCore::SVGElement::propertyController): Expose reference to SynchronizablePropertyController object.
+        * svg/SVGViewSpec.cpp: Reorder initialization order of contextElement, leading to possible crashes.
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        (WebCore::SVGViewSpec::viewTarget):
+        * svg/SVGViewSpec.h: Ditto.
+        (WebCore::SVGViewSpec::contextElement):
+        * svg/SynchronizablePropertyController.cpp: Added.
+        (WebCore::SynchronizablePropertyController::SynchronizablePropertyController):
+        (WebCore::SynchronizablePropertyController::registerProperty):
+        (WebCore::SynchronizablePropertyController::setPropertyNeedsSynchronization):
+        (WebCore::SynchronizablePropertyController::synchronizeProperty):
+        (WebCore::SynchronizablePropertyController::synchronizeAllProperties):
+        (WebCore::SynchronizablePropertyController::startAnimation):
+        (WebCore::SynchronizablePropertyController::stopAnimation):
+        * svg/SynchronizablePropertyController.h: Added.
+        (WebCore::SynchronizableProperty::SynchronizableProperty):
+        (WebCore::SynchronizableProperty::isHashTableDeletedValue):
+        (WebCore::SynchronizableProperty::operator==):
+        (WebCore::SynchronizablePropertyHash::hash):
+        (WebCore::SynchronizablePropertyHash::equal):
+        (WebCore::SynchronizablePropertyHashTraits::constructDeletedValue):
+        (WebCore::SynchronizablePropertyHashTraits::isDeletedValue):
+
+2009-10-17  Joanmarie Diggs  <joanmarie.diggs@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25413
+        [GTK] Please expose the level of headings
+
+        Exposes the heading level as an attribute of the AtkObject.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (addAttributeToSet):
+        (webkit_accessible_get_attributes):
+        (webkit_accessible_class_init):
+
+2009-10-17  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        EventHandler::eventLoopHandleMouseDragged needs ENABLE(DRAG_SUPPORT) guards
+        https://bugs.webkit.org/show_bug.cgi?id=30472
+
+        Put ENABLE(DRAG_SUPPORT) guards around EventHandler::eventLoopHandleMouseDragged
+        in EventHandler.cpp. MSVC fails to compile when DRAG_SUPPORT not enabled.
+
+        * page/EventHandler.cpp:
+
+2009-10-17  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [chromium] Video controls not zoomed / transformed correctly
+        https://bugs.webkit.org/show_bug.cgi?id=30461
+
+        Draw the images in the controls scaled.
+
+        No new tests. With this change Chromium will pass the following tests:
+        LayoutTests/media/video-controls-zoomed.html
+        LayoutTests/media/video-controls-transformed.html
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        Pass along the target rect directly.
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        Adjust the thumb slide applied with the scale factor.
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Gtk] Build fix for WebKitGtk after r49723.
+
+        Add bindings/js/JSExceptionBase.* to the build.
+
+        * GNUmakefile.am:
+
+2009-10-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49723.
+
+        Add bindings/js/JSExceptionBase.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule): Ask for the correct library instead of guessing.
+        * platform/win/ScrollbarThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderMediaControls.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+        * rendering/RenderThemeSafari.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_hasBeenHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::hasBeenHalted):
+        Return m_hasBeenHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_hasBeenHalted.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        @charset rule after the first byte causes the rest of css to be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=18265
+
+        Apparently we're supposed to tolerate whitespace before the charset
+        rule so folks can write code like this:
+
+        <style>
+        @charset "utf-8"
+        ...
+        </style>
+
+        I'm told this is one of the top compatability problems in China.
+        Tests: fast/css/comment-before-charset-external.html
+               fast/css/comment-before-charset.html
+               fast/css/many-spaces-before-charset.html
+               fast/css/space-before-charset-external.html
+               fast/css/space-before-charset.html
+
+        * css/CSSGrammar.y:
+
+2009-10-16  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes part of <http://webkit.org/b/30412>.
+        Web Inspector should get human readable DOM Exceptions.
+
+        Add a description field to ExceptionBase, and call it through 
+        reportException which allows the user/developer to get a more detailed
+        and coherent error explanation through the Web Inspector.
+
+        This only applies to exceptions that come from a script on the page when
+        it is run. DOM Exceptions that come from the code run in the console, or DOM
+        exceptions that are caught and logged will come in a future patch.
+
+        Tests: inspector/uncaught-dom1-exception.html
+               inspector/uncaught-dom3-exception.html
+               inspector/uncaught-dom8-exception.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        * bindings/js/JSExceptionBase.cpp: Added.
+        (WebCore::toExceptionBase):
+        * bindings/js/JSExceptionBase.h: Added.
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/ExceptionBase.h:
+        (WebCore::ExceptionBase::description):
+        * dom/ExceptionCode.cpp:
+        (WebCore::):
+        (WebCore::getExceptionCodeDescription):
+        * dom/ExceptionCode.h:
+
+2009-10-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: forgot to check in this #include.
+
+        * bridge/runtime_root.h:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transform layer gets stuck with the wrong transform after an animation ends
+        <rdar://problem/7311662>
+
+        Work around a CoreAnimation bug which causes an animated transform layer to
+        end up with a stale transform.
+        
+        Test: compositing/animation/state-at-end-event-transform-layer.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::bug7311367Workaround):
+        (WebCore::GraphicsLayerCA::removeAnimationFromLayer):
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        After running a transition with an end event listener, can't change the transform
+        https://bugs.webkit.org/show_bug.cgi?id=30454
+        
+        Fix an issue where, if a document had any listener for webkitTransitionEnd or webkitAnimationEnd,
+        the animations would not get cleaned up correctly, which broke subsequent changes of transform.
+        
+        Now, we always clean up the animations right after queuing up the end events.
+
+        Tests: animations/state-at-end-event.html
+               transitions/move-after-transition.html
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Handle the Enter Key in the Elements Tree Hierarchy
+        https://bugs.webkit.org/show_bug.cgi?id=30428
+
+        TextNode => Edit Text Node
+        Has Attributes => Edit First Attribute
+        No Attributes => Start Editing New Attribute
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent): handle the "Enter" key
+        (WebInspector.ElementsTreeElement.prototype.set hovered): only add new attribute button on nodes with attributes
+        (WebInspector.ElementsTreeElement.prototype._addNewAttribute): prevent moving backwards where there are no attributes
+        (WebInspector.ElementsTreeElement.prototype._startEditingFromEvent): renamed to be clearer
+        (WebInspector.ElementsTreeElement.prototype._startEditing): transition to the appropriate edit state for a tree element
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix header indent style for FrameLoader and friends
+        https://bugs.webkit.org/show_bug.cgi?id=30430
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::frame):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::notifier):
+        (WebCore::FrameLoader::isLoadingMainResource):
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state):
+        (WebCore::FrameLoader::client):
+        (WebCore::FrameLoader::url):
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+        (WebCore::FrameLoader::committingFirstRealLoad):
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * loader/HistoryController.h:
+        (WebCore::HistoryController::currentItem):
+        (WebCore::HistoryController::provisionalItem):
+        * loader/PolicyCallback.h:
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyChecker.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        * loader/RedirectScheduler.h:
+        * loader/ResourceLoadNotifier.h:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebCore.vcproj/QTMovieWin.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.make: Debug build in makefile should build Debug_All.
+        * WebCore.vcproj/WebCore.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.submit.sln: Add Debug_All configuration.
+        * WebCore.vcproj/WebCore.vcproj: Add Debug_All configuration.
+        * WebCore.vcproj/WebCoreGenerated.vcproj: Renamed single configuration from "Release" to "all".
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49693, because it broke Chromium build.
+        http://trac.webkit.org/changeset/49693
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Updated media resource selection algorithm to reflect latest HTML 5 specification.
+
+        Noticable changes:
+            -  Elements with no source should have their network state set to NETWORK_EMPTY as opposed to NETWORK_NO_SOURCE
+            -  Empty string ("") is now considered a valid URL resolving to the current page and will be loaded
+
+        Tests: media/video-src-empty.html
+               media/video-src-none.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=30407
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectMediaResource): Updated code and comments to match spec.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Insecure plug-ins don't trigger mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=30431
+
+        Added the missing check.
+
+        Test: http/tests/security/mixedContent/insecure-plugin-in-iframe.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Set autobuffer to true and schedule load in V8 audio element constructor.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30448
+
+        Covered by existing tests.
+
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Set autobuffer to true and schedule load.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove FIXME in RenderMediaControlsChromium as bug was fixed upstream.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30422
+
+        Covered by existing media layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaSlider): Removed round() and FIXME.
+
+2009-10-16  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix Chromium media controls to render a disabled play button when the element is unintialized.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30410
+
+        Covered by existing layout tests.
+
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaPlayButton): Include check for NETWORK_EMPTY to render disabled play button.
+
+2009-10-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Last part -- replace HasDefaultGetPropertyNames with OverridesGetPropertyNames
+        flag.
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-16  Steven Knight  <sgk@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30447
+        Handle long link lines by building .idl-generated bindings in a
+        separate webcore_bindings library target.  Avoid Visual Studio
+        dependency issues by building additional generated .cpp and .h files
+        in a separate webcore_bindings_sources target.
+
+        Chrome should still build and test successfully.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2009-10-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Transform transitions that used to be accelerated are no longer so
+        https://bugs.webkit.org/show_bug.cgi?id=30453
+
+        The change in r49633, to not run accelerated animations/transitions on layers that
+        are not attached, broke accelerated transitions/animations in many cases where they start
+        as soon as the page loads. This change reverts the code that tests for the GraphicsLayer being
+        attached.
+        
+        No test, because it's not possible from a test to know whether a transition is accelerated or not.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix, build the MSW source to get methods that use the MSW version of
+        PlatformModuleVersion.
+
+        * wscript:
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Add back MIMETypeRegistryChromium with the right
+        casing.
+
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Change EmptyPluginHalterClient in SVGImage to be non-static, to
+        match changes made http://trac.webkit.org/changeset/49385.
+        https://bugs.webkit.org/show_bug.cgi?id=30403
+
+        Run the following layout test sequence:
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-01-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-03-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-04-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-05-b.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-06-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-07-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-08-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-09-t.svg
+          LayoutTests/svg/W3C-SVG-1.1/struct-image-10-t.svg
+          LayoutTests/svg/carto.net/scrollbar.svg
+          LayoutTests/svg/carto.net/selectionlist.svg
+
+        selectionlist.svg should not crash.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Made EmptyPluginHalterClient non-static.
+
+2009-10-16  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add beforeload event support to V8DOMWrapper
+
+        https://bugs.webkit.org/show_bug.cgi?id=30413
+
+        LayoutTests/fast/dom/beforeload/frame-before-load.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        MimeTypeRegistryChromium is mis-casen
+        https://bugs.webkit.org/show_bug.cgi?id=30441
+
+        Change the case of MimeTypeRegistryChromium to match other platforms.
+
+        * WebCore.gypi:
+        * platform/chromium/MIMETypeRegistryChromium.cpp: Copied from WebCore/platform/chromium/MimeTypeRegistryChromium.cpp.
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Removed.
+
+2009-10-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Chrome doesn't set Content-Type for file upload when the file extension
+        is not recognized
+        https://bugs.webkit.org/show_bug.cgi?id=30433
+
+        Apparently, getMIMETypeForPath is supposed to return
+        application/octet-stream when it doesn't have a better MIME type.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Inform the application when a plugin is created or destroyed, but only if the 
+        application registered for these notifications.
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-16  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Default language translation should be determined by locale settings,
+        e.g., "en-US".
+        https://bugs.webkit.org/show_bug.cgi?id=29653
+
+        Test: fast/js/navigator-language.html
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::defaultLanguage):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Crash fix when loading NPAPI plugins on Qt/Mac
+
+        There's no guarantee that the plist will be valid even if we
+        ask the plugin to create it. Crash obverved with iGetter.
+
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-10-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix for Chromium/skia's implementation of canvas's isPointInPath().
+        https://bugs.webkit.org/show_bug.cgi?id=30402
+
+        Covered by LayoutTests/fast/canvas/pointInPath.html.
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor ResourceLoadNotifier out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30379
+
+        These methods have virtually no interaction with the rest of
+        FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::FrameLoader::sendRemainingDelegateMessages):
+        (WebCore::FrameLoader::requestFromDelegate):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::notifier):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::receivedError):
+        * loader/ResourceLoadNotifier.cpp: Added.
+        (WebCore::ResourceLoadNotifier::ResourceLoadNotifier):
+        (WebCore::ResourceLoadNotifier::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::didCancelAuthenticationChallenge):
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::willSendRequest):
+        (WebCore::ResourceLoadNotifier::didReceiveResponse):
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::didFinishLoad):
+        (WebCore::ResourceLoadNotifier::didFailToLoad):
+        (WebCore::ResourceLoadNotifier::didLoadResourceByXMLHttpRequest):
+        (WebCore::ResourceLoadNotifier::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::dispatchDidFinishLoading):
+        (WebCore::ResourceLoadNotifier::activeDocumentLoader):
+        * loader/ResourceLoadNotifier.h: Added.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::willSendRequest):
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+        (WebCore::ResourceLoader::didFail):
+        (WebCore::ResourceLoader::didCancel):
+        (WebCore::ResourceLoader::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceLoader::didCancelAuthenticationChallenge):
+
+2009-10-15  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 30427 -  Remove unneeded methods in ChromiumDataObject
+        (https://bugs.webkit.org/show_bug.cgi?id=30427)
+        
+        Remove no longer needed methods from ChromiumDataObject.
+
+        No new tests (no functional change)
+
+        * platform/chromium/ChromiumDataObject.h:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        No review, rolling out r49644.
+        http://trac.webkit.org/changeset/49644
+        
+        We need to think about this change some more. See bug #30418 
+        for more details.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        Initialize m_isHalted.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isHalted):
+        Return m_isHalted.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+        Set m_isHalted to true.
+        (WebCore::PluginView::restart):
+        clear m_isHalted.
+
+2009-10-15  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Build fix for QtWebKit after r49649.
+
+        Change JSC::HasNonDefaultMark to OverridesMarkChildren in createStructure function.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed - build fix.
+
+        Web Inspector: add file missing in r49648
+
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+
+        Part 2 -- Reverse the TypeInfo HasDefaultMark flag to OverridesMarkChildren, etc
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: introduce test controller with waitUntilDone
+        on frontend side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30400
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/TestController.js: Added.
+        (WebInspector.TestController):
+        (WebInspector.TestController.prototype.waitUntilDone):
+        (WebInspector.TestController.prototype.notifyDone):
+        (WebInspector.evaluateForTestInFrontend):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27895
+        
+        Fixes an issue in which injecting an inline event handler whose value ends in a single-line
+        JavaScript comment can bypass the XSSAuditor. Similarly fixes this issue with respect to
+        the HTML Base element, HTML Object element, inline and external script tags, and
+        JavaScript multi-line variants of all of these attacks.
+
+        Tests: http/tests/security/xssAuditor/base-href-comment.html
+               http/tests/security/xssAuditor/iframe-javascript-url-comment.html
+               http/tests/security/xssAuditor/img-onerror-HTML-comment.html
+               http/tests/security/xssAuditor/img-onerror-comment.html
+               http/tests/security/xssAuditor/object-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-comment-HTML-entity.html
+               http/tests/security/xssAuditor/script-tag-comment.html
+               http/tests/security/xssAuditor/script-tag-with-source-comment.html
+
+        * page/XSSAuditor.cpp: Added constant minAttackLength.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::findInRequest): Added parameter context. Only looks at up 
+        to minAttackLength of script code plus context (if any).
+        * page/XSSAuditor.h:
+
+2009-10-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Currently, Skia clip paths are 1-bit. This patch makes our path
+        clipping anti-aliased for non-canvas drawing.
+
+        http://code.google.com/p/chromium/issues/detail?id=5927
+        https://bugs.webkit.org/show_bug.cgi?id=28820
+        http://www.imperialviolet.org/2009/09/02/anti-aliased-clipping.html
+
+        Already covered by layout tests. New baselines will be needed in the
+        Chromium tree.
+
+        (Reland. First landed in r49329, reverted in r49330 due to Windows
+        build break)
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::clip):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::canvasClip):
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::clipPathAntiAliased):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyAntiAliasedClipPaths):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebCore.Video.exp: Export muted and setMute.
+
+2009-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Transitions fail to run sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=26770
+
+        Fix an issue where we could attempt to start accelerated animations or transitions on
+        GraphicsLayer that were not rooted (because of visibility:hidden), which would leave
+        the AnimationController's m_waitingForResponse flag in a state that killed subsequent
+        software transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        Make some methods non-inline for ease of debugging (these are not hot methods).
+        Rename m_waitingForAResponse to m_waitingForResponse.
+        
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::hasAncestor):
+        New method to report whether the receiver has the given layer as an ancestor. Used for checking
+        whether a layer is rooted.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        Don't try to start accelerated animations or transitions on non-rooted GraphicsLayers.
+
+2009-10-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Refactor ProfilesPanel to support multiple profile types
+
+        Data describing different profile types are now stored in distinct objects.
+        https://bugs.webkit.org/show_bug.cgi?id=30332
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        (WebInspector.CPUProfileView.prototype._sortData):
+        (WebInspector.CPUProfileType):
+        (WebInspector.CPUProfileType.prototype.get buttonTooltip):
+        (WebInspector.CPUProfileType.prototype.get buttonStyle):
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        (WebInspector.CPUProfileType.prototype.setRecordingProfile):
+        (WebInspector.CPUProfile):
+        (WebInspector.CPUProfile.prototype.get title):
+        (WebInspector.CPUProfile.prototype.get uid):
+        (WebInspector.CPUProfile.prototype.get head):
+        (WebInspector.CPUProfile.prototype.createView):
+        (WebInspector.CPUProfile.prototype.viewForProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfileType):
+        (WebInspector.ProfileType.prototype.get buttonTooltip):
+        (WebInspector.ProfileType.prototype.get buttonStyle):
+        (WebInspector.ProfileType.prototype.get buttonCaption):
+        (WebInspector.ProfileType.prototype.get id):
+        (WebInspector.ProfileType.prototype.get name):
+        (WebInspector.ProfileType.prototype.buttonClicked):
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems.clickHandler):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._makeKey):
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.getProfileType):
+        (WebInspector.ProfilesPanel.prototype.showProfileForURL):
+        (WebInspector.ProfilesPanel.prototype.updateProfileTypeButtons):
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        (WebInspector.ProfilesPanel.prototype.get searchableViews):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.addProfileHeader):
+        (WebInspector.setRecordingProfile):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.showProfileForURL):
+
+2009-10-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enable inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GStreamer] READY state doesn't mean "enough data"
+        https://bugs.webkit.org/show_bug.cgi?id=30003
+
+        STATE_READY means MediaPlayer::HaveNothing
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30002
+
+        implement cancelLoad
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30353
+        
+        Fix race condition, leading to a deadlock
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_unlock_stop):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_start):
+        (webkit_video_sink_class_init):
+        Fix race condition in unlock/render that would lead to deadlocks.
+
+2009-10-15  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30374
+        
+        Check if caps are valid before parsing them
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+        Check if caps are valid before parsing them in ::naturalSize().
+        This prevents assertions if the natural size should be calculated
+        before the video caps are negotiated.
+
+2009-10-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30006
+        [GStreamer] Unnecessary checks for Messages types in callbacks
+
+        refactored gst message callbacks into a single one
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback):
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+
+2009-10-15  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Adele Peterson.
+
+        Anchor elements should be mouse focusable regardless isLink flag.
+        https://bugs.webkit.org/show_bug.cgi?id=26856
+
+        * html/HTMLAnchorElement.cpp:
+        * html/HTMLAnchorElement.h:
+
+2009-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Return correct shorthand property name for 
+        background-repeat-x, background-repeat-y, background-position-x,
+        background-position-y, -webkit-mask-position-x, -webkit-mask-position-y,
+        -webkit-mask-repeat-x, -webkit-mask-repeat-y.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+
+        Test: fast/backgrounds/repeat/background-repeat-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Create and update frontend script objects only when
+        web inspector is visible.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30376
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+
+2009-10-15  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Fix Windows build.
+
+        * dom/Document.idl:
+
+2009-10-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [HTML5] Add document.head
+        https://bugs.webkit.org/show_bug.cgi?id=30232
+
+        Test is fast/dom/document-head.html
+
+        * dom/Document.idl: added readonly attribute head
+
+2009-10-14  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Check FNonNeg after the unit switch to avoid valgrind uninitialised conditional reference in WebCore::CSSParser::validUnit.  See http://crbug.com/20939.
+        https://bugs.webkit.org/show_bug.cgi?id=30347
+        https://bugs.webkit.org/show_bug.cgi?id=22772
+
+        Covered by running LayoutTests/fast/css/invalid-percentage-property.html under valgrind.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Move scrolling code from FrameLoader to FrameView
+        https://bugs.webkit.org/show_bug.cgi?id=30370
+
+        This code is about controlling the Frame's view, not about loading
+        stuff into the frame.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::scrollToAnchor):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToFragment):
+        (WebCore::FrameView::scrollToAnchor):
+        * page/FrameView.h:
+
+2009-10-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make typeinfo flags default to false
+        https://bugs.webkit.org/show_bug.cgi?id=30372
+        
+        Part 1. Reverse the HasStandardGetOwnPropertySlot flag.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2009-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        [XSSAuditor] Add an exception for local files
+        https://bugs.webkit.org/show_bug.cgi?id=30352
+
+        Reduce XSS auditor false positives by always letting pages load scripts
+        from their own host. We don't actually know of any false positives
+        that this prevents, but it seems like a good idea.
+
+        One subtly is that we don't add this exception for scripts that have a
+        query string because (1) URLs with query strings are more apt to
+        confuse servers and (2) it is much less common to load scripts with a
+        query string.
+
+        Tests: http/tests/security/xssAuditor/script-tag-with-source-same-host-with-query.html
+               http/tests/security/xssAuditor/script-tag-with-source-same-host.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+
+2009-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Kill virtual contextElement() method spread all over SVG code
+        https://bugs.webkit.org/show_bug.cgi?id=30183
+
+        Remove virtual contextElement() function from all SVG*Element classes, as all animated properties live in the
+        SVG*Element classes now instead of the SVGFitToViewBox / SVGURIReference / SVGExternalResourcesRequired
+        subclasses. This is a first step to working animVal support. More patches will follow that depend on this change.
+
+        Remove "This file is part of the KDE project" from several files, change my old mail adress wildfox -> zimmermann,
+        and remove vim modelines on all files I touched. No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGAltGlyphElement.h: Remove virtual contextElement() method.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::synchronize):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGAnimationElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGCircleElement.h: Ditto.
+        * svg/SVGClipPathElement.h: Ditto.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGDefsElement.h: Ditto.
+        * svg/SVGEllipseElement.h: Ditto.
+        * svg/SVGExternalResourcesRequired.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFEImageElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFELightElement.h: Remove virtual contextElement() method.
+        * svg/SVGFEMergeNodeElement.h: Ditto.
+        * svg/SVGFilterElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGFilterPrimitiveStandardAttributes.h: Remove virtual contextElement() method.
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::parseViewBox): Add Document* parameter - we used to fetch the Document pointer from the context element.
+        (WebCore::SVGFitToViewBox::parseMappedAttribute): Ditto.
+        * svg/SVGFitToViewBox.h: Remove pure-virtual contextElement() method.
+        * svg/SVGFontElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGForeignObjectElement.h: Ditto.
+        * svg/SVGGElement.h: Ditto.
+        * svg/SVGGradientElement.h: Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGLineElement.h: Ditto.
+        * svg/SVGMPathElement.h: Ditto. Fix license indention.
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGMarkerElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGMaskElement.h: Ditto.
+        * svg/SVGPathElement.h: Ditto.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGPatternElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::updateAnimatedSVGAttribute): synchronizeProperty<...>() has been renamed to PropertySynchronizer<...>::synchronize().
+        * svg/SVGPolyElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGRectElement.h: Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSVGElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGScriptElement.h: Ditto.
+        * svg/SVGSwitchElement.h: Ditto.
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGSymbolElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTRefElement.h: Remove virtual contextElement() method.
+        * svg/SVGTextContentElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGTextPathElement.h: Remove virtual contextElement() method.
+        * svg/SVGUseElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::parseMappedAttribute): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        * svg/SVGViewElement.h: Remove virtual contextElement() method. Change OwnerType of ANIMATED_* macros to this class.
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::setViewBoxString): Pass document() to SVGFitToViewBox::parseMappedAttribute().
+        (WebCore::SVGViewSpec::parseViewSpec): Ditto.
+        * svg/SVGViewSpec.h: Devirtualize contextElement() method, it's the only place where contextElement() remains needed.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Masking with wrong offset
+        [https://bugs.webkit.org/show_bug.cgi?id=30325]
+
+        SVGMaskElement moves the mask image graphics context to the wrong location.
+        In objectBoundingBoxMode the maskDestRect gets translated. This transformation
+        is not used in the later calculation. Fix by consistenly calculating the translation
+        offsets from the final mask destination rect.
+
+        Test: svg/custom/mask-with-default-value.svg
+
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Jon Honeycutt.
+        
+        Export a few more showSubstituteImage() related methods.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-14  Mark Seaborn  <mseaborn@google.com>
+
+        Reviewed by Darin Adler.
+
+        Check error return value in Perl build script
+        https://bugs.webkit.org/show_bug.cgi?id=30316
+
+        * css/makevalues.pl: Die if gperf fails.
+
+2009-10-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG wrong filterRegions for userSpaceOnUse and percentage values
+        [https://bugs.webkit.org/show_bug.cgi?id=30330]
+
+        Some clean-up of the SVG filter calculation code. This clean-up
+        also fixes the problem with percentage and userSpaceInUse mode.
+
+        Test: svg/filters/subRegion-in-userSpace.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::buildFilter):
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::~SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::create):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        The last change fixed the problem, removing diagnostic printfs.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL build fix for versions < 7.18.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        One more round of changes to figure out why the webgl 
+        tests are crashing on the build bot. Here I am trying
+        to see if we can create a software renderer. I am also
+        printing the found pixel formats.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Yael Aharon  <yael.aharon@nokia.com>
+ 
+        Reviewed by Simon Hausmann.
+ 
+        Enabling NPAPI plugin support on Qt Webkit for S60 platform
+        https://bugs.webkit.org/show_bug.cgi?id=29302
+
+        Also implemented by Mahesh Kulkarni<mahesh.kulkarni@nokia.com>, 
+        Rohini Ananth <rohini.ananth@nokia.com> and help from Norbert Lesr
+        <norbert.leser@nokia.com>
+         
+        * WebCore.pro:
+        Enabling ENABLE_NETSCAPE_PLUGIN_API for S60 and added S60 specific 
+        new plugin files to be compiled under symbian: macro
+
+        * bridge/npapi.h:
+        Added NPEvent and NPRegion definition for Symbian
+
+        * plugins/PluginPackage.h:
+        Added S60 specific plugin interface and plugin loader variables
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::unload): Added !PLATFORM(SYMBIAN) macro.
+        Default implementation to be used only for non-symbian platform
+        * plugins/PluginDatabase.cpp:
+        Macro !SYMBIAN checking
+        * plugins/PluginView.h:
+        Add Symbian to platforms that support setNPWindowIfNeeded
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect): Add Symbian to platforms that
+        call setNPWindowRect from setFrameRect
+         
+        Added folder 'symbian' which contains implementation files for S60
+        platform-specific NPAPI plugin functionality, under /plugins folder
+        * plugins/symbian
+        * plugins/symbian/npinterface.h:
+        Plugin Interface to be implemented by S60 NPAPI plugins 
+        * plugins/symbian/PluginContainerSymbian.h:
+        * plugins/symbian/PluginContainerSymbian.cpp:
+        * plugins/symbian/PluginDatabaseSymbian.cpp:
+        * plugins/symbian/PluginViewSymbian.cpp:
+        * plugins/symbian/PluginPackageSymbian.cpp:
+
+2009-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        More changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Round non-integer line height values.
+
+        Change webkit to rounding non-integer line height values
+        instead of truncating them. This fixes a layout test
+        failure on Windows and matches the calculation in IE and Firefox. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=24434
+
+        Test: fast/css/line-height-rounding.html
+              fast/forms/textarea-scrollbar-height.htm
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-10-13  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Removes the persistent setting for InspectorTimelineAgent and renames timeline related
+        interfaces to be more consistent with the JavaScript profiler.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::startTimelineProfiler):
+        (WebCore::InspectorBackend::stopTimelineProfiler):
+        (WebCore::InspectorBackend::timelineProfilerEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::timelineProfilerEnabled):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineProfilerWasStarted):
+        (WebCore::InspectorFrontend::timelineProfilerWasStopped):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/TimelineAgent.js:
+        (WebInspector.timelineProfilerWasStarted):
+        (WebInspector.timelineProfilerWasStopped):
+
+2009-10-01  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix crash when loading invalid image data
+        https://bugs.webkit.org/show_bug.cgi?id=29980
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setImageSizeForAltText):
+
+2009-10-09  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for NULL ptr deref in canvas's toDataURL().
+        https://bugs.webkit.org/show_bug.cgi?id=30254
+
+        Test: fast/canvas/canvas-toDataURL-crash.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed, reverting r49558 since it broke profiler tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        ImageDecoderQt: Minor tweaks to the decoder
+
+        - Only cache the data when we start to use it.
+        - Start with a repetition count of none for normal images.
+        - Do not use canRead as this will trigger parsing of the full image
+        - Cope with a GIF failing to decode the first frame, do not
+          set m_failed to true if decoding the first frame failed
+        - Inform the QImageReader about the format that was detected
+        - Always create a ImageDecoderQt when when we have more
+        than four byte.
+
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create): Always create QImageReader for a significant speed up
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialize m_repetitionCount to cAnimationNone
+        (WebCore::ImageDecoderQt::setData): Only call ImageDecoder::setData when everything has been received
+        (WebCore::ImageDecoderQt::isSizeAvailable): Do not check m_failed twice.
+        (WebCore::ImageDecoderQt::filenameExtension): Convert from QByteArray to String
+        (WebCore::ImageDecoderQt::frameBufferAtIndex): Check for m_failed before trying to decode
+        (WebCore::ImageDecoderQt::internalDecodeSize): Fail if the size is QSize()
+        (WebCore::ImageDecoderQt::forceLoadEverything): Handle the case were decoding the first frame fails
+        * platform/graphics/qt/ImageDecoderQt.h: Change the m_format type
+
+2009-10-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Migrate profiles to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30328
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getProfileHeaders):
+        (WebCore::InspectorBackend::getProfile):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::getProfileHeaders):
+        (WebCore::InspectorController::getProfile):
+        (WebCore::InspectorController::createProfileHeader):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addProfileHeader):
+        (WebCore::InspectorFrontend::didGetProfileHeaders):
+        (WebCore::InspectorFrontend::didGetProfile):
+        * inspector/InspectorFrontend.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.profileCallback):
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype._mouseDownInDataGrid):
+        (WebInspector.ProfileView.prototype._assignParentsInProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfileHeader):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addProfileHeader):
+
+2009-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Don't collect call frame properties until they're needed for completion.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30334
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions): if call frame id is specified and the expression is empty collect frame properties.
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain): don't send call frame properties until they're needed.
+        * inspector/front-end/ScriptsPanel.js:
+
+2009-10-13  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29106
+        [Qt] make CachedResourceHandle.h compile in winscw Symbian compiler.
+
+        Don't inline constructor CachedResourceHandle<T>(R*) to stop winscw
+        compiler aggressively resolve inheritance of class R.  
+        
+        The winscw compiler bug is reported at:
+        https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+        
+        The change should be reverted when the above bug is fixed in winscw compiler.
+
+        * loader/CachedResourceHandle.h:
+        (WebCore::::CachedResourceHandle):
+
+2009-10-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49554, because it broke Win and Chromium builds.
+        http://trac.webkit.org/changeset/49554
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Stringify CSS units manually (without printf) to make the formatting
+        locale-insensitive and obey CSS spec with respect to large values.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::appendCSSDouble):
+        (WebCore::formatWithUnits):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by David Levin.
+
+        Make grippy lines vertical on horizontal scrollbars in Linux Chrome.
+        While we're rebaselining scrollbars, fix an off by one in the vertical
+        scrollbar rendering too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30319
+
+        Tests: this is covered by every pixel test involving scrollbars.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+
+2009-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix issue where clientX and clientY on MouseEvents were wrong when
+        the page was zoomed and scrolled.
+
+        Test: fast/events/clientXY-in-zoom-and-scroll.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX): Take page zoom into account.
+        (WebCore::contentsY): Ditto.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some of the user stylesheet/script functions.  Split the removal functions
+        out into separate ones for scripts and stylesheets.
+
+        * WebCore.base.exp:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScriptToWorld):
+        (WebCore::PageGroup::addUserStyleSheetToWorld):
+        (WebCore::PageGroup::removeUserScriptFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetFromWorld):
+        (WebCore::PageGroup::removeUserScriptsFromWorld):
+        (WebCore::PageGroup::removeUserStyleSheetsFromWorld):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        (WebCore::PageGroup::userStyleSheets):
+
+2009-10-13  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Chrome's "Skia" theme paints select controls backwards in RTL.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30320
+
+        Test: fast/text/international/bidi-menulist.html
+        (The test is about something else, but it includes RTL selects.)
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMenuList): flip the arrow position in RTL case.
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30318
+        ScriptExecutionContext is not anymore needed to create an EventListener - remove old code.
+        It's a followup to r48884. It removed the need to pass the ScritpExecutionContext
+        into EventListener constructor but did not remove the code pulling ScriptExecutionContext.
+
+        Tests:
+        Test adds event listener to a DocumentType Node which is created without a document
+        and then dispatches the event after attaching a node to the tree. Event
+        should fire when node is attached to the tree.
+
+        * fast/events/add-event-without-document-expected.txt: Added.
+        * fast/events/add-event-without-document.html: Added.
+
+        All changes in files below are the same - remove the code that calls
+        EventTarget::scriptExecutionContext and checks it for NULL.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        Cleaned up bitrot in SharedWorker V8 bindings.
+
+        * WebCore.gypi:
+        Removed default implementation of SharedWorkerRepository so Chromium can provide its own.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        Added V8SharedWorkerContext.cpp.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        Added case statements for SHAREDWORKER and SHAREDWORKERCONTEXT.
+        * bindings/v8/V8Index.cpp:
+        Now includes V8SharedWorkerContext.h to allow supporting SharedWorkers.
+        * bindings/v8/V8Index.h:
+        Added definition for SHAREDWORKERCONTEXT wrapper.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        Added includes for SharedWorker.h and SharedWorkerContext.h.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Reorganized Worker field indexes to be clearer, and fixed mismatch in worker field index.
+        Also added field indexes for SharedWorkers.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_RUNTIME_ENABLER):
+        Added runtime enabler for the SharedWorker constructor.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Cleaned up bitrot (various APIs have changed since this file was written).
+        * page/DOMWindow.idl:
+        Added EnabledAtRuntime flag to window.SharedWorker.
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30345
+        HTTP tests for credential handling fail on Tiger
+
+        We cannot prevent NSURLConnection from doing its credentil handling on Tiger anyway; so
+        let it do its work without intervention. Once again, we pass explicitly passed credentials
+        in URL, fixing regressions from Safari 3.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+
+2009-10-13  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Adam Barth.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Reworked and added to the getter/setter interface in ChromiumDataObject:
+        - added contains...() methods to just query the state
+        - added containsValid...URL() methods for URL data members
+        - removed takeFileNames() as this was too type-dependent
+        - changed return type of fileNames() to Vector<String>
+        - added interface methods to allow appending to and iteration over file names
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::containsMainURL):
+        (WebCore::ChromiumDataObject::containsValidMainURL):
+        (WebCore::ChromiumDataObject::containsMainURLTitle):
+        (WebCore::ChromiumDataObject::containsTextPlain):
+        (WebCore::ChromiumDataObject::containsTextHTML):
+        (WebCore::ChromiumDataObject::containsHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsValidHTMLBaseURL):
+        (WebCore::ChromiumDataObject::containsContent):
+        (WebCore::ChromiumDataObject::containsContentFileExtension):
+        (WebCore::ChromiumDataObject::containsContentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::containsFileNames):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::clearFileNames):
+        (WebCore::ChromiumDataObject::countFileNames):
+        (WebCore::ChromiumDataObject::fileNameAt):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::appendToFileNames):
+        (WebCore::ChromiumDataObject::popFileName):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Temporary debugging changes to figure out why the webgl tests are crashing on the build bot.
+
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+
+2009-10-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Visibility:visible inside a compositing layer doesn't make the element visible
+        https://bugs.webkit.org/show_bug.cgi?id=30339
+        
+        When deciding if a layer had any renderable content, RenderLayerBacking::paintIntoLayer()
+        only consulted hasVisibleContent(), which does not take into a account child layers which
+        may be visible. We also have to consult hasVisibleDescendant() as well.
+
+        Test: compositing/compositing-visible-descendant.html
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasVisibleDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-10-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH
+        https://bugs.webkit.org/show_bug.cgi?id=30278
+
+        Move the definition of ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 
+        from the make system into common code.
+
+        Enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH if NETSCAPE_PLUGIN_API 
+        support is not enabled.
+
+        Remove notImplemented() from PluginPackageNone.cpp and 
+        PluginDataNone.cpp make them just empty functions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginDataNone.cpp:
+        (WebCore::PluginData::initPlugins):
+        (WebCore::PluginData::refresh):
+        * plugins/PluginPackageNone.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2009-10-13  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30150
+        <rdar://problem/7283540> REGRESSION: Crash when accessing clipboardData.types
+
+        Test: editing/pasteboard/crash-accessing-clipboardData-types.html
+
+        * platform/mac/ClipboardMac.mm: (WebCore::addHTMLClipboardTypesForCocoaType): The String
+        class doesn't have operator bool, it's operator NSString* that is invoked instead, and it
+        converts null strings to non-null @"".
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by Dimitri Glazkov.
+
+        window attributes (like localStorage) that are disabled at runtime are still visible
+        https://bugs.webkit.org/show_bug.cgi?id=30240
+
+        Adding codegen/bindings to support runtime disabling of attributes.
+
+        No new tests (only supported by chrome currently)
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Refactored the guts of GenerateBatchedAttributeData into a separate GenerateSingleBatchedAttribute with a passed-in indentation level to allow generating a single BatchedAttribute struct.
+        Added support for the EnabledAtRuntime extended attribute, which generates a call to the appropriate XXXXEnabled() API before adding the attribute to the instance.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureAttributes):
+        Refactored attribute setting code into a common inline routine.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::configureAttribute):
+        Inline function which configures a single attribute given a BatchedAttribute struct.
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added (DECLARE_)ACCESSOR_RUNTIME_ENABLER to allow enabling attributes at runtime.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        Added code to enable window.Audio only if MediaPlayer.isAvailable() == true
+        * page/DOMWindow.idl:
+        Added [EnabledAtRuntime] extended attribute to the Audio attribute.
+
+2009-10-13  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27457
+        Added support for static validation on type=email input elements as per
+        HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#e-mail-state
+
+        Test: fast/forms/ValidityState-typeMismatch-email.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch): ValidityState.typeMismatch
+        performs validation on type=email input elements now.
+        (WebCore::ValidityState::isValidEmailAddress): simple validation method 
+        * html/ValidityState.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Event listeners installed on a window object returned from window.open() don't work
+        https://bugs.webkit.org/show_bug.cgi?id=28716
+
+        Tests: http/tests/security/window-events-clear-domain.html
+               http/tests/security/window-events-clear-port.html
+               http/tests/security/window-events-pass.html
+
+        * dom/Document.cpp: Split code of Document::clear() in a way to avoid removing all
+        window event handlers when implicitOpen is called. It is called in 2 cases - on
+        committing loaded content (no need to clean handlers) and on document.open() (needs to remove handlers).
+
+        (WebCore::Document::open): in addition to calling implicitOpen it also removes window
+        event handlers, to preserve the behavior of document.open().
+
+        (WebCore::Document::implicitOpen): includes the part of removed Document::clear() that
+        does not remove window event handlers.
+
+        * dom/Document.h: Removed clear().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): add check to avoid removing window event handlers
+        if we transition from temporary empty document to a loaded one.
+
+        (WebCore::FrameLoader::didOpenURL): Remove closeURL() which was called twice when loading.
+        (WebCore::FrameLoader::finishedLoadingDocument): add closeURL() to compensate for change above.
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix a leak in the inspector by calling didRemoveNode with
+        an error code when it fails, instead of returning from the
+        Backend.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30337>.
+        Web Inspector: Should be able to delete nodes from the Elements Tree.
+        
+        When the delete key is pressed and a element is selected in the tree,
+        the element should be deleted from the Elements Tree and the DOM.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::removeNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didRemoveNode):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.handleKeyEvent):
+
+2009-10-13  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix REGRESSION(49479): Mouseover on resources graph doesn't show timings.
+        
+        Set pointer-events: none on the new overlay so mouseover events are passed
+        to the resources graph so we can show timings.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+       https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepthPerComponent):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-10-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build system fix. Typo in a filename.
+
+        * GNUmakefile.am:
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+        Alter profile link format to enable multiple profile types
+        https://bugs.webkit.org/show_bug.cgi?id=30253
+
+        The new profile URL includes the profile type along with the
+        profile title and uid.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.linkifyStringAsFragment):
+
+2009-10-12  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix same-named profiles grouping in the Profiles panel.
+
+        The tree node re-parenting while adding a new group node was broken.
+         
+        https://bugs.webkit.org/show_bug.cgi?id=30299
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Enforce async interaction between inspector controller and frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30300
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch.delayDispatch):
+        (WebInspector.dispatch):
+
+2009-10-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix issue caretRangeFromPoint() returns wrong result for a zoomed and 
+        scrolled page.
+        https://bugs.webkit.org/show_bug.cgi?id=30034
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+        (WebCore::Document::caretRangeFromPoint): calculate the correct point 
+        relative to document when the page is zoomed and scrolled.
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        JavaScript bindings of WebSocket addEventListener/removeEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        Test: fast/websockets/websocket-event-target.html
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocket::addEventListener):
+        (WebCore::JSWebSocket::removeEventListener):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * websockets/WebSocket.idl:
+
+2009-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29078
+        <rdar://problem/7288221>
+
+        Add a mechanism to blacklist certain codecs.  Initially, just blacklist UTF-7 as HTML5 encourages.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::pruneBlacklistedCodecs):
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-10-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for the beforeload event to frames.  Complete support of the beforeload event by making sure
+        its wrapper gets properly constructed (so that the URL field of the event can be accessed).  Add support
+        for the Objective-C wrapper class as well.
+
+        Added fast/dom/beforeload/frame-before-load.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/objc/DOMEvents.mm:
+        (kitClass):
+        * dom/BeforeLoadEvent.h:
+        (WebCore::BeforeLoadEvent::isBeforeLoadEvent):
+        * dom/Event.cpp:
+        (WebCore::Event::isBeforeLoadEvent):
+        * dom/Event.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-10-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix <rdar://problem/7094146> Reproducible crash at
+        RenderObject::localToAbsolute()
+
+        Test: fast/dynamic/position-absolute-to-fixed-crash.html
+
+        The crash was caused by stale positioned objects lists following an
+        object transitioning from being absolutely position to being fixed
+        positioned.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): In case of a transition between
+        absolute and fixed position, mark the parent as having a child needing
+        layout, so that this object will get inserted into its new container's
+        positioned objects list.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange): Changed a condition to cover
+        this transition, so that this object gets removed from its current
+        container's positioned objects list.
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add a palette() method that is needed by our RenderTheme.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Gradients can't handle percentage values in userSpaceOnUse mode
+        [https://bugs.webkit.org/show_bug.cgi?id=30286]
+
+        Fixed *GradientAttributes to take SVGLength instead of double. This casues
+        the problem, that we can't calculate the correct size of a gradient on
+        userSpaceOnUse mode with percentage values.
+
+        Test: svg/custom/gradient-userSpaceOnUse-with-percentage.svg
+
+        * svg/LinearGradientAttributes.h:
+        (WebCore::LinearGradientAttributes::LinearGradientAttributes):
+        (WebCore::LinearGradientAttributes::x1):
+        (WebCore::LinearGradientAttributes::y1):
+        (WebCore::LinearGradientAttributes::x2):
+        (WebCore::LinearGradientAttributes::y2):
+        (WebCore::LinearGradientAttributes::setX1):
+        (WebCore::LinearGradientAttributes::setY1):
+        (WebCore::LinearGradientAttributes::setX2):
+        (WebCore::LinearGradientAttributes::setY2):
+        * svg/RadialGradientAttributes.h:
+        (WebCore::RadialGradientAttributes::RadialGradientAttributes):
+        (WebCore::RadialGradientAttributes::cx):
+        (WebCore::RadialGradientAttributes::cy):
+        (WebCore::RadialGradientAttributes::r):
+        (WebCore::RadialGradientAttributes::fx):
+        (WebCore::RadialGradientAttributes::fy):
+        (WebCore::RadialGradientAttributes::setCx):
+        (WebCore::RadialGradientAttributes::setCy):
+        (WebCore::RadialGradientAttributes::setR):
+        (WebCore::RadialGradientAttributes::setFx):
+        (WebCore::RadialGradientAttributes::setFy):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+
+2009-10-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30315>.
+        Web Inspector: DOM Content and Load lines in Resources are unclear what they mean.
+        
+        Add tooltip text to the Load event and DOM Content event lines through
+        a new layer that allows these lines to be on top of the view.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        * inspector/front-end/inspector.css:
+
+2009-10-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r49429, because it broke layout tests.
+        http://trac.webkit.org/changeset/49429
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG - crash on feMerge when input not available
+        [https://bugs.webkit.org/show_bug.cgi?id=30297]
+
+        Make a early return in SVGFEMergeElement if the needed
+        filter effect doesn't exist.
+
+        Test: svg/filters/feMerge-wrong-input.svg
+
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::build):
+
+2009-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added automatic flush before compositing
+        https://bugs.webkit.org/show_bug.cgi?id=30236
+
+        This causes image to always render correctly. In writing a testcase
+        I needed to implement readPixels. This exposed a bug in reading back
+        values from a CanvasArray subclass, so I fixed that as well. Now when
+        you wrap a CanvasArray in a JSValue it actually wraps the specific
+        subclass. To do this I need to add virtual methods to each CanvasArray
+        subclass to determine the type and a custom toJS method for CanvasArray
+        to create the proper wrapper. 
+
+        Test: fast/canvas/webgl/triangle.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayCustom.cpp:
+        (WebCore::toJS):
+        * html/canvas/CanvasArray.h:
+        (WebCore::CanvasArray::isByteArray):
+        (WebCore::CanvasArray::isUnsignedByteArray):
+        (WebCore::CanvasArray::isShortArray):
+        (WebCore::CanvasArray::isUnsignedShortArray):
+        (WebCore::CanvasArray::isIntArray):
+        (WebCore::CanvasArray::isUnsignedIntArray):
+        (WebCore::CanvasArray::isFloatArray):
+        * html/canvas/CanvasArray.idl:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::isByteArray):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::isFloatArray):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::isIntArray):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::readPixels):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::isShortArray):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::isUnsignedByteArray):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::isUnsignedIntArray):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::isUnsignedShortArray):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/Canvas3DLayer.mm:
+        (-[Canvas3DLayer drawInCGLContext:pixelFormat:forLayerTime:displayTime:]):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::readPixels):
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30307
+        
+        Fix 0 sentinel for g_object_set() function call.
+
+        * platform/graphics/gtk/DataSourceGStreamer.cpp:
+        (webkit_data_src_uri_set_uri):
+        0 is passed as 32 bit value on x86-64 in vararg functions, but
+        g_object_set() expects a 64 bit 0. This will cause crashes.
+
+2009-10-12  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop in="" from <feFlood>
+        https://bugs.webkit.org/show_bug.cgi?id=29001
+
+        This makes <feFlood in="bogus"> have an effect, too.
+
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#feflood-attribute
+
+        Test: svg/dom/feFlood-no-in1.html
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29998
+        
+        Scale video to completely fill the target surface while
+        keeping the aspect ratio. This fixes displaying of the
+        YouTube HTML5 sample website.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Scale video to completely fill the target surface, keep
+        the aspect ratio and center it.
+
+2009-10-12  Sebastian Dröge  <sebastian.droege@collabora.co.uk>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29997
+        
+        Fixes double memcpy of all rendered video frames.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::duration):
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (marshal_VOID__MINIOBJECT):
+        (webkit_video_sink_class_init):
+        (webkit_video_sink_new):
+        * platform/graphics/gtk/VideoSinkGStreamer.h:
+        Directly pass the buffers up to the MediaPlayerPrivate::paint()
+        method instead of rendering them first to an intermediate cairo
+        surface. This should increase performance and peak memory usage.
+
+2009-10-11  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30242
+        
+        Fixes an issue where JavaScript URLs that are URL-encoded twice can 
+        bypass the XSSAuditor.
+        
+        JavaScript URLs that are completed by method Document::completeURL have added
+        URL-encoded characters such that a direct comparison with the URL-decoded 
+        outgoing HTTP parameters is not sufficient. Instead, the URL-decoded outgoing 
+        HTTP parameters must be URL-decoded before comparison.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode2.html
+               http/tests/security/xssAuditor/iframe-javascript-url-twice-url-encode3.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL): Modified to pass XSSAuditor
+        the URL-decoded source code for the JavaScript URL.
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Minor syntactical change to the comment.
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::canonicalizeURL): Added 
+        parameter decodeURLEscapeSequencesTwice.
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::decodeURL): Ditto.
+        (WebCore::XSSAuditor::findInRequest): Ditto.
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer): Ditto.
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Fixes a build break in the V8 bindings caused by revision 49420.
+        https://bugs.webkit.org/show_bug.cgi?id=30294
+
+        Revision 49420 introduces an IDL-defined CanvasActiveInfo
+        type. This causes a build break in the V8 bindings where
+        CanvasGraphicsContext3D naively refers to CanvasActiveInfo as a
+        non-ref type.
+
+        * WebCore.gypi: Include CanvasActiveInfo.idl in build.
+        * bindings/scripts/CodeGeneratorV8.pm: CanvasActiveInfo is a ref
+          ptr type.
+        * bindings/v8/DOMObjectsInclude.h: Include generated
+          CanvasActiveInfo files.
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-10-11  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Log mixed content warnings to console
+
+        https://bugs.webkit.org/show_bug.cgi?id=30290
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+
+2009-10-11  Søren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Add a context scope in JS listener destructor. The destructor code uses the cotext. See http://crbug.com/24200.
+        https://bugs.webkit.org/show_bug.cgi?id=30250
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-11  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct the position of #endif sentence inside WebCore::Document::finishedParsing().
+
+        https://bugs.webkit.org/show_bug.cgi?id=30244
+
+        This change requires no test case as it fix a compiling error.
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+
+2009-10-11  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Adam Barth.
+
+        Sets a 500K stack limit for JavaScript workers in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29797
+
+        Runaway recursion in JavaScript workers crashes the Chromium
+        worker process on OS X. This is because V8's default stack limit
+        is 512K on ia32 or 1M on x64, but the worker process runs workers
+        on a thread with the OS X default stack size--512K. Because there
+        are already some C+frames on the stack when V8 establishes its
+        512K default stack limit, and V8 doesn't precisely enforce the
+        stack limit, runaway recursion in V8 workers overflows the OS
+        stack and segfaults, killing the worker process. This is described
+        in Chromium bug 21653 <http://crbug.com/21653>.
+
+        This patch sets the V8 stack limit for worker JavaScript in
+        Chromium to a more conservative 500K on all platforms. This allows
+        some "headroom" for the C+stack in use when the limit is set up,
+        and some "legroom" for the V8 helper functions which in practice
+        briefly flout the V8 stack limit.
+
+        Test: LayoutTests/fast/workers/use-machine-stack.html
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for wxMac 2.9, use wxGC API for measuring text.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2009-10-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Sam Weinig.
+
+        Allow [Reflect] on SVG elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28936
+
+        Update the JS binding generators to reference SVGNames instead of
+        HTMLNames, if [Reflect]ing an attribute on an SVG element.  Make
+        SVGElement::id use [Reflect].
+
+        Also make [Reflect] on an attribute with a setter exception work in ObjC
+        bindings.
+
+        Test: svg/dom/id-reflect.html
+
+        * bindings/scripts/CodeGenerator.pm: Add a function to determine the
+        appropriate C+namespace for attribute name constants.
+        * bindings/scripts/CodeGeneratorObjC.pm: Generate ExceptionCode handling
+        code for [Reflect] on an attribute with a setter exception.
+        * bindings/scripts/CodeGeneratorCOM.pm: Generate "SVGNames" instead of
+        "HTMLNames" when appropriate.
+        * bindings/scripts/CodeGeneratorJS.pm: Ditto.
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        * svg/SVGElement.cpp: Remove getter and setter methods for id.
+        * svg/SVGElement.h: Ditto.
+        * svg/SVGElement.idl: Add [Reflect] to id.
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Fix paths in xcode.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Implement getActiveAttrib and getActiveUniform
+        https://bugs.webkit.org/show_bug.cgi?id=30276
+
+        Implements the getActiveAttrib and getActiveUniform APIs.
+        Rather simple patch, adds CanvasActiveInfo definition and implementation
+        and adds forwarding to the GraphicsContext3D.
+
+        Test: fast/canvas/webgl/getActiveTest.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/CanvasActiveInfo.h: Added.
+        (WebCore::CanvasActiveInfo::create):
+        (WebCore::CanvasActiveInfo::name):
+        (WebCore::CanvasActiveInfo::type):
+        (WebCore::CanvasActiveInfo::size):
+        (WebCore::CanvasActiveInfo::CanvasActiveInfo):
+        * html/canvas/CanvasActiveInfo.idl: Added.
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+          Need to make the context public as it is needed to ensure we don't
+          provide a program from one context as an argument to another.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::getActiveAttrib):
+        (WebCore::CanvasRenderingContext3D::getActiveUniform):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+
+2009-10-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Adding new attributes in Element Panel is
+        counterintuitive.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30057
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove):
+        (WebInspector.ElementsTreeElement.prototype.set hovered):
+        (WebInspector.ElementsTreeElement.prototype.toggleNewAttributeButton):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Build fix if Netscape plugin support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=30275
+
+        In addition to fixing the build break with guards
+        remove notImplemented() from PluginViewNone.cpp and
+        make them just just be empty functions.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed.
+
+        [Qt] Build fix for QtWebKit after r49415.
+
+        Add HistoryController.cpp to the build.
+
+        * WebCore.pro:
+
+2009-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] KURLGoogle's protocolIs barfs on input containing hyphens
+        https://bugs.webkit.org/show_bug.cgi?id=30262
+
+        This is not testable from WebKit since WebKit never uses the member
+        function form of protocolIs with input that can be controlled from a
+        web page.  It always passes string literals lacking hyphens.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::lowerCaseEqualsASCII): Only assert if toASCIILower would
+        transform the input character.
+
+2009-10-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move HistoryController to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=30272
+
+        Purely mechanical.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/HistoryController.cpp: Added.
+        * loader/HistoryController.h: Added.
+
+2009-10-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ApplyStyleCommand removes presentational tags even when not necessary
+        https://bugs.webkit.org/show_bug.cgi?id=28091
+
+        This patch updates implicitlyStyledElementShouldBeRemovedWhenApplyingStyle to return true
+        (triggering removal of tag) only if the style implicitly added by the element is not present in
+        the new style to apply. It also changes surroundNodeRangeWithElement so that it merges the
+        surrounding element when possible. applyTextDecorationStyle is modified so that it does not add
+        style span when the style attribute is empty.
+
+        Test: editing/execCommand/toggle-style-3.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::shouldRemoveTextDecorationTag): Returns true if specified text
+        decoration is not present in the style to apply
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle): No longer
+        returns true if the tag is used in new style
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle): Does not add style-span when redundant
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement): Merges the newly created element
+        with the surrounding identical elements
+        * editing/ApplyStyleCommand.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        HistoryController is in charge of managing the current / previous /
+        provisional HistoryItems.  The split isn't perfect, but it's a place to
+        start.  I'll move HistoryController into its own file in another patch.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::HistoryController::HistoryController):
+        (WebCore::HistoryController::~HistoryController):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::begin):
+        (WebCore::HistoryController::restoreDocumentState):
+        (WebCore::HistoryController::setCurrentItem):
+        (WebCore::HistoryController::setProvisionalItem):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::scrollToAnchor):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::didFirstLayout):
+        (WebCore::HistoryController::updateForFrameLoadCompleted):
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::receivedMainResourceError):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::HistoryController::addHistoryItemForFragmentScroll):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        (WebCore::FrameLoader::shouldTreatURLAsSameAsCurrent):
+        (WebCore::HistoryController::createHistoryItem):
+        (WebCore::FrameLoader::checkDidPerformFirstNavigation):
+        (WebCore::HistoryController::addBackForwardItemClippedAtTarget):
+        (WebCore::HistoryController::createHistoryItemTree):
+        (WebCore::HistoryController::saveScrollPositionAndViewStateToItem):
+        (WebCore::HistoryController::restoreScrollPositionAndViewState):
+        (WebCore::HistoryController::invalidateCurrentItemCachedPage):
+        (WebCore::HistoryController::saveDocumentState):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::HistoryController::urlsMatchItem):
+        (WebCore::HistoryController::goToItem):
+        (WebCore::HistoryController::recursiveGoToItem):
+        (WebCore::HistoryController::childFramesMatchItem):
+        (WebCore::HistoryController::updateForStandardLoad):
+        (WebCore::HistoryController::updateForClientRedirect):
+        (WebCore::HistoryController::updateForBackForwardNavigation):
+        (WebCore::HistoryController::updateForReload):
+        (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
+        (WebCore::HistoryController::updateForCommit):
+        (WebCore::HistoryController::updateForAnchorScroll):
+        (WebCore::HistoryController::saveDocumentAndScrollState):
+        (WebCore::HistoryController::setCurrentItemTitle):
+        (WebCore::FrameLoader::didChangeTitle):
+        * loader/FrameLoader.h:
+        (WebCore::HistoryController::current):
+        (WebCore::HistoryController::provisional):
+        (WebCore::FrameLoader::policyChecker):
+        (WebCore::FrameLoader::history):
+        (WebCore::FrameLoader::creatingInitialEmptyDocument):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Unreviewed - fixing an obvious typo in my previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Fixes existing tests (which I thought I had run the previous time).
+
+        * platform/network/CredentialStorage.cpp: (WebCore::originsWithCredentials): Return the
+        set by reference.
+
+2009-10-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [v8] Need change to V8WorkerContextEventListener::reportError signature to match the base class.
+        https://bugs.webkit.org/show_bug.cgi?id=30264
+
+        The base class method changed in r48884.
+
+        Test: fast/worker/worker-script-error.html
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-10-09  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30260
+        <rdar://problem/6447115> REGRESSION: Logging out from SAP doesn't work
+
+        Tests: http/tests/xmlhttprequest/logout.html
+               http/tests/xmlhttprequest/re-login-async.html
+               http/tests/xmlhttprequest/re-login.html
+
+        Fix several issues with existing credential handling code.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::pathToDefaultProtectionSpaceMap): Changed the data structure to a simpler one.
+        (WebCore::originsWithCredentials): The reason for two-stage lookup above was that we didn't
+        want to iterate paths for origins that never had credentials associated with them. Changed
+        to use a separate HashSet for this.
+        (WebCore::pathToDefaultProtectionSpaceMap): The concept of default per-path credentials didn't
+        match the spec very well. UAs are supposed to deduce protection space from an URL, and then
+        use whichever credentials are known for this protection space. So, OriginToDefaultBasicCredentialMap
+        is now PathToDefaultProtectionSpaceMap.
+        (WebCore::protectionSpaceMapKeyFromURL): Factored out a helper that extracts a directory
+        URL from a given URL. These directory URLs are what we use as keys in PathToDefaultProtectionSpaceMap.
+        (WebCore::CredentialStorage::set): Updated for above changes.
+        (WebCore::findDefaultProtectionSpaceForURL): Factored out code iterating path length to find
+        a prefix in OriginToDefaultBasicCredentialMap.
+        (WebCore::CredentialStorage::set): Another version of set() can update credentials for a
+        URL default protection space. It does nothing if the given URL doesn't correspond to a known
+        protection space.
+        (WebCore::CredentialStorage::get): Renamed from getDefaultAuthenticationCredential.
+
+        * platform/network/CredentialStorage.h: Made the distinction between methods that use a known
+        protection space and those that deduce one from URL more clear.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Update credentials before starting the request for real.
+        This makes the following pattern work:
+          var req = new XMLHttpRequest("GET", "logout.html", "logout", "logout"); // wrong credentials
+          req.send("");
+          req.abort();
+        Abort() is used here to avoid having UA present an auth dialog after getting a 401 response.
+        Note that one cannot log in using the same method, because there isn't a known protection
+        space for the URL yet in that case, so the added code has no effect.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Use a correct persistence for
+        calling receivedCredential(). This fixes logging in using an async XHR (withut abort(), of
+        course), and matches sync case.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Renamed getDefaultAuthenticationCredential() to get().
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac code.
+
+2009-10-09  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Undoing a indent removes text instead of it's formatting.
+        <rdar://problem/7169206>
+        https://bugs.webkit.org/show_bug.cgi?id=28722
+        Restored the behavior prior to http://trac.webkit.org/changeset/46143. This change implemented the
+        indent command making simple DOM operation, without using moveParagraph which cause undo to be broken.
+        
+        Added editing/undo/undo-indent.html test.
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion): Restored. 
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Merged changes.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Restored.
+        (WebCore::IndentOutdentCommand::indentRegion): Restored and added call to updateLayout to
+        ensure TextIterator could correctly calculate the position starting from the index.
+        * editing/IndentOutdentCommand.h: Restored.
+
+2009-10-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+        
+        Optimization: Many StringImpl transformations are no-ops and should just return 'this'
+        https://bugs.webkit.org/show_bug.cgi?id=30186
+
+        Optimized StringImpl methods lower(), stripWhiteSpace() and simplifyWhiteSpace() to
+        detect no-ops and return this instead of creating a new instance.
+        Empirical testing shows that the majority of calls to these methods are no-ops, making
+        this worthwhile even if (in the case of lower()) the non-no-op case is slightly slowed.
+        Upper() is very rarely a no-op, so it wasn't worthwhile to optimize it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper): Just add a comment explaining why this wasn't optimized
+        (WebCore::StringImpl::stripWhiteSpace):
+        (WebCore::StringImpl::simplifyWhiteSpace):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feGaussianBlur implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28141]
+
+        This is the implementation of GaussianBlur filter for SVG.
+
+        There is already a test for feGaussianBlur
+        Test: svg/W3C-SVG-1.1/filters-gauss-01-b-w3c.svg 
+
+        Test: svg/filters/feGaussianBlur.svg
+
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isAlphaImage):
+        (WebCore::FilterEffect::setIsAlphaImage):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::boxBlur):
+        (WebCore::FEGaussianBlur::apply):
+
+2009-10-09  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] QoS support in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=29959
+
+        Removed the async buffer queue from the sink. Synchronize the
+        render method of the sink using a g_timeout_add() combined with a
+        gcond triggered when the buffer has been rendered.
+        Also fixed the video sink reference handling in the player, now
+        that the idle is not there anymore to mess up things.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_init):
+        (webkit_video_sink_timeout_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_dispose):
+        (unlock_buffer_mutex):
+        (webkit_video_sink_unlock):
+        (webkit_video_sink_stop):
+        (webkit_video_sink_class_init):
+
+2009-10-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        feMorphology filter is not implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=5863]
+
+        Adds SVGFEMorphologyElement, for the SVG filter. It also fixes a bug
+        with the attribute "operator". It was only accessible via "_operator" 
+        on JavaScript.
+
+        Test: svg/dom/operatorAttribute.xhtml
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.SVG.Filters.exp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEMorphologyElement.cpp: Added.
+        (WebCore::SVGFEMorphologyElement::SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::~SVGFEMorphologyElement):
+        (WebCore::SVGFEMorphologyElement::setRadius):
+        (WebCore::SVGFEMorphologyElement::parseMappedAttribute):
+        (WebCore::SVGFEMorphologyElement::build):
+        * svg/SVGFEMorphologyElement.h: Added.
+        * svg/SVGFEMorphologyElement.idl: Added.
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::operator<<):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::):
+        * svg/svgtags.in:
+
+2009-10-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix Chromium breakage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain): check that Storage panel is present before calling its methods.
+
+2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual methods setInputMethodEnabled and setInputMethodHint to QWebPageClient
+
+        https://bugs.webkit.org/show_bug.cgi?id=30023
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implement beforeload for images.  ImageLoadEventSender has been refactored into a more generic
+        ImageEventSender that can be used by both load and beforeload events.  If the document has any
+        beforeload listeners, then the installation of images onto the renderer becomes asynchronous
+        and will be held up until the beforeload event can fire at a later date.
+
+        Both beforeload and load events now fire at the end of the tokenizer write() methods, so that
+        in the typical parsing case we don't have to put off the beforeload/load events until after
+        a layout or paint might already have happened.  This lets beforeload/load not cause extra
+        layouts and repaints.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageBeforeLoadEventSender::ImageBeforeLoadEventSender):
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender):
+        (WebCore::beforeLoadEventSender):
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):
+        (WebCore::ImageLoader::dispatchPendingEvents):
+        (WebCore::ImageEventSender::ImageEventSender):
+        (WebCore::ImageEventSender::dispatchEventSoon):
+        (WebCore::ImageEventSender::cancelEvent):
+        (WebCore::ImageEventSender::dispatchPendingEvents):
+        (WebCore::ImageEventSender::timerFired):
+        * loader/ImageLoader.h:
+        (WebCore::ImageLoader::haveFiredBeforeLoadEvent):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::attach):
+
+2009-10-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Web Inspector: Wrap Database into ScriptObject in v8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30174
+
+        No tests due to no Script* test infrastructure.
+
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Fix crash when using QWebPage without QWebView.
+        
+        'client' is 0 when we have no view.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30251
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Add missing setCurrentPlugin(0)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30248
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+
+2009-10-09  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] beforeload event does not fire on script elements in XML
+        https://bugs.webkit.org/show_bug.cgi?id=30235
+
+        r49194 was lacking a change to XMLTokenizerQt.cpp, equivalent to the one
+        made in XMLTokenizerLibxml2.cpp.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-10-09  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's CSSParserValueList
+        https://bugs.webkit.org/show_bug.cgi?id=30249
+
+        Inherits CSSParserValueList class from FastAllocBase because it has 
+        been instantiated by 'new' in WebCore/css/CSSGrammar.y:1271.
+
+        * css/CSSParserValues.h:
+
+2009-10-09  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins : Create Pixmap only when size changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30214
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        This fixes a leak of WebPluginHalterClients:
+        https://bugs.webkit.org/show_bug.cgi?id=30119.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCore.base.exp:
+        Removed the export of WebCore::Settings::setPluginHalterEnabled().
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyPluginHalterClient::enabled):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Remove initialization of m_pluginHalterClient, which was removed. If a
+        non-null PluginHalterClient was passed, create the PluginHalter, and
+        set its allowed run time.
+
+        * page/Page.h:
+        Removed pluginHalterEnabledStateChanged() and m_pluginHalterClient.
+
+        * page/PluginHalter.cpp:
+        (WebCore::PluginHalter::didStartPlugin):
+        Check whether the PluginHalterClient is enabled.
+        (WebCore::PluginHalter::didStopPlugin):
+        Ditto.
+
+        * page/PluginHalter.h:
+        Made m_client an OwnPtr.
+
+        * page/PluginHalterClient.h:
+        Added a function to return the enabled state.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        Remove initialization of removed member.
+
+        * page/Settings.h:
+        Removed settings for the enabled state of the PluginHalter; we now use
+        the existence of a WebPluginHalterDelegate to determine whether the
+        PluginHalter is enabled.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        These methods have virtually no interaction with FrameLoader.  They
+        really seem like they ought to belong to ScriptController.
+
+        * WebCore.base.exp:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::executeScript):
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/v8/ScriptController.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptExecution):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::replaceDocument):
+        * loader/FrameLoader.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: added missing #include.
+
+        * ForwardingHeaders/runtime/StructureChain.h: Copied from WebCore/ForwardingHeaders/runtime/PropertyNameArray.h.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30237>.
+        DOM Content and Load lines aren't shown if a page is loaded when the inspector is up.
+        
+        Make sure to call update script object if we have an InspectorFrontend to
+        call it on when we get one of the new events.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+
+2009-10-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: updated for removal of Structure::markAggregate().
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::markChildren):
+
+2009-10-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make AtomicString create its StringImpl via create(), not the constructor,
+        so it gets allocated in a single heap block, saving memory and CPU cycles.
+        This eliminates two StringImpl constructors, making the remaining ones
+        unambiguous, so the "AdoptBuffer" parameter is no longer needed.
+        Added const attribute to UChar* in StringImpl constructor, eliminating the
+        need for several const_casts in calls to it.
+        StringImpl also unfriends AtomicString (OMG drama!!!)
+        https://bugs.webkit.org/show_bug.cgi?id=30141
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::CStringTranslator::translate): Call StringImpl::create().
+        (WebCore::UCharBufferTranslator::translate): Ditto.
+        (WebCore::HashAndCharactersTranslator::translate): Ditto.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Remove unnecessary AdoptBuffer param.
+        (WebCore::StringImpl::adopt): Ditto.
+        (WebCore::StringImpl::createUninitialized): Ditto.
+        (WebCore::StringImpl::create): Ditto.
+        (WebCore::StringImpl::crossThreadString): Ditto.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::setHash): Used by AtomicString when creating StringImpls.
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL frame loader client function.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        SVGURIReference Build problem for V8.  An additional stale reference to SVGURIReference bindings
+        which wasn't exposed until a clean build.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * bindings/v8/V8Index.cpp:
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-08  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        unselectable resources in resource panel
+        https://bugs.webkit.org/show_bug.cgi?id=30079
+
+        manual test added
+        
+        Also changed the way DnD for resources in the Resources panel is 
+        handled.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.onattach):
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondragstart):
+        * manual-tests/inspector/duplicate-resource-urls.html: Added.
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30233>
+        Local Storage and Cookies show Blank Titles on Local Files.
+
+        If a local storage or cookies sidebar item has no domain, set the 
+        title to "Local Files", because that is what it represents.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+
+2009-10-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix failing media layout tests.  Don't make beforeload block loads of objects that aren't in the
+        document, since video/audio (and images eventually too) can load when not in the document yet.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGFitToViewBox ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30230
+
+        This patch also devirtualizes viewBoxToViewTransform(), is it's superflous.
+        viewBoxToViewTransform() is now a simple static heper function in SVGFitToViewBox.
+        As a result, the SVGSVGElement::viewBoxToViewTransform() function now resuses the same logic.
+
+        As side-effect this patch fixes svg/custom/linking-a-03-b-transform.svg, the return
+        statement in SVGSVGElement::viewBoxToViewTransform() was clearly wrong.
+
+        * svg/SVGFitToViewBox.cpp:
+        (WebCore::SVGFitToViewBox::SVGFitToViewBox):
+        (WebCore::SVGFitToViewBox::viewBoxToViewTransform):
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::viewBoxToViewTransform):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/SVGPatternElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::viewBoxToViewTransform):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+        * svg/SVGViewSpec.cpp:
+        (WebCore::SVGViewSpec::SVGViewSpec):
+        * svg/SVGViewSpec.h:
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Correct a typo that fixes the resizing of columns in Cookie view when you
+        resize the Inspector window.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-10-08  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=29811>
+        Text in Inspector's Styles gear menu is invisible.
+        
+        Adds a style rule for the option text and hr's in the gear menu,
+        to prevent them from being transparent.
+
+        * inspector/front-end/inspector.css:
+
+2009-10-08  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        Fix build problem with SVGURIReference in V8.
+        https://bugs.webkit.org/show_bug.cgi?id=30217
+
+        No new tests, just a build fix.
+
+        * WebCore.gypi:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Make beforeload work on <video>/<audio> elements.
+
+        Added fast/dom/beforeload/video-before-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+        (WebCore::HTMLMediaElement::selectMediaResource):
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        Move SVGExternalResourcesRequired ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30218
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::SVGAnimationElement):
+        * svg/SVGAnimationElement.h:
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::SVGCircleElement):
+        * svg/SVGCircleElement.h:
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::SVGClipPathElement):
+        * svg/SVGClipPathElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGDefsElement.cpp:
+        (WebCore::SVGDefsElement::SVGDefsElement):
+        * svg/SVGDefsElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::SVGEllipseElement):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGExternalResourcesRequired.cpp:
+        (WebCore::SVGExternalResourcesRequired::SVGExternalResourcesRequired):
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGFontElement.cpp:
+        (WebCore::SVGFontElement::SVGFontElement):
+        * svg/SVGFontElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::SVGGElement):
+        * svg/SVGGElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::SVGLineElement):
+        * svg/SVGLineElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::SVGPathElement):
+        * svg/SVGPathElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::SVGPolyElement):
+        * svg/SVGPolyElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::SVGRectElement):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        * svg/SVGSVGElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGSwitchElement.cpp:
+        (WebCore::SVGSwitchElement::SVGSwitchElement):
+        * svg/SVGSwitchElement.h:
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::SVGSymbolElement):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::SVGTextContentElement):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+        * svg/SVGViewElement.cpp:
+        (WebCore::SVGViewElement::SVGViewElement):
+        * svg/SVGViewElement.h:
+
 2009-10-08  Dirk Schulze  <krit@webkit.org>
 
         Reviewed by Darin Adler.
@@ -137,7 +8887,7 @@
 
 2009-10-07  Xan Lopez  <xlopez@igalia.com>
 
-        Fix more breakage in the GTK+ build.
+        Fix more breakage in the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -583,7 +9333,7 @@
 
         Reviewed by Adam Barth.
 
-        Fetch pointers to C++ DOM window immediately from holder
+        Fetch pointers to C+DOM window immediately from holder
         object (do not search prototype chain for proper JS wrapper).
         https://bugs.webkit.org/show_bug.cgi?id=29031
 
@@ -773,7 +9523,7 @@
 
 2009-10-06  Xan Lopez  <xlopez@igalia.com>
 
-        Try to fix the GTK+ build.
+        Try to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -3363,12 +12113,12 @@
         (WebCore::XSLTMessageHandler::handleMessage):
         (WebCore::XSLTProcessor::transformToString):
 
-2009-10-02  Ben Murdoch  <benm@google.com>
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
 
-        Reviewed by David Kilzer.
+        Reviewed by Gustavo Noronha.
 
-        Stale database version persists through browser refresh (changeVersion doesn't work)
-        https://bugs.webkit.org/show_bug.cgi?id=27836
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
 
         Scale the cairo surface of the video sink depending on the
         pixel-aspect-ratio of the video buffer to paint. Also
@@ -3382,12 +12132,12 @@
         * platform/graphics/gtk/VideoSinkGStreamer.cpp:
         (webkit_video_sink_idle_func):
 
-2009-10-02  Philippe Normand  <pnormand@igalia.com>
+2009-10-02  Ben Murdoch  <benm@google.com>
 
-        Reviewed by Gustavo Noronha.
+        Reviewed by David Kilzer.
 
-        [GTK] missing support for anamorphic PAR video size
-        https://bugs.webkit.org/show_bug.cgi?id=29717
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
 
         Tests: storage/change-version-handle-reuse.html
                storage/change-version.html
@@ -3666,7 +12416,7 @@
         those values correspond to:
 
         auto = optimizeSpeed = what we normally when the value's not set
-        optimizeLegibility = geometricPrecision = ligatures + kerning
+        optimizeLegibility = geometricPrecision = ligatures kerning
 
         Add new file TextRenderingMode.h to the project files.
         * WebCore.vcproj/WebCore.vcproj:
@@ -3826,7 +12576,7 @@
          o All wrappers have hidden dependencies on their listeners to
            prevent listeners from being collected.
          o All variats of getEventListener function grouped in V8DOMWrapper.
-         o Pointers to C++ EventListener wrappers are stored in JS objects
+         o Pointers to C+EventListener wrappers are stored in JS objects
            instead of event listener lists.
         https://bugs.webkit.org/show_bug.cgi?id=29825
 
@@ -6083,7 +14833,7 @@
         can't happen when working with JavaScript since the Element will be kept
         alive due to the change above.
         (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
-        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "1" and added
         missing braces.
 
         * dom/NamedAttrMap.h: Made the element function public so it can be used by
@@ -6206,7 +14956,7 @@
         1. if the insertion node has a non opaque background color and one of the parent element did have
         a solid background color the new paragraph did not have the element with the solid color in the tree.
         2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
-        background color and some font attribute was being reproduced as span + bold + italic + font as separate tags.
+        background color and some font attribute was being reproduced as span bold italic font as separate tags.
         The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
         paragraph where the insertion point is.
 
@@ -6542,7 +15292,7 @@
 
         Reviewed by Oliver Hunt.
 
-        Implement correct horizontal scrollbar behavior for GTK+ also on
+        Implement correct horizontal scrollbar behavior for GTKalso on
         styled scrollbars.
 
         https://bugs.webkit.org/show_bug.cgi?id=29348
@@ -8416,7 +17166,7 @@
 
 2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Unreviewed build fix for GTK+ and a blind one for Qt after r48566.
+        Unreviewed build fix for GTKand a blind one for Qt after r48566.
 
         * GNUmakefile.am:
         * WebCore.pro:
@@ -9170,7 +17920,7 @@
         Reviewed by Oliver Hunt.
 
         <rdar://problem/7007541> 
-        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        CrashTracer: 4800crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
         
         Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
         crashes while we're calling into it).
@@ -10452,7 +19202,7 @@
 
         Reviewed by Dan Bernstein.
 
-        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() + 436
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() 436
         
         Avoid a crash when a mouse event handler on a <select> changes the select from a popup
         to a list (by setting the 'size' property) inside the event handler.
@@ -11468,7 +20218,7 @@
 
         Reviewed by Gustavo Noronha.
 
-        Build fix for GTK+ after r48267.
+        Build fix for GTKafter r48267.
 
         * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
         (WebCore::MediaPlayerPrivate::buffered):
@@ -12509,7 +21259,7 @@
 
 2009-09-08  Xan Lopez  <xlopez@igalia.com>
 
-        Unreviewed attempt to fix the GTK+ build.
+        Unreviewed attempt to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -18175,7 +26925,7 @@
         do not set playbin's audio sink.
         * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
         * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_idle_func): Use C++ casts, decrease reference count of async
+        (webkit_video_sink_idle_func): Use C+casts, decrease reference count of async
         queue at the end of the idle function.
         (webkit_video_sink_render): Increase reference count of async queue.
         (webkit_video_sink_stop): Remove any idle functions with the sink as data.
@@ -19936,7 +28686,7 @@
 
         Reviewed by Eric Seidel.
 
-        Add 'icu::' qualifier when refering to ICU C++ names to the other
+        Add 'icu::' qualifier when refering to ICU C+names to the other
         file with this issue missed in the previous check-in.
 
         https://bugs.webkit.org/show_bug.cgi?id=28410
@@ -20219,7 +28969,7 @@
 
         Reviewed by Eric Seidel
 
-        Add 'icu::' qualifier when refering to ICU C++ names.
+        Add 'icu::' qualifier when refering to ICU C+names.
 
         https://bugs.webkit.org/show_bug.cgi?id=28410
 
@@ -24397,7 +33147,7 @@ form controls that have different validity states.
         Reviewed by Sam Weinig.
 
         <rdar://problem/6952336>
-        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const + 27
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const 27
 
         Make sure to set the security origin before calling dispatchWindowObjectAvailable.
         
@@ -24721,11 +33471,11 @@ form controls that have different validity states.
         Reviewed by Darin Adler.
 
         https://bugs.webkit.org/show_bug.cgi?id=28204
-        Allow C++ exceptions to be disabled in WebCore's V8 Mac build.
+        Allow C+exceptions to be disabled in WebCore's V8 Mac build.
 
         * WebCorePrefix.h:
         Only undefine |try| and |catch| when building Objective-C[++],
-        leaving the C++ library definitions intact for C++.
+        leaving the C+library definitions intact for C++.
 
 2009-08-12  Nate Chapin  <japhet@chromium.org>
 
@@ -25775,7 +34525,7 @@ form controls that have different validity states.
 
         Reviewed by Darin Fisher.
 
-        Cleanup DOM Storage namespace shutdown code + usage of security origin.
+        Cleanup DOM Storage namespace shutdown code usage of security origin.
         https://bugs.webkit.org/show_bug.cgi?id=28094
 
         If a storage namespace is not explicitly closed, be sure to do so on
@@ -25882,7 +34632,7 @@ form controls that have different validity states.
 
 2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
-        Fix GTK+ build.
+        Fix GTKbuild.
 
         * platform/network/soup/ResourceHandleSoup.cpp:
         (WebCore::):
@@ -25896,7 +34646,7 @@ form controls that have different validity states.
         * platform/graphics/GlyphBuffer.h: Removed advanceData().
         * platform/graphics/wince/GraphicsContextWince.cpp:
         (WebCore::GraphicsContext::drawText): Changed to use advances(from)
-            instead of advanceData() + from.
+            instead of advanceData() from.
 
 2009-08-10  Xan Lopez  <xlopez@igalia.com>
 
@@ -26209,7 +34959,7 @@ form controls that have different validity states.
 
         Modify FrameLoadType enum to match the order of WebFrameLoadType in WebFramePrivate.h / IWebFramePrivate.idl.
         The mac/win public API exposes the old 'FrameLoadTypeReloadAllowingStaleData' value, which resides between
-        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload + 2'.
+        'FrameLoadTypeReload' and 'FrameLoadTypeSame'. Work around this problem, by assigning 'FrameLoadTypeSame = FrameLoadTypeReload 2'.
 
         Add a note to the FrameLoadType enum to keep it in sync with WebFramePrivate.h & IWebFramePrivate.idl.
 
@@ -33519,7 +42269,7 @@ form controls that have different validity states.
 
         I decided to change these to Base:: instead of DOMObjectWithGlobal::
         for future-proofing.  All autogenerated classes use a typedef Base
-        to avoid bugs like these.  Sadly C++ does not have a built-in super:: we could use.
+        to avoid bugs like these.  Sadly C+does not have a built-in super:: we could use.
 
         * WebCore.xcodeproj/project.pbxproj:
         * bindings/js/JSAbstractWorkerCustom.cpp:
@@ -34387,7 +43137,7 @@ form controls that have different validity states.
 
 2009-07-22  Xan Lopez  <xlopez@igalia.com>
 
-        Attempt to fix the GTK+ build.
+        Attempt to fix the GTKbuild.
 
         * GNUmakefile.am:
 
@@ -40448,7 +49198,7 @@ form controls that have different validity states.
 
         Crash in RenderMedia::styleDidChange.
         <rdar://problem/7044313> CrashTracer: quicklook crashed generating thumbnail for page with 
-        media element (RenderMedia::styleDidChange + 115)
+        media element (RenderMedia::styleDidChange 115)
 
         Speculative fix for crash in styleDidChange. Null check controller elements before tell
         them to update style.
@@ -41566,7 +50316,7 @@ form controls that have different validity states.
 
         Not reviewed, Chromium build fix.
 
-        Add in missing header + fix syntax issue that crept into last patch.
+        Add in missing header fix syntax issue that crept into last patch.
         https://bugs.webkit.org/show_bug.cgi?id=27027
 
         * rendering/RenderThemeChromiumMac.mm:
@@ -42397,7 +51147,7 @@ form controls that have different validity states.
 
         Report the caret offset from the end of the selection, otherwise
         we'll report the same offset when moving the caret while
-        modififying the selection (eg, with Shift + Right).
+        modififying the selection (eg, with Shift Right).
 
         * editing/gtk/SelectionControllerGtk.cpp:
         (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
@@ -43666,7 +52416,7 @@ form controls that have different validity states.
 
         Reviewed by Geoff Garen.
 
-        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const + 62
+        <rdar://problem/6960286> CrashTracer: [REGRESSION] 1120 crashes in Safari at com.apple.WebCore WebCore::JSLazyEventListener::parseCode const 62
 
         <select> elements and other elements the produce popups can keep their popups
         live across a page load.  If this occurs and the <select> element has an
@@ -44322,7 +53072,7 @@ form controls that have different validity states.
 
         Reviewed by Jan Alonzo.
 
-        [GTK] Don't use deprecated GTK+ symbols.
+        [GTK] Don't use deprecated GTKsymbols.
         https://bugs.webkit.org/show_bug.cgi?id=26583
 
         * plugins/gtk/gtk2xtbin.c:
@@ -49815,7 +58565,7 @@ form controls that have different validity states.
 
         Reviewed by Brady Eidson.
 
-        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient + 53
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient 53
         
         When revalidating a resource, calling addClient() on one client might cause another to get removed.
         
@@ -49877,7 +58627,7 @@ form controls that have different validity states.
         Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
         Provide an assignment operator to avoid improper reference
         counts on the Cairo font objects.  This brings the Windows
-        Cairo port in line with the GTK+ port.
+        Cairo port in line with the GTKport.
 
         * platform/graphics/win/FontPlatformData.h:
         * platform/graphics/win/FontPlatformDataCairoWin.cpp:
diff --git a/WebCore/Configurations/Base.xcconfig b/WebCore/Configurations/Base.xcconfig
index b8a5970..441c9fa 100644
--- a/WebCore/Configurations/Base.xcconfig
+++ b/WebCore/Configurations/Base.xcconfig
@@ -85,6 +85,7 @@ SQLITE3_HEADER_SEARCH_PATHS_ = $(SQLITE3_HEADER_SEARCH_PATHS_1040);
 SQLITE3_HEADER_SEARCH_PATHS_1040 = $(WEBCORE_SQLITE3_HEADER_SEARCH_PATHS);
 SQLITE3_HEADER_SEARCH_PATHS_1050 = $(WEBCORE_SQLITE3_HEADER_SEARCH_PATHS);
 SQLITE3_HEADER_SEARCH_PATHS_1060 = ;
+SQLITE3_HEADER_SEARCH_PATHS_1070 = ;
 
 
 // Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
diff --git a/WebCore/Configurations/DebugRelease.xcconfig b/WebCore/Configurations/DebugRelease.xcconfig
index 53264bc..470414d 100644
--- a/WebCore/Configurations/DebugRelease.xcconfig
+++ b/WebCore/Configurations/DebugRelease.xcconfig
@@ -28,6 +28,7 @@ ARCHS_ = $(ARCHS_1040);
 ARCHS_1040 = $(NATIVE_ARCH);
 ARCHS_1050 = $(NATIVE_ARCH);
 ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -36,6 +37,7 @@ MACOSX_DEPLOYMENT_TARGET_ = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
 
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index ed387aa..42aa3cf 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -31,10 +31,12 @@
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
 ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1070 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
 ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
+ENABLE_3D_RENDERING_1070 = ENABLE_3D_RENDERING;
 
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index 66d574b..fabc009 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 2;
+MINOR_VERSION = 4;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -36,6 +36,7 @@ SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_V
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
 SYSTEM_VERSION_PREFIX_1060 = 6;
+SYSTEM_VERSION_PREFIX_1070 = 7;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
diff --git a/WebCore/Configurations/WebCore.xcconfig b/WebCore/Configurations/WebCore.xcconfig
index 4ea0097..042ed0e 100644
--- a/WebCore/Configurations/WebCore.xcconfig
+++ b/WebCore/Configurations/WebCore.xcconfig
@@ -56,3 +56,4 @@ SQLITE3_LIBRARY_ = WebCoreSQLite3;
 SQLITE3_LIBRARY_1040 = WebCoreSQLite3;
 SQLITE3_LIBRARY_1050 = WebCoreSQLite3;
 SQLITE3_LIBRARY_1060 = sqlite3;
+SQLITE3_LIBRARY_1070 = sqlite3;
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index 48a67e9..1edbf7d 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -82,6 +82,7 @@
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
+#include "JSHTMLAllCollection.cpp"
 #include "JSHTMLAnchorElement.cpp"
 #include "JSHTMLAppletElement.cpp"
 #include "JSHTMLAreaElement.cpp"
@@ -244,6 +245,7 @@
 #include "JSSVGFEImageElement.cpp"
 #include "JSSVGFEMergeElement.cpp"
 #include "JSSVGFEMergeNodeElement.cpp"
+#include "JSSVGFEMorphologyElement.cpp"
 #include "JSSVGFEOffsetElement.cpp"
 #include "JSSVGFEPointLightElement.cpp"
 #include "JSSVGFESpecularLightingElement.cpp"
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index 157b01a..fd38707 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -70,6 +70,7 @@ DOM_CLASSES = \
     CSSValueList \
     CSSVariablesRule \
     CSSVariablesDeclaration \
+    CanvasActiveInfo \
     CanvasArray \
     CanvasArrayBuffer \
     CanvasBuffer \
@@ -125,6 +126,7 @@ DOM_CLASSES = \
     FileList \
     Geolocation \
     Geoposition \
+    HTMLAllCollection \
     HTMLAnchorElement \
     HTMLAppletElement \
     HTMLAreaElement \
@@ -288,6 +290,7 @@ DOM_CLASSES = \
     SVGFEImageElement \
     SVGFEMergeElement \
     SVGFEMergeNodeElement \
+    SVGFEMorphologyElement \
     SVGFEOffsetElement \
     SVGFEPointLightElement \
     SVGFESpecularLightingElement \
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index 3e6db09..0e150f0 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
diff --git a/WebCore/ForwardingHeaders/runtime/JSCell.h b/WebCore/ForwardingHeaders/runtime/JSCell.h
new file mode 100644
index 0000000..83a1575
--- /dev/null
+++ b/WebCore/ForwardingHeaders/runtime/JSCell.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JSCell_h
+#define WebCore_FWD_JSCell_h
+#include <JavaScriptCore/JSCell.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/StructureChain.h b/WebCore/ForwardingHeaders/runtime/StructureChain.h
new file mode 100644
index 0000000..7c60fa7
--- /dev/null
+++ b/WebCore/ForwardingHeaders/runtime/StructureChain.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_StructureChain_h
+#define WebCore_FWD_StructureChain_h
+#include <JavaScriptCore/StructureChain.h>
+#endif
+
diff --git a/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h b/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
new file mode 100644
index 0000000..f39bdee
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DateInstanceCache_h
+#define WebCore_FWD_DateInstanceCache_h
+#include <JavaScriptCore/DateInstanceCache.h>
+#endif
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index c4ab425..c4560ab 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -54,7 +54,6 @@ webcore_cppflags += \
 
 webcoregtk_cppflags += \
 	-DWTF_USE_SOUP=1 \
-        -DENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1 \
 	-I$(srcdir)/WebCore/accessibility/gtk \
 	-I$(srcdir)/WebCore/loader/gtk \
 	-I$(srcdir)/WebCore/page/gtk \
@@ -170,6 +169,7 @@ IDL_BINDINGS += \
 	WebCore/html/DataGridColumnList.idl \
 	WebCore/html/File.idl \
 	WebCore/html/FileList.idl \
+	WebCore/html/HTMLAllCollection.idl \
 	WebCore/html/HTMLAnchorElement.idl \
 	WebCore/html/HTMLAppletElement.idl \
 	WebCore/html/HTMLAreaElement.idl \
@@ -368,10 +368,11 @@ webcore_sources += \
 	WebCore/bindings/js/JSEventSourceCustom.cpp \
 	WebCore/bindings/js/JSEventTarget.cpp \
 	WebCore/bindings/js/JSEventTarget.h \
+	WebCore/bindings/js/JSExceptionBase.cpp \
+	WebCore/bindings/js/JSExceptionBase.h \
 	WebCore/bindings/js/JSGeolocationCustom.cpp \
-	WebCore/bindings/js/JSHTMLAllCollection.cpp \
-	WebCore/bindings/js/JSHTMLAllCollection.h \
-	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
+	WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp \
+ 	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.h \
 	WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
@@ -476,6 +477,7 @@ webcore_sources += \
 	WebCore/bindings/js/SerializedScriptValue.cpp \
 	WebCore/bindings/js/SerializedScriptValue.h \
 	WebCore/bindings/js/StringSourceProvider.h \
+	WebCore/bindings/ScriptControllerBase.cpp \
 	WebCore/bridge/IdentifierRep.cpp \
 	WebCore/bridge/IdentifierRep.h \
 	WebCore/bridge/NP_jsobject.cpp \
@@ -646,6 +648,7 @@ webcore_sources += \
 	WebCore/dom/Attr.h \
 	WebCore/dom/Attribute.cpp \
 	WebCore/dom/Attribute.h \
+	WebCore/dom/BeforeLoadEvent.h \
 	WebCore/dom/BeforeTextInsertedEvent.cpp \
 	WebCore/dom/BeforeTextInsertedEvent.h \
 	WebCore/dom/BeforeUnloadEvent.cpp \
@@ -958,6 +961,8 @@ webcore_sources += \
 	WebCore/html/FileList.h \
 	WebCore/html/FormDataList.cpp \
 	WebCore/html/FormDataList.h \
+	WebCore/html/HTMLAllCollection.cpp \
+	WebCore/html/HTMLAllCollection.h \
 	WebCore/html/HTMLAnchorElement.cpp \
 	WebCore/html/HTMLAnchorElement.h \
 	WebCore/html/HTMLAppletElement.cpp \
@@ -1159,8 +1164,6 @@ webcore_sources += \
 	WebCore/icu/unicode/uversion.h \
 	WebCore/inspector/ConsoleMessage.cpp \
 	WebCore/inspector/ConsoleMessage.h \
-	WebCore/inspector/DOMDispatchTimelineItem.cpp \
-	WebCore/inspector/DOMDispatchTimelineItem.h \
 	WebCore/inspector/InspectorBackend.cpp \
 	WebCore/inspector/InspectorBackend.h \
 	WebCore/inspector/InspectorDatabaseResource.cpp \
@@ -1187,8 +1190,8 @@ webcore_sources += \
 	WebCore/inspector/JavaScriptProfile.h \
 	WebCore/inspector/JavaScriptProfileNode.cpp \
 	WebCore/inspector/JavaScriptProfileNode.h \
-	WebCore/inspector/TimelineItem.cpp \
-	WebCore/inspector/TimelineItem.h \
+	WebCore/inspector/TimelineRecordFactory.cpp \
+	WebCore/inspector/TimelineRecordFactory.h \
 	WebCore/loader/Cache.cpp \
 	WebCore/loader/Cache.h \
 	WebCore/loader/CachePolicy.h \
@@ -1231,6 +1234,8 @@ webcore_sources += \
 	WebCore/loader/FrameLoader.h \
 	WebCore/loader/FrameLoaderClient.h \
 	WebCore/loader/FrameLoaderTypes.h \
+	WebCore/loader/HistoryController.cpp \
+	WebCore/loader/HistoryController.h \
 	WebCore/loader/ImageDocument.cpp \
 	WebCore/loader/ImageDocument.h \
 	WebCore/loader/ImageLoader.cpp \
@@ -1259,6 +1264,8 @@ webcore_sources += \
 	WebCore/loader/Request.h \
 	WebCore/loader/ResourceLoader.cpp \
 	WebCore/loader/ResourceLoader.h \
+	WebCore/loader/ResourceLoadNotifier.cpp \
+	WebCore/loader/ResourceLoadNotifier.h \
 	WebCore/loader/SubresourceLoader.cpp \
 	WebCore/loader/SubresourceLoader.h \
 	WebCore/loader/SubresourceLoaderClient.h \
@@ -1549,6 +1556,7 @@ webcore_sources += \
 	WebCore/platform/graphics/StringTruncator.cpp \
 	WebCore/platform/graphics/StringTruncator.h \
 	WebCore/platform/graphics/StrokeStyleApplier.h \
+	WebCore/platform/graphics/TextRenderingMode.h \
 	WebCore/platform/graphics/TextRun.h \
 	WebCore/platform/graphics/UnitBezier.h \
 	WebCore/platform/graphics/WidthIterator.cpp \
@@ -2002,7 +2010,8 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
 	WebCore/platform/network/soup/ResourceResponse.h \
-	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
+	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp \
+	WebCore/workers/SharedWorkerRepository.h
 
 # ---
 # Channel mesaging support
@@ -2240,6 +2249,7 @@ webcore_sources += \
 	WebCore/storage/StorageAreaSync.cpp \
 	WebCore/storage/StorageAreaSync.h \
 	WebCore/storage/StorageEvent.cpp \
+	WebCore/storage/StorageEventDispatcher.h \
 	WebCore/storage/StorageEventDispatcher.cpp \
 	WebCore/storage/StorageEvent.h \
 	WebCore/storage/StorageMap.cpp \
@@ -2329,7 +2339,7 @@ webcoregtk_sources += \
 	WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp \
 	WebCore/platform/graphics/gtk/VideoSinkGStreamer.h \
 	WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp \
-	WebCore/platform/graphics/gtk/DataSourceGstreamer.h
+	WebCore/platform/graphics/gtk/DataSourceGStreamer.h
 
 webcore_libadd += \
 	-lgstinterfaces-0.10 \
@@ -2511,7 +2521,6 @@ webcore_built_sources += \
 	WebCore/workers/SharedWorker.h \
 	WebCore/workers/SharedWorkerContext.cpp \
 	WebCore/workers/SharedWorkerContext.h \
-	WebCore/workers/SharedWorkerRepository.h \
 	WebCore/workers/SharedWorkerThread.cpp \
 	WebCore/workers/SharedWorkerThread.h
 
@@ -2593,6 +2602,8 @@ webcore_sources += \
 	WebCore/platform/graphics/filters/FEComponentTransfer.h \
 	WebCore/platform/graphics/filters/FEComposite.cpp \
 	WebCore/platform/graphics/filters/FEComposite.h \
+	WebCore/platform/graphics/filters/FEGaussianBlur.cpp \
+	WebCore/platform/graphics/filters/FEGaussianBlur.h \
 	WebCore/platform/graphics/filters/Filter.h \
 	WebCore/platform/graphics/filters/FilterEffect.cpp \
 	WebCore/platform/graphics/filters/FilterEffect.h \
@@ -2622,6 +2633,47 @@ webcoregtk_sources += \
 endif # END ENABLE_GEOLOCATION
 
 # ----
+# MathML support
+# ----
+if ENABLE_MATHML
+
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_MATHML=1
+
+webcore_cppflags += \
+	-I$(srcdir)/WebCore/mathml \
+	-DENABLE_MATHML=1
+
+webcore_sources += \
+	WebCore/mathml/MathMLElement.cpp \
+	WebCore/mathml/MathMLElement.h \
+	WebCore/mathml/MathMLInlineContainerElement.cpp \
+	WebCore/mathml/MathMLInlineContainerElement.h  \
+	WebCore/mathml/MathMLMathElement.cpp \
+	WebCore/mathml/MathMLMathElement.h
+
+webcore_built_sources += \
+	DerivedSources/MathMLElementFactory.cpp \
+	DerivedSources/MathMLElementFactory.h \
+	DerivedSources/MathMLNames.cpp \
+	DerivedSources/MathMLNames.h
+
+# MathML tag and attribute names, and element factory 
+DerivedSources/MathMLElementFactory.h: DerivedSources/MathMLElementFactory.cpp
+
+DerivedSources/MathMLNames.h: DerivedSources/MathMLNames.cpp
+
+DerivedSources/MathMLElementFactory.cpp DerivedSources/MathMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/mathml/mathtags.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/mathml/mathtags.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+else 
+DerivedSources/MathMLElementFactory.cpp:
+	echo > $@
+
+DerivedSources/MathMLNames.cpp:
+	echo > $@
+
+endif # END ENABLE_MATHML
+
+# ----
 # Notifications support
 # ----
 if ENABLE_NOTIFICATIONS
@@ -2710,6 +2762,7 @@ IDL_BINDINGS += \
 	WebCore/svg/SVGFEImageElement.idl \
 	WebCore/svg/SVGFEMergeElement.idl \
 	WebCore/svg/SVGFEMergeNodeElement.idl \
+	WebCore/svg/SVGFEMorphologyElement.idl \
 	WebCore/svg/SVGFEOffsetElement.idl \
 	WebCore/svg/SVGFEPointLightElement.idl \
 	WebCore/svg/SVGFESpecularLightingElement.idl \
@@ -2964,6 +3017,8 @@ webcore_sources += \
 	WebCore/svg/SVGFEMergeElement.h \
 	WebCore/svg/SVGFEMergeNodeElement.cpp \
 	WebCore/svg/SVGFEMergeNodeElement.h \
+	WebCore/svg/SVGFEMorphologyElement.cpp \
+	WebCore/svg/SVGFEMorphologyElement.h \
 	WebCore/svg/SVGFEOffsetElement.cpp \
 	WebCore/svg/SVGFEOffsetElement.h \
 	WebCore/svg/SVGFEPointLightElement.cpp \
@@ -3145,6 +3200,8 @@ webcore_sources += \
 	WebCore/svg/SVGZoomAndPan.h \
 	WebCore/svg/SVGZoomEvent.cpp \
 	WebCore/svg/SVGZoomEvent.h \
+	WebCore/svg/SynchronizablePropertyController.cpp \
+	WebCore/svg/SynchronizablePropertyController.h \
 	WebCore/svg/SynchronizableTypeWrapper.h \
 	WebCore/svg/animation/SMILTime.cpp \
 	WebCore/svg/animation/SMILTime.h \
@@ -3186,8 +3243,6 @@ webcore_sources += \
 	WebCore/svg/graphics/filters/SVGFEDisplacementMap.h \
 	WebCore/svg/graphics/filters/SVGFEFlood.cpp \
 	WebCore/svg/graphics/filters/SVGFEFlood.h \
-	WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp \
-	WebCore/svg/graphics/filters/SVGFEGaussianBlur.h \
 	WebCore/svg/graphics/filters/SVGFEImage.cpp \
 	WebCore/svg/graphics/filters/SVGFEImage.h \
 	WebCore/svg/graphics/filters/SVGFEMerge.cpp \
@@ -3352,6 +3407,7 @@ DerivedSources/CSSGrammar.cpp: $(WebCore)/css/CSSGrammar.y
 # user agent style sheets
 USER_AGENT_STYLE_SHEETS = \
 	$(WebCore)/css/html.css \
+	$(WebCore)/css/mathml.css \
 	$(WebCore)/css/quirks.css \
 	$(WebCore)/css/view-source.css \
 	$(WebCore)/css/svg.css \
@@ -3465,6 +3521,7 @@ webcore_dist += \
 	WebCore/bindings/scripts/generate-bindings.pl \
 	WebCore/bindings/scripts/CodeGeneratorJS.pm \
 	WebCore/css/html.css \
+	WebCore/css/mathml.css \
 	WebCore/css/quirks.css \
 	WebCore/css/view-source.css \
 	WebCore/css/svg.css \
diff --git a/WebCore/LICENSE-APPLE b/WebCore/LICENSE-APPLE
index 92514e2..f29b41c 100644
--- a/WebCore/LICENSE-APPLE
+++ b/WebCore/LICENSE-APPLE
@@ -1,22 +1,21 @@
-Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
+1.  Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+2.  Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
 
-THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
-EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
-CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
-OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/WebCore/WebCore.SVG.Filters.exp b/WebCore/WebCore.SVG.Filters.exp
index b0244db..5698258 100644
--- a/WebCore/WebCore.SVG.Filters.exp
+++ b/WebCore/WebCore.SVG.Filters.exp
@@ -15,6 +15,7 @@
 .objc_class_name_DOMSVGFEImageElement
 .objc_class_name_DOMSVGFEMergeElement
 .objc_class_name_DOMSVGFEMergeNodeElement
+.objc_class_name_DOMSVGFEMorphologyElement
 .objc_class_name_DOMSVGFEOffsetElement
 .objc_class_name_DOMSVGFEPointLightElement
 .objc_class_name_DOMSVGFESpecularLightingElement
diff --git a/WebCore/WebCore.Video.exp b/WebCore/WebCore.Video.exp
index 596fb4b..5d35698 100644
--- a/WebCore/WebCore.Video.exp
+++ b/WebCore/WebCore.Video.exp
@@ -3,6 +3,8 @@ __ZN7WebCore16HTMLMediaElement5pauseEv
 __ZNK7WebCore16HTMLMediaElement6volumeEv
 __ZNK7WebCore16HTMLMediaElement7canPlayEv
 __ZNK7WebCore16HTMLMediaElement8durationEv
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore16HTMLMediaElement8setMutedEb
 __ZN7WebCore16HTMLMediaElement9setVolumeEfRi
 __ZN7WebCore16HTMLMediaElement6rewindEf
 __ZN7WebCore16HTMLMediaElement10screenRectEv
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index 24d8355..a8bed54 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -156,22 +156,17 @@ __ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
 __ZN7WebCore11FrameLoader11loadArchiveEN3WTF10PassRefPtrINS_7ArchiveEEE
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
 __ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
-__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
 __ZN7WebCore11FrameLoader14detachChildrenEv
 __ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
 __ZN7WebCore11FrameLoader14stopAllLoadersENS_14DatabasePolicyE
 __ZN7WebCore11FrameLoader16detachFromParentEv
-__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEENS_14ReferrerPolicyE
 __ZN7WebCore11FrameLoader17stopForUserCancelEb
-__ZN7WebCore11FrameLoader18currentHistoryItemEv
 __ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
 __ZN7WebCore11FrameLoader23isProcessingUserGestureEv
 __ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
 __ZN7WebCore11FrameLoader26reloadWithOverrideEncodingERKNS_6StringE
-__ZN7WebCore11FrameLoader26saveDocumentAndScrollStateEv
-__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataEb
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_6StringEb
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestEb
@@ -277,7 +272,6 @@ __ZN7WebCore13HitTestResultD1Ev
 __ZN7WebCore13KeyboardEventC1ERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
 __ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
 __ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
-__ZN7WebCore13toJSDOMWindowEPNS_5FrameE
 __ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
 __ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
 __ZN7WebCore14DocumentLoader13attachToFrameEv
@@ -375,8 +369,11 @@ __ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
 __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
 __ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
 __ZN7WebCore16NavigationActionC1Ev
-__ZN7WebCore16ScriptController10initScriptEv
+__ZN7WebCore16ScriptController10initScriptEPNS_15DOMWrapperWorldE
+__ZN7WebCore16ScriptController12globalObjectEj
+__ZN7WebCore16ScriptController13executeScriptERKNS_6StringEb
 __ZN7WebCore16ScriptController18windowScriptObjectEv
+__ZN7WebCore16ScriptController28executeScriptInIsolatedWorldEjRKNS_6StringEb
 __ZN7WebCore16VisibleSelectionC1EPKNS_5RangeENS_9EAffinityE
 __ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionES3_
 __ZN7WebCore16colorFromNSColorEP7NSColor
@@ -388,7 +385,9 @@ __ZN7WebCore16threadGlobalDataEv
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
+__ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17HTMLPlugInElement11getNPObjectEv
+__ZN7WebCore21mainThreadNormalWorldEv
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN7WebCore18deprecatedParseURLERKNS_6StringE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
@@ -423,6 +422,7 @@ __ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11Geoposi
 __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
 __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
+__ZN7WebCore22counterValueForElementEPNS_7ElementE
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
 __ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
@@ -457,6 +457,7 @@ __ZN7WebCore31applicationIsMicrosoftMessengerEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
+__ZN7WebCore33DebuggerCallFrame_evaluateInWorldERKN3JSC17DebuggerCallFrameERKNS0_7UStringERNS0_7JSValueE
 __ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore4Font11setCodePathENS0_8CodePathE
@@ -648,7 +649,6 @@ __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings32setAcceleratedCompositingEnabledEb
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
-__ZN7WebCore8Settings32setExperimentalWebSocketsEnabledEb
 __ZN7WebCore8Settings33setDownloadableBinaryFontsEnabledEb
 __ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore8Settings34setLocalFileContentSniffingEnabledEb
@@ -724,16 +724,18 @@ __ZN7WebCore9HTMLNames9iframeTagE
 __ZN7WebCore9HTMLNames9scriptTagE
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
-__ZN7WebCore9PageGroup17addUserStyleSheetERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_j
-__ZN7WebCore9PageGroup13addUserScriptERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_jNS_23UserScriptInjectionTimeE
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
 __ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
-__ZN7WebCore9PageGroup32removeUserContentWithURLForWorldERKNS_4KURLEj
-__ZN7WebCore9PageGroup25removeUserContentForWorldEj
 __ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
 __ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
+__ZN7WebCore9PageGroup25removeUserScriptFromWorldEjRKNS_4KURLE
+__ZN7WebCore9PageGroup29removeUserStyleSheetFromWorldEjRKNS_4KURLE
+__ZN7WebCore9PageGroup26removeUserScriptsFromWorldEj
+__ZN7WebCore9PageGroup24addUserStyleSheetToWorldEjRKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_
+__ZN7WebCore9PageGroup20addUserScriptToWorldEjRKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_NS_23UserScriptInjectionTimeE
+__ZN7WebCore9PageGroup30removeUserStyleSheetsFromWorldEj
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
@@ -955,6 +957,9 @@ __ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
 __ZNK7WebCore8Position8upstreamEv
 __ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
 __ZNK7WebCore9FloatRectcv7_NSRectEv
+__ZNK7WebCore5Frame9nodeImageEPNS_4NodeE
+__ZN7WebCore12RenderWidget19showSubstituteImageEN3WTF10PassRefPtrINS_5ImageEEE
+__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
 __ZNK7WebCore9FrameTree20traverseNextWithWrapEb
@@ -973,7 +978,6 @@ __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
 __ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
 __ZN7WebCore8Settings23setPluginAllowedRunTimeEj
-__ZN7WebCore8Settings22setPluginHalterEnabledEb
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
index 4a0c540..055e3cb 100644
--- a/WebCore/WebCore.gyp/WebCore.gyp
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -44,7 +44,58 @@
       # WebKit is checked out in src/chromium/third_party/WebKit
       'variables': {'chromium_src_dir': '../../../..'},
     }],
-  ],  
+    ['OS == "mac"', {
+      'targets': [
+        {
+          # On the Mac, libWebKitSystemInterface*.a is used to help WebCore
+          # interface with the system.  This library is supplied as a static
+          # library in binary format.  At present, it contains many global
+          # symbols not marked private_extern.  It should be considered an
+          # implementation detail of WebCore, and does not need these symbols
+          # to be exposed so widely.
+          #
+          # This target contains an action that cracks open the existing
+          # static library and rebuilds it with these global symbols
+          # transformed to private_extern.
+          'target_name': 'webkit_system_interface',
+          'type': 'static_library',
+          'variables': {
+            'adjusted_library_path':
+                '<(PRODUCT_DIR)/libWebKitSystemInterfaceLeopardPrivateExtern.a',
+          },
+          'sources': [
+            # An empty source file is needed to convince Xcode to produce
+            # output for this target.  The resulting library won't actually
+            # contain anything.  The library at adjusted_library_path will,
+            # and that library is pushed to dependents of this target below.
+            'mac/Empty.cpp',
+          ],
+          'actions': [
+            {
+              'action_name': 'Adjust Visibility',
+              'inputs': [
+                'mac/adjust_visibility.sh',
+                '../../WebKitLibraries/libWebKitSystemInterfaceLeopard.a',
+              ],
+              'outputs': [
+                '<(adjusted_library_path)',
+              ],
+              'action': [
+                '<@(_inputs)',
+                '<@(_outputs)',
+                '<(INTERMEDIATE_DIR)/adjust_visibility',  # work directory
+              ],
+            },
+          ],  # actions
+          'link_settings': {
+            'libraries': [
+              '<(adjusted_library_path)',
+            ],
+          },  # link_settings
+        },  # target webkit_system_interface
+      ],  # targets
+    }],  # condition OS == "mac"
+  ],  # conditions
 
   'variables': {
     # If set to 1, doesn't compile debug symbols into webcore reducing the
@@ -129,6 +180,9 @@
           '../platform/mac',
           '../platform/text/mac',
         ],
+        # enable -Wall and -Werror, just in Mac build for now
+        # FIXME: Also enable this for Linux/Windows after verifying no warnings
+        'chromium_code': 1,
       }],
       ['OS=="win"', {
         'webcore_include_dirs': [
@@ -142,23 +196,66 @@
   },
   'targets': [
     {
-      'target_name': 'webcore',
-      'type': '<(library)',
-      'msvs_guid': '1C16337B-ACF3-4D03-AA90-851C5B5EADA6',
-      'dependencies': [
-        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
-        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
-        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
-        '<(chromium_src_dir)/skia/skia.gyp:skia',
-        '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
-        '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
-        '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
-        '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
-        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
-        '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
+      'target_name': 'webcore_bindings_sources',
+      'type': 'none',
+      'hard_dependency': 1,
+      'sources': [
+        # bison rule
+        '../css/CSSGrammar.y',
+        '../xml/XPathGrammar.y',
+
+        # gperf rule
+        '../html/DocTypeStrings.gperf',
+        '../html/HTMLEntityNames.gperf',
+        '../platform/ColorData.gperf',
+
+        # idl rule
+        '<@(webcore_bindings_idl_files)',
       ],
-      'defines': [
-        'WEBCORE_NAVIGATOR_VENDOR="Google Inc."', 
+      'sources/': [
+        # SVG_FILTERS only.
+        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.idl$'],
+
+      ],
+      'sources!': [
+        # Custom bindings in bindings/v8/custom exist for these.
+        '../dom/EventListener.idl',
+        '../dom/EventTarget.idl',
+        '../html/VoidCallback.idl',
+
+        # JSC-only.
+        '../inspector/JavaScriptCallFrame.idl',
+
+        # ENABLE_GEOLOCATION only.
+        '../page/Geolocation.idl',
+        '../page/Geoposition.idl',
+        '../page/PositionCallback.idl',
+        '../page/PositionError.idl',
+        '../page/PositionErrorCallback.idl',
+
+        # Bindings with custom Objective-C implementations.
+        '../page/AbstractView.idl',
+
+        # FIXME: I don't know why all of these are excluded.
+        # Extra SVG bindings to exclude.
+        '../svg/ElementTimeControl.idl',
+        '../svg/SVGAnimatedPathData.idl',
+        '../svg/SVGComponentTransferFunctionElement.idl',
+        '../svg/SVGExternalResourcesRequired.idl',
+        '../svg/SVGFitToViewBox.idl',
+        '../svg/SVGHKernElement.idl',
+        '../svg/SVGLangSpace.idl',
+        '../svg/SVGLocatable.idl',
+        '../svg/SVGStylable.idl',
+        '../svg/SVGTests.idl',
+        '../svg/SVGTransformable.idl',
+        '../svg/SVGViewSpec.idl',
+        '../svg/SVGZoomAndPan.idl',
+
+        # FIXME: I don't know why these are excluded, either.
+        # Someone (me?) should figure it out and add appropriate comments.
+        '../css/CSSUnknownRule.idl',
+
       ],
       'actions': [
         # Actions to build derived sources.
@@ -170,10 +267,16 @@
             '../css/SVGCSSPropertyNames.in',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/CSSPropertyNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSPropertyNames.cpp',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSPropertyNames.h',
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_csspropertynames.py', '<@(_outputs)', '--', '<@(_inputs)'],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_csspropertynames.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)'
+          ],
         },
         {
           'action_name': 'CSSValueKeywords',
@@ -183,10 +286,16 @@
             '../css/SVGCSSValueKeywords.in',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/CSSValueKeywords.c',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSValueKeywords.c',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSValueKeywords.h',
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_cssvaluekeywords.py', '<@(_outputs)', '--', '<@(_inputs)'],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_cssvaluekeywords.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)'
+          ],
         },
         {
           'action_name': 'HTMLNames',
@@ -196,15 +305,23 @@
             '../html/HTMLAttributeNames.in',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/HTMLNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLNames.cpp',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLNames.h',
-            '<(INTERMEDIATE_DIR)/HTMLElementFactory.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLElementFactory.cpp',
             # Pass --wrapperFactory to make_names to get these (JSC build?)
-            #'<(INTERMEDIATE_DIR)/JSHTMLElementWrapperFactory.cpp',
-            #'<(INTERMEDIATE_DIR)/JSHTMLElementWrapperFactory.h',
+            #'<(SHARED_INTERMEDIATE_DIR)/webkit/JSHTMLElementWrapperFactory.cpp',
+            #'<(SHARED_INTERMEDIATE_DIR)/webkit/JSHTMLElementWrapperFactory.h',
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)',
+            '--',
+            '--factory',
+            '--extraDefines', '<(feature_defines)'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--factory', '--extraDefines', '<(feature_defines)'],
-          'process_outputs_as_sources': 1,
         },
         {
           'action_name': 'SVGNames',
@@ -214,16 +331,24 @@
             '../svg/svgattrs.in',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/SVGNames.cpp',
-            '<(INTERMEDIATE_DIR)/SVGNames.h',
-            '<(INTERMEDIATE_DIR)/SVGElementFactory.cpp',
-            '<(INTERMEDIATE_DIR)/SVGElementFactory.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/SVGNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/SVGNames.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/SVGElementFactory.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/SVGElementFactory.h',
             # Pass --wrapperFactory to make_names to get these (JSC build?)
-            #'<(INTERMEDIATE_DIR)/JSSVGElementWrapperFactory.cpp',
-            #'<(INTERMEDIATE_DIR)/JSSVGElementWrapperFactory.h',
+            #'<(SHARED_INTERMEDIATE_DIR)/webkit/JSSVGElementWrapperFactory.cpp',
+            #'<(SHARED_INTERMEDIATE_DIR)/webkit/JSSVGElementWrapperFactory.h',
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)',
+            '--',
+            '--factory',
+            '--extraDefines', '<(feature_defines)'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--factory', '--extraDefines', '<(feature_defines)'],
-          'process_outputs_as_sources': 1,
         },
         {
           'action_name': 'UserAgentStyleSheets',
@@ -240,11 +365,16 @@
             '../css/mediaControlsChromium.css',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/UserAgentStyleSheets.h',
-            '<(INTERMEDIATE_DIR)/UserAgentStyleSheetsData.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/UserAgentStyleSheets.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/UserAgentStyleSheetsData.cpp',
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_useragentstylesheets.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_useragentstylesheets.py', '<@(_outputs)', '--', '<@(_inputs)'],
-          'process_outputs_as_sources': 1,
         },
         {
           'action_name': 'XLinkNames',
@@ -253,11 +383,18 @@
             '../svg/xlinkattrs.in',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/XLinkNames.cpp',
-            '<(INTERMEDIATE_DIR)/XLinkNames.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/XLinkNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/XLinkNames.h',
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)',
+            '--',
+            '--extraDefines', '<(feature_defines)'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--extraDefines', '<(feature_defines)'],
-          'process_outputs_as_sources': 1,
         },
         {
           'action_name': 'XMLNames',
@@ -266,11 +403,18 @@
             '../xml/xmlattrs.in',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/XMLNames.cpp',
-            '<(INTERMEDIATE_DIR)/XMLNames.h',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/XMLNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/XMLNames.h',
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_makenames.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)',
+            '--',
+            '--extraDefines', '<(feature_defines)'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--extraDefines', '<(feature_defines)'],
-          'process_outputs_as_sources': 1,
         },
         {
           'action_name': 'tokenizer',
@@ -279,9 +423,15 @@
             '../css/tokenizer.flex',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/tokenizer.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/tokenizer.cpp',
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/action_maketokenizer.py',
+            '<@(_outputs)',
+            '--',
+            '<@(_inputs)'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/action_maketokenizer.py', '<@(_outputs)', '--', '<@(_inputs)'],
         },
       ],
       'rules': [
@@ -290,11 +440,15 @@
           'rule_name': 'bison',
           'extension': 'y',
           'outputs': [
-            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).cpp',
-            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).h'
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).h'
+          ],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/rule_bison.py',
+            '<(RULE_INPUT_PATH)',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit'
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_bison.py', '<(RULE_INPUT_PATH)', '<(INTERMEDIATE_DIR)'],
-          'process_outputs_as_sources': 1,
         },
         {
           'rule_name': 'gperf',
@@ -312,7 +466,12 @@
             '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).c',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).cpp',
           ],
-          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_gperf.py', '<(RULE_INPUT_PATH)', '<(SHARED_INTERMEDIATE_DIR)/webkit'],
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/rule_gperf.py',
+            '<(RULE_INPUT_PATH)',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit'
+          ],
           'process_outputs_as_sources': 0,
         },
         # Rule to build generated JavaScript (V8) bindings from .idl source.
@@ -328,7 +487,9 @@
             '../bindings/scripts/IDLStructure.pm',
           ],
           'outputs': [
-            '<(INTERMEDIATE_DIR)/bindings/V8<(RULE_INPUT_ROOT).cpp',
+            # FIXME:  The .cpp file should be in webkit/bindings once
+            # we coax GYP into supporting it (see 'action' below).
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/bindings/V8<(RULE_INPUT_ROOT).cpp',
             '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings/V8<(RULE_INPUT_ROOT).h',
           ],
           'variables': {
@@ -345,32 +506,139 @@
               '--include', '../xml',
             ],
           },
-          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_binding.py', '<(RULE_INPUT_PATH)', '<(INTERMEDIATE_DIR)/bindings', '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings', '--', '<@(_inputs)', '--', '--defines', '<(feature_defines) LANGUAGE_JAVASCRIPT V8_BINDING', '--generator', 'V8', '<@(generator_include_dirs)'],
-          # They are included by DerivedSourcesAllInOne.cpp instead.
-          'process_outputs_as_sources': 0,
+          # FIXME:  Note that we put the .cpp files in webcore/bindings
+          # but the .h files in webkit/bindings.  This is to work around
+          # the unfortunate fact that GYP strips duplicate arguments
+          # from lists.  When we have a better GYP way to suppress that
+          # behavior, change the output location.
+          'action': [
+            'python',
+            '<(chromium_src_dir)/webkit/build/rule_binding.py',
+            '<(RULE_INPUT_PATH)',
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/bindings',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
+            '--',
+            '<@(_inputs)',
+            '--',
+            '--defines', '<(feature_defines) LANGUAGE_JAVASCRIPT V8_BINDING',
+            '--generator', 'V8',
+            '<@(generator_include_dirs)'
+          ],
           'message': 'Generating binding from <(RULE_INPUT_PATH)',
         },
       ],
+    },
+    {
+      'target_name': 'webcore_bindings',
+      'type': '<(library)',
+      'hard_dependency': 1,
+      'dependencies': [
+        'webcore_bindings_sources',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+        '<(chromium_src_dir)/skia/skia.gyp:skia',
+        '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+        '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
+        '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
+        '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
+        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+        '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
+      ],
       'include_dirs': [
         '<(INTERMEDIATE_DIR)',
+        # FIXME:  Remove <(SHARED_INTERMEDIATE_DIR)/webcore when we
+        # can entice gyp into letting us put both the .cpp and .h
+        # files in the same output directory.
+        '<(SHARED_INTERMEDIATE_DIR)/webcore',
         '<(SHARED_INTERMEDIATE_DIR)/webkit',
         '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
         '<@(webcore_include_dirs)',
       ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '<(SHARED_INTERMEDIATE_DIR)/webkit',
+          '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
+        ],
+      },
       'sources': [
-        # bison rule
-        '../css/CSSGrammar.y',
-        '../xml/XPathGrammar.y',
-
-        # gperf rule
-        '../html/DocTypeStrings.gperf',
-        '../html/HTMLEntityNames.gperf',
-        '../platform/ColorData.gperf',
-
         # This file includes all the .cpp files generated from the .idl files
         # in webcore_files.
         '../bindings/v8/DerivedSourcesAllInOne.cpp',
 
+        # Additional .cpp files from webcore_bindings_sources actions.
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLElementFactory.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLNames.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/SVGElementFactory.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/SVGNames.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/UserAgentStyleSheetsData.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/XLinkNames.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/XMLNames.cpp',
+
+        # Additional .cpp files from the webcore_bindings_sources rules.
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSGrammar.cpp',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/XPathGrammar.cpp',
+      ],
+      'conditions': [
+        ['javascript_engine=="v8"', {
+          'dependencies': [
+            '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+          ],
+        }],
+        ['OS=="mac"', {
+          'include_dirs': [
+            '../../WebKitLibraries',
+          ],
+        }],
+        ['OS=="win"', {
+          'dependencies': [
+            '<(chromium_src_dir)/build/win/system.gyp:cygwin'
+          ],
+          'defines': [
+            'WEBCORE_NAVIGATOR_PLATFORM="Win32"',
+            '__PRETTY_FUNCTION__=__FUNCTION__',
+          ],
+          # This is needed because Event.h in this directory is blocked
+          # by a system header on windows.
+          'include_dirs++': ['../dom'],
+          'direct_dependent_settings': {
+            'include_dirs+++': ['../dom'],
+          },
+        }],
+        ['OS!="win" and remove_webcore_debug_symbols==1', {
+          'configurations': {
+            'Debug': {
+              'cflags!': ['-g'],
+            }
+          },
+        }],
+      ],
+    },
+    {
+      'target_name': 'webcore',
+      'type': '<(library)',
+      'msvs_guid': '1C16337B-ACF3-4D03-AA90-851C5B5EADA6',
+      'dependencies': [
+        'webcore_bindings',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+        '<(chromium_src_dir)/skia/skia.gyp:skia',
+        '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+        '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
+        '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
+        '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
+        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+        '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
+      ],
+      'defines': [
+        'WEBCORE_NAVIGATOR_VENDOR="Google Inc."', 
+      ],
+      'include_dirs': [
+        '<(INTERMEDIATE_DIR)',
+        '<@(webcore_include_dirs)',
+      ],
+      'sources': [
         '<@(webcore_files)',
 
         # For WebCoreSystemInterface, Mac-only.
@@ -380,9 +648,6 @@
         # Exclude JSC custom bindings.
         ['exclude', 'bindings/js'],
 
-        # SVG_FILTERS only.
-        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.idl$'],
-
         # Fortunately, many things can be excluded by using broad patterns.
 
         # Exclude things that don't apply to the Chromium platform on the basis
@@ -397,7 +662,7 @@
         # ENABLE_OFFLINE_WEB_APPLICATIONS, exclude most of webcore's impl
         ['exclude', 'loader/appcache/'],
         ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
-        ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp|idl)$'],
+        ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp)$'],
 
         # SVG_FILTERS only.
         ['exclude', '(platform|svg)/graphics/filters/'],
@@ -408,44 +673,6 @@
         ['exclude', 'platform/sql/SQLiteFileSystem.cpp'],
       ],
       'sources!': [
-        # Custom bindings in bindings/v8/custom exist for these.
-        '../dom/EventListener.idl',
-        '../dom/EventTarget.idl',
-        '../html/VoidCallback.idl',
-
-        # JSC-only.
-        '../inspector/JavaScriptCallFrame.idl',
-
-        # ENABLE_GEOLOCATION only.
-        '../page/Geolocation.idl',
-        '../page/Geoposition.idl',
-        '../page/PositionCallback.idl',
-        '../page/PositionError.idl',
-        '../page/PositionErrorCallback.idl',
-
-        # Bindings with custom Objective-C implementations.
-        '../page/AbstractView.idl',
-
-        # FIXME: I don't know why all of these are excluded.
-        # Extra SVG bindings to exclude.
-        '../svg/ElementTimeControl.idl',
-        '../svg/SVGAnimatedPathData.idl',
-        '../svg/SVGComponentTransferFunctionElement.idl',
-        '../svg/SVGExternalResourcesRequired.idl',
-        '../svg/SVGFitToViewBox.idl',
-        '../svg/SVGHKernElement.idl',
-        '../svg/SVGLangSpace.idl',
-        '../svg/SVGLocatable.idl',
-        '../svg/SVGStylable.idl',
-        '../svg/SVGTests.idl',
-        '../svg/SVGTransformable.idl',
-        '../svg/SVGViewSpec.idl',
-        '../svg/SVGZoomAndPan.idl',
-
-        # FIXME: I don't know why these are excluded, either.
-        # Someone (me?) should figure it out and add appropriate comments.
-        '../css/CSSUnknownRule.idl',
-
         # A few things can't be excluded by patterns.  List them individually.
 
         # Don't build StorageNamespace.  We have our own implementation.
@@ -500,8 +727,6 @@
       ],
       'direct_dependent_settings': {
         'include_dirs': [
-          '<(SHARED_INTERMEDIATE_DIR)/webkit',
-          '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
           '<@(webcore_include_dirs)',
         ],
         'mac_framework_dirs': [
@@ -509,6 +734,7 @@
         ],
       },
       'export_dependent_settings': [
+        'webcore_bindings',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
@@ -604,6 +830,9 @@
           ],
         }],
         ['OS=="mac"', {
+          'dependencies': [
+            'webkit_system_interface',
+          ],
           'defines': [
             # Match Safari and Mozilla on Mac x86.
             'WEBCORE_NAVIGATOR_PLATFORM="MacIntel"',
@@ -740,11 +969,6 @@
             '../platform/image-decoders/xbm/XBMImageDecoder.cpp',
             '../platform/image-decoders/xbm/XBMImageDecoder.h',
           ],
-          'link_settings': {
-            'libraries': [
-              '../../WebKitLibraries/libWebKitSystemInterfaceLeopard.a',
-            ],
-          },
           'direct_dependent_settings': {
             'include_dirs': [
               '../../WebKitLibraries',
@@ -753,7 +977,9 @@
           },
         }],
         ['OS=="win"', {
-          'dependencies': ['<(chromium_src_dir)/build/win/system.gyp:cygwin'],
+          'dependencies': [
+            '<(chromium_src_dir)/build/win/system.gyp:cygwin'
+          ],
           'sources/': [
             ['exclude', 'Posix\\.cpp$'],
             ['include', '/opentype/'],
@@ -772,8 +998,12 @@
             'include_dirs+++': ['../dom'],
           },
         }],
-        ['OS!="linux" and OS!="freebsd"', {'sources/': [['exclude', '(Gtk|Linux)\\.cpp$']]}],
-        ['OS!="mac"', {'sources/': [['exclude', 'Mac\\.(cpp|mm?)$']]}],
+        ['OS!="linux" and OS!="freebsd"', {
+          'sources/': [['exclude', '(Gtk|Linux)\\.cpp$']]
+        }],
+        ['OS!="mac"', {
+          'sources/': [['exclude', 'Mac\\.(cpp|mm?)$']]
+        }],
         ['OS!="win"', {
           'sources/': [
             ['exclude', 'Win\\.cpp$'],
@@ -789,5 +1019,5 @@
         }],
       ],
     },
-  ], # targets
+  ],  # targets
 }
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.cpp b/WebCore/WebCore.gyp/mac/Empty.cpp
index ce2609c..d25a2b7 100644
--- a/WebCore/bindings/js/JSHTMLAllCollection.cpp
+++ b/WebCore/WebCore.gyp/mac/Empty.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,16 +20,8 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "config.h"
-#include "JSHTMLAllCollection.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-const ClassInfo JSHTMLAllCollection::s_info = { "HTMLAllCollection", 0, 0, 0 };
-
-} // namespace WebCore
+// This is an empty file used to convince Xcode to link a library when it
+// wouldn't otherwise have any reason to do so.
diff --git a/WebCore/WebCore.gyp/mac/adjust_visibility.sh b/WebCore/WebCore.gyp/mac/adjust_visibility.sh
new file mode 100755
index 0000000..44a50b7
--- /dev/null
+++ b/WebCore/WebCore.gyp/mac/adjust_visibility.sh
@@ -0,0 +1,108 @@
+#!/bin/sh
+
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# usage: adjust_visibility.sh INPUT OUTPUT WORK_DIR
+#
+# Transforms a static library at INPUT by marking all of its symbols
+# private_extern.  The output is placed at OUTPUT.  WORK_DIR is used as a
+# scratch directory, which need not exist before this script is invoked,
+# and which will be left behind when the script exits.
+
+set -e
+
+if [ $# -ne 3 ] ; then
+  echo "usage: ${0} INPUT OUTPUT WORK_DIR" >& 2
+  exit 1
+fi
+
+INPUT="${1}"
+OUTPUT="${2}"
+WORK_DIR="${3}"
+
+# Start with a clean slate.
+rm -f "${OUTPUT}"
+rm -rf "${WORK_DIR}"
+mkdir -p "${WORK_DIR}"
+
+# ar doesn't operate on fat files.  Figure out what architectures are
+# involved.
+ARCHS=$(file "${INPUT}" | sed -Ene 's/^.*\(for architecture (.+)\):.*$/\1/p')
+if [ -z "${ARCHS}" ] ; then
+  ARCHS=self
+fi
+
+OUTPUT_NAME="output.a"
+
+for ARCH in ${ARCHS} ; do
+  # Get a thin version of fat input by running lipo.  If the input is already
+  # thin, just copy it into place.  The extra copy isn't strictly necessary
+  # but it simplifies the script.
+  ARCH_DIR="${WORK_DIR}/${ARCH}"
+  mkdir -p "${ARCH_DIR}"
+  INPUT_NAME=input.a
+  ARCH_INPUT="${ARCH_DIR}/${INPUT_NAME}"
+  if [ "${ARCHS}" = "self" ] ; then
+    cp "${INPUT}" "${ARCH_INPUT}"
+  else
+    lipo -thin "${ARCH}" "${INPUT}" -output "${ARCH_INPUT}"
+  fi
+
+  # Change directories to extract the archive to ensure correct pathnames.
+  (cd "${ARCH_DIR}" && ar -x "${INPUT_NAME}")
+
+  # Use ld -r to relink each object that was in the archive.  Providing an
+  # empty -exported_symbols_list will transform all symbols to private_extern;
+  # these symbols are retained with -keep_private_externs.
+  for OBJECT in "${ARCH_DIR}/"*.o ; do
+    NEW_OBJECT="${OBJECT}.new"
+    ld -o "${NEW_OBJECT}" -r "${OBJECT}" \
+        -exported_symbols_list /dev/null -keep_private_externs
+    mv "${NEW_OBJECT}" "${OBJECT}"
+  done
+
+  # Build an architecture-specific archive from the modified object files.
+  ARCH_OUTPUT="${ARCH_DIR}/${OUTPUT_NAME}"
+  (cd "${ARCH_DIR}" && ar -rc "${OUTPUT_NAME}" *.o)
+  ranlib "${ARCH_OUTPUT}"
+
+  # Toss the object files out now that they're in the archive.
+  rm -f "${ARCH_DIR}/"*.o
+done
+
+# Create a fat archive from the architecture-specific archives if needed.
+# If the input was thin, leave the output thin by copying the only output
+# archive to the destination.
+if [ "${ARCHS}" = "self" ] ; then
+  cp "${WORK_DIR}/self/${OUTPUT_NAME}" "${OUTPUT}"
+else
+  lipo -create -output "${OUTPUT}" "${WORK_DIR}/"*"/${OUTPUT_NAME}"
+fi
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index a8cfeb9..c0baaf4 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -1,6 +1,6 @@
 {
     'variables': {
-        'webcore_files': [
+        'webcore_bindings_idl_files': [
 
             #IDL files
             'css/CSSCharsetRule.idl',
@@ -51,7 +51,6 @@
             'dom/EventException.idl',
             'dom/EventListener.idl',
             'dom/EventTarget.idl',
-            'dom/HTMLAllCollection.idl',
             'dom/KeyboardEvent.idl',
             'dom/MessageChannel.idl',
             'dom/MessageEvent.idl',
@@ -77,6 +76,7 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
+            'html/canvas/CanvasActiveInfo.idl',
             'html/canvas/CanvasArray.idl',
             'html/canvas/CanvasArrayBuffer.idl',
             'html/canvas/CanvasBuffer.idl',
@@ -102,6 +102,7 @@
             'html/DataGridColumnList.idl',
             'html/File.idl',
             'html/FileList.idl',
+            'html/HTMLAllCollection.idl',
             'html/HTMLAnchorElement.idl',
             'html/HTMLAppletElement.idl',
             'html/HTMLAreaElement.idl',
@@ -259,6 +260,7 @@
             'svg/SVGFEImageElement.idl',
             'svg/SVGFEMergeElement.idl',
             'svg/SVGFEMergeNodeElement.idl',
+            'svg/SVGFEMorphologyElement.idl',
             'svg/SVGFEOffsetElement.idl',
             'svg/SVGFEPointLightElement.idl',
             'svg/SVGFESpecularLightingElement.idl',
@@ -346,7 +348,6 @@
             'svg/SVGTransform.idl',
             'svg/SVGTransformList.idl',
             'svg/SVGTransformable.idl',
-            'svg/SVGURIReference.idl',
             'svg/SVGUnitTypes.idl',
             'svg/SVGUseElement.idl',
             'svg/SVGViewElement.idl',
@@ -373,6 +374,8 @@
             'xml/XPathNSResolver.idl',
             'xml/XPathResult.idl',
             'xml/XSLTProcessor.idl',
+        ],
+        'webcore_files': [
 
             # Source/Header Files
             'accessibility/AXObjectCache.cpp',
@@ -485,11 +488,12 @@
             'bindings/js/JSEventListener.h',
             'bindings/js/JSEventTarget.cpp',
             'bindings/js/JSEventTarget.h',
+            'bindings/js/JSExceptionBase.cpp',
+            'bindings/js/JSExceptionBase.h',
             'bindings/js/JSGeolocationCustom.cpp',
             'bindings/js/JSHistoryCustom.cpp',
             'bindings/js/JSHistoryCustom.h',
-            'bindings/js/JSHTMLAllCollection.cpp',
-            'bindings/js/JSHTMLAllCollection.h',
+            'bindings/js/JSHTMLAllCollectionCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.h',
             'bindings/js/JSHTMLCanvasElementCustom.cpp',
@@ -625,6 +629,7 @@
             'bindings/js/StringSourceProvider.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
+            'bindings/ScriptControllerBase.cpp',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
@@ -673,6 +678,7 @@
             'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
+            'bindings/v8/custom/V8HTMLAllCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
@@ -738,6 +744,8 @@
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
             'bindings/v8/OwnHandle.h',
+            'bindings/v8/RuntimeEnabledFeatures.cpp',
+            'bindings/v8/RuntimeEnabledFeatures.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
@@ -767,6 +775,8 @@
             'bindings/v8/ScriptState.h',
             'bindings/v8/ScriptState.cpp',
             'bindings/v8/ScriptString.h',
+            'bindings/v8/ScriptStringImpl.cpp',
+            'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
             'bindings/v8/SerializedScriptValue.h',
@@ -1319,6 +1329,8 @@
             'html/FileList.h',
             'html/FormDataList.cpp',
             'html/FormDataList.h',
+            'html/HTMLAllCollection.cpp',
+            'html/HTMLAllCollection.h',
             'html/HTMLAnchorElement.cpp',
             'html/HTMLAnchorElement.h',
             'html/HTMLAppletElement.cpp',
@@ -1501,8 +1513,6 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
-            'inspector/DOMDispatchTimelineItem.cpp',
-            'inspector/DOMDispatchTimelineItem.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1528,8 +1538,8 @@
             'inspector/JavaScriptProfile.h',
             'inspector/JavaScriptProfileNode.cpp',
             'inspector/JavaScriptProfileNode.h',
-            'inspector/TimelineItem.cpp',
-            'inspector/TimelineItem.h',
+            'inspector/TimelineRecordFactory.cpp',
+            'inspector/TimelineRecordFactory.h',
             'loader/appcache/ApplicationCache.cpp',
             'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
@@ -1615,6 +1625,8 @@
             'loader/FrameLoader.h',
             'loader/FrameLoaderClient.h',
             'loader/FrameLoaderTypes.h',
+            'loader/HistoryController.cpp',
+            'loader/HistoryController.h',
             'loader/ImageDocument.cpp',
             'loader/ImageDocument.h',
             'loader/ImageLoader.cpp',
@@ -1643,6 +1655,8 @@
             'loader/Request.h',
             'loader/ResourceLoader.cpp',
             'loader/ResourceLoader.h',
+            'loader/ResourceLoadNotifier.cpp',
+            'loader/ResourceLoadNotifier.h',
             'loader/SubresourceLoader.cpp',
             'loader/SubresourceLoader.h',
             'loader/SubresourceLoaderClient.h',
@@ -1833,7 +1847,7 @@
             'platform/chromium/KeyboardCodesWin.h',
             'platform/chromium/Language.cpp',
             'platform/chromium/LinkHashChromium.cpp',
-            'platform/chromium/MimeTypeRegistryChromium.cpp',
+            'platform/chromium/MIMETypeRegistryChromium.cpp',
             'platform/chromium/PasteboardChromium.cpp',
             'platform/chromium/PasteboardPrivate.h',
             'platform/chromium/PlatformCursor.h',
@@ -1931,6 +1945,8 @@
             'platform/graphics/filters/FEComponentTransfer.h',
             'platform/graphics/filters/FEComposite.cpp',
             'platform/graphics/filters/FEComposite.h',
+            'platform/graphics/filters/FEGaussianBlur.cpp',
+            'platform/graphics/filters/FEGaussianBlur.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -2364,6 +2380,7 @@
             'platform/network/chromium/NetworkStateNotifierChromium.cpp',
             'platform/network/chromium/NetworkStateNotifierPrivate.h',
             'platform/network/chromium/ResourceError.h',
+            'platform/network/chromium/ResourceRequest.cpp',
             'platform/network/chromium/ResourceRequest.h',
             'platform/network/chromium/ResourceResponse.h',
             'platform/network/chromium/SocketStreamError.h',
@@ -3142,8 +3159,6 @@
             'svg/graphics/filters/SVGFEDisplacementMap.h',
             'svg/graphics/filters/SVGFEFlood.cpp',
             'svg/graphics/filters/SVGFEFlood.h',
-            'svg/graphics/filters/SVGFEGaussianBlur.cpp',
-            'svg/graphics/filters/SVGFEGaussianBlur.h',
             'svg/graphics/filters/SVGFEImage.cpp',
             'svg/graphics/filters/SVGFEImage.h',
             'svg/graphics/filters/SVGFEMerge.cpp',
@@ -3288,6 +3303,8 @@
             'svg/SVGFEMergeElement.h',
             'svg/SVGFEMergeNodeElement.cpp',
             'svg/SVGFEMergeNodeElement.h',
+            'svg/SVGFEMorphologyElement.cpp',
+            'svg/SVGFEMorphologyElement.h',
             'svg/SVGFEOffsetElement.cpp',
             'svg/SVGFEOffsetElement.h',
             'svg/SVGFEPointLightElement.cpp',
@@ -3469,6 +3486,8 @@
             'svg/SVGZoomAndPan.h',
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
+            'svg/SynchronizablePropertyController.cpp',
+            'svg/SynchronizablePropertyController.h',
             'svg/SynchronizableTypeWrapper.h',
             'websockets/WebSocket.cpp',
             'websockets/WebSocket.h',
@@ -3483,8 +3502,6 @@
             'workers/DedicatedWorkerContext.h',
             'workers/DedicatedWorkerThread.cpp',
             'workers/DedicatedWorkerThread.h',
-            'workers/DefaultSharedWorkerRepository.cpp',
-            'workers/DefaultSharedWorkerRepository.h',
             'workers/GenericWorkerTask.h',
             'workers/SharedWorker.cpp',
             'workers/SharedWorker.h',
@@ -3570,6 +3587,7 @@
         'webinspector_files': [
 
             'inspector/front-end/inspector.html',
+            'inspector/front-end/AbstractTimelinePanel.js',
             'inspector/front-end/BottomUpProfileDataGridTree.js',
             'inspector/front-end/Breakpoint.js',
             'inspector/front-end/BreakpointsSidebarPane.js',
@@ -3593,6 +3611,7 @@
             'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
+            'inspector/front-end/InspectorControllerStub.js',
             'inspector/front-end/InjectedScript.js',
             'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
@@ -3626,8 +3645,10 @@
             'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
             'inspector/front-end/SummaryBar.js',
+            'inspector/front-end/TestController.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TimelineAgent.js',
+            'inspector/front-end/TimelinePanel.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
@@ -3683,6 +3704,7 @@
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
             'inspector/front-end/Images/paneGrowHandleLine.png',
+            'inspector/front-end/Images/paneSettingsButtons.png',
             'inspector/front-end/Images/pauseOnExceptionButtonGlyph.png',
             'inspector/front-end/Images/percentButtonGlyph.png',
             'inspector/front-end/Images/profileGroupIcon.png',
@@ -3734,6 +3756,16 @@
             'inspector/front-end/Images/timelineHollowPillPurple.png',
             'inspector/front-end/Images/timelineHollowPillRed.png',
             'inspector/front-end/Images/timelineHollowPillYellow.png',
+            'inspector/front-end/Images/timelineIcon.png',
+            'inspector/front-end/Images/timelineBarBlue.png',
+            'inspector/front-end/Images/timelineBarGray.png',
+            'inspector/front-end/Images/timelineBarGreen.png',
+            'inspector/front-end/Images/timelineBarOrange.png',
+            'inspector/front-end/Images/timelineBarPurple.png',
+            'inspector/front-end/Images/timelineBarRed.png',
+            'inspector/front-end/Images/timelineBarYellow.png',
+            'inspector/front-end/Images/timelineCheckmarks.png',
+            'inspector/front-end/Images/timelineDots.png',
             'inspector/front-end/Images/timelinePillBlue.png',
             'inspector/front-end/Images/timelinePillGray.png',
             'inspector/front-end/Images/timelinePillGreen.png',
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 24ce0c9..9a4e9d8 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -164,7 +164,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
-    unix|win32-*:!embedded:!wince*:!symbian {
+    unix|win32-*:!embedded:!wince*: {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
     } else {
         DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
@@ -394,6 +394,7 @@ IDL_BINDINGS += \
     html/DataGridColumnList.idl \
     html/File.idl \
     html/FileList.idl \
+    html/HTMLAllCollection.idl \
     html/HTMLAudioElement.idl \
     html/HTMLAnchorElement.idl \
     html/HTMLAppletElement.idl \
@@ -547,6 +548,7 @@ IDL_BINDINGS += \
     svg/SVGFEImageElement.idl \
     svg/SVGFEMergeElement.idl \
     svg/SVGFEMergeNodeElement.idl \
+    svg/SVGFEMorphologyElement.idl \
     svg/SVGFEOffsetElement.idl \
     svg/SVGFEPointLightElement.idl \
     svg/SVGFESpecularLightingElement.idl \
@@ -700,11 +702,12 @@ SOURCES += \
     bindings/js/JSEventSourceConstructor.cpp \
     bindings/js/JSEventSourceCustom.cpp \
     bindings/js/JSEventTarget.cpp \
+    bindings/js/JSExceptionBase.cpp \
     bindings/js/JSGeolocationCustom.cpp \
-    bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
     bindings/js/JSHTMLCanvasElementCustom.cpp \
+    bindings/js/JSHTMLAllCollectionCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDataGridElementCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -767,6 +770,7 @@ SOURCES += \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
     bindings/js/SerializedScriptValue.cpp \
+    bindings/ScriptControllerBase.cpp \
     bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
@@ -987,6 +991,7 @@ SOURCES += \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
+    html/HTMLAllCollection.cpp \
     html/HTMLAnchorElement.cpp \
     html/HTMLAppletElement.cpp \
     html/HTMLAreaElement.cpp \
@@ -1072,7 +1077,6 @@ SOURCES += \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
-    inspector/DOMDispatchTimelineItem.cpp \
     inspector/InspectorBackend.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
@@ -1081,7 +1085,7 @@ SOURCES += \
     inspector/InspectorFrontend.cpp \
     inspector/InspectorResource.cpp \
     inspector/InspectorTimelineAgent.cpp \
-    inspector/TimelineItem.cpp \
+    inspector/TimelineRecordFactory.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
@@ -1101,6 +1105,7 @@ SOURCES += \
     loader/DocumentThreadableLoader.cpp \
     loader/FormState.cpp \
     loader/FrameLoader.cpp \
+    loader/HistoryController.cpp \
     loader/FTPDirectoryDocument.cpp \
     loader/FTPDirectoryParser.cpp \
     loader/icon/IconLoader.cpp \
@@ -1119,6 +1124,7 @@ SOURCES += \
     loader/RedirectScheduler.cpp \
     loader/Request.cpp \
     loader/ResourceLoader.cpp \
+    loader/ResourceLoadNotifier.cpp \
     loader/SubresourceLoader.cpp \
     loader/TextDocument.cpp \
     loader/TextResourceDecoder.cpp \
@@ -1182,6 +1188,7 @@ SOURCES += \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
     platform/image-decoders/qt/RGBA32BufferQt.cpp \
+    platform/graphics/filters/FEGaussianBlur.cpp \
     platform/graphics/FontDescription.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
@@ -1397,7 +1404,6 @@ HEADERS += \
     bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
     bindings/js/JSHistoryCustom.h \
-    bindings/js/JSHTMLAllCollection.h \
     bindings/js/JSHTMLAppletElementCustom.h \
     bindings/js/JSHTMLEmbedElementCustom.h \
     bindings/js/JSHTMLInputElementCustom.h \
@@ -1658,6 +1664,7 @@ HEADERS += \
     html/File.h \
     html/FileList.h \
     html/FormDataList.h \
+    html/HTMLAllCollection.h \
     html/HTMLAnchorElement.h \
     html/HTMLAppletElement.h \
     html/HTMLAreaElement.h \
@@ -1747,7 +1754,6 @@ HEADERS += \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
-    inspector/DOMDispatchTimelineItem.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
@@ -1759,7 +1765,7 @@ HEADERS += \
     inspector/JavaScriptDebugServer.h \
     inspector/JavaScriptProfile.h \
     inspector/JavaScriptProfileNode.h \
-    inspector/TimelineItem.h \
+    inspector/TimelineRecordFactory.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
@@ -1868,6 +1874,7 @@ HEADERS += \
     platform/graphics/filters/FEColorMatrix.h \
     platform/graphics/filters/FEComponentTransfer.h \
     platform/graphics/filters/FEComposite.h \
+    platform/graphics/filters/FEGaussianBlur.h \
     platform/graphics/filters/FilterEffect.h \
     platform/graphics/filters/SourceAlpha.h \
     platform/graphics/filters/SourceGraphic.h \
@@ -2096,7 +2103,6 @@ HEADERS += \
     svg/graphics/filters/SVGFEDiffuseLighting.h \
     svg/graphics/filters/SVGFEDisplacementMap.h \
     svg/graphics/filters/SVGFEFlood.h \
-    svg/graphics/filters/SVGFEGaussianBlur.h \
     svg/graphics/filters/SVGFEImage.h \
     svg/graphics/filters/SVGFEMerge.h \
     svg/graphics/filters/SVGFEMorphology.h \
@@ -2160,6 +2166,7 @@ HEADERS += \
     svg/SVGFELightElement.h \
     svg/SVGFEMergeElement.h \
     svg/SVGFEMergeNodeElement.h \
+    svg/SVGFEMorphologyElement.h \
     svg/SVGFEOffsetElement.h \
     svg/SVGFEPointLightElement.h \
     svg/SVGFESpecularLightingElement.h \
@@ -2247,6 +2254,7 @@ HEADERS += \
     svg/SVGViewSpec.h \
     svg/SVGZoomAndPan.h \
     svg/SVGZoomEvent.h \
+    svg/SynchronizablePropertyController.h \
     wml/WMLAccessElement.h \
     wml/WMLAElement.h \
     wml/WMLAnchorElement.h \
@@ -2453,46 +2461,61 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
 
-    unix {
-        DEFINES += ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1
+    symbian {
+        SOURCES += \
+        plugins/symbian/PluginPackageSymbian.cpp \
+        plugins/symbian/PluginDatabaseSymbian.cpp \
+        plugins/symbian/PluginViewSymbian.cpp \
+        plugins/symbian/PluginContainerSymbian.cpp
 
-        mac {
-            SOURCES += \
-                plugins/mac/PluginPackageMac.cpp \
-                plugins/mac/PluginViewMac.cpp
-            OBJECTIVE_SOURCES += \
-                platform/text/mac/StringImplMac.mm \
-                platform/mac/WebCoreNSStringExtras.mm
-            INCLUDEPATH += platform/mac
-            # Note: XP_MACOSX is defined in npapi.h
-        } else {
-            !embedded: CONFIG += x11
-            SOURCES += \
-                plugins/qt/PluginContainerQt.cpp \
-                plugins/qt/PluginPackageQt.cpp \
-                plugins/qt/PluginViewQt.cpp
-            HEADERS += \
-                plugins/qt/PluginContainerQt.h
-            DEFINES += XP_UNIX
-        }
-    }
+        HEADERS += \
+        plugins/symbian/PluginContainerSymbian.h \
+        plugins/symbian/npinterface.h
 
-    win32-* {
-        INCLUDEPATH += $$PWD/plugins/win
-
-        SOURCES += page/win/PageWin.cpp \
-                   plugins/win/PluginDatabaseWin.cpp \
-                   plugins/win/PluginPackageWin.cpp \
-                   plugins/win/PluginMessageThrottlerWin.cpp \
-                   plugins/win/PluginViewWin.cpp
-
-        LIBS += \
-            -ladvapi32 \
-            -lgdi32 \
-            -lshell32 \
-            -lshlwapi \
-            -luser32 \
-            -lversion
+        LIBS += -lefsrv
+
+    } else {
+
+        unix {
+    
+            mac {
+                SOURCES += \
+                    plugins/mac/PluginPackageMac.cpp \
+                    plugins/mac/PluginViewMac.cpp
+                OBJECTIVE_SOURCES += \
+                    platform/text/mac/StringImplMac.mm \
+                    platform/mac/WebCoreNSStringExtras.mm
+                INCLUDEPATH += platform/mac
+                # Note: XP_MACOSX is defined in npapi.h
+            } else {
+                !embedded: CONFIG += x11
+                SOURCES += \
+                    plugins/qt/PluginContainerQt.cpp \
+                    plugins/qt/PluginPackageQt.cpp \
+                    plugins/qt/PluginViewQt.cpp
+                HEADERS += \
+                    plugins/qt/PluginContainerQt.h
+                DEFINES += XP_UNIX
+            }
+        }
+    
+        win32-* {
+            INCLUDEPATH += $$PWD/plugins/win
+    
+            SOURCES += page/win/PageWin.cpp \
+                       plugins/win/PluginDatabaseWin.cpp \
+                       plugins/win/PluginPackageWin.cpp \
+                       plugins/win/PluginMessageThrottlerWin.cpp \
+                       plugins/win/PluginViewWin.cpp
+    
+            LIBS += \
+                -ladvapi32 \
+                -lgdi32 \
+                -lshell32 \
+                -lshlwapi \
+                -luser32 \
+                -lversion
+        }
     }
 
 } else {
@@ -2537,8 +2560,7 @@ contains(DEFINES, ENABLE_SQLITE=1) {
             LIBS *= $$QT_LFLAGS_SQLITE
         } else {
             INCLUDEPATH += $${SQLITE3SRCDIR}
-            symbian: LIBS += -lsqlite3.lib
-            else: LIBS += -lsqlite3
+            LIBS += -lsqlite3
         }
     }
 
@@ -2756,6 +2778,7 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/FEColorMatrix.cpp \
         platform/graphics/filters/FEComponentTransfer.cpp \
         platform/graphics/filters/FEComposite.cpp \
+        platform/graphics/filters/FEGaussianBlur.cpp \
         platform/graphics/filters/FilterEffect.cpp \
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp
@@ -2900,6 +2923,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGFELightElement.cpp \
         svg/SVGFEMergeElement.cpp \
         svg/SVGFEMergeNodeElement.cpp \
+        svg/SVGFEMorphologyElement.cpp \
         svg/SVGFEOffsetElement.cpp \
         svg/SVGFEPointLightElement.cpp \
         svg/SVGFESpecularLightingElement.cpp \
@@ -2986,6 +3010,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGViewElement.cpp \
         svg/SVGViewSpec.cpp \
         svg/SVGZoomAndPan.cpp \
+        svg/SynchronizablePropertyController.cpp \
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
@@ -2993,7 +3018,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/filters/SVGFEDiffuseLighting.cpp \
         svg/graphics/filters/SVGFEDisplacementMap.cpp \
         svg/graphics/filters/SVGFEFlood.cpp \
-        svg/graphics/filters/SVGFEGaussianBlur.cpp \
         svg/graphics/filters/SVGFEImage.cpp \
         svg/graphics/filters/SVGFEMerge.cpp \
         svg/graphics/filters/SVGFEMorphology.cpp \
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.rc b/WebCore/WebCore.vcproj/QTMovieWin.rc
index 1ed0428..cbc8918 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.rc
+++ b/WebCore/WebCore.vcproj/QTMovieWin.rc
@@ -1,7 +1,7 @@
 // Microsoft Visual C++ generated resource script.
 //
 #include "autoversion.h"
-#include "winres.h"
+#include "winresrc.h"
 
 #ifdef _WIN32
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 5e54c67..714f6ee 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -232,6 +232,78 @@
 				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/WebCore/WebCore.vcproj/WebCore.make b/WebCore/WebCore.vcproj/WebCore.make
index 2c6148b..3a6d697 100644
--- a/WebCore/WebCore.vcproj/WebCore.make
+++ b/WebCore/WebCore.vcproj/WebCore.make
@@ -1,7 +1,7 @@
 !IF !defined(BUILDSTYLE)
 BUILDSTYLE=Release
 !ELSEIF "$(BUILDSTYLE)"=="DEBUG"
-BUILDSTYLE=Debug_Internal
+BUILDSTYLE=Debug_All
 !ENDIF
 
 install:
diff --git a/WebCore/WebCore.vcproj/WebCore.sln b/WebCore/WebCore.vcproj/WebCore.sln
index cfe5b84..aeb4d5c 100644
--- a/WebCore/WebCore.vcproj/WebCore.sln
+++ b/WebCore/WebCore.vcproj/WebCore.sln
@@ -13,23 +13,30 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "QTMovieWin", "QTMovieWin.vc
 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.ActiveCfg = Debug|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = all|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32

diff --git a/WebCore/WebCore.vcproj/WebCore.submit.sln b/WebCore/WebCore.vcproj/WebCore.submit.sln
index cc867db..07b5c0b 100644
--- a/WebCore/WebCore.vcproj/WebCore.submit.sln
+++ b/WebCore/WebCore.vcproj/WebCore.submit.sln
@@ -15,23 +15,30 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "QTMovieWin", "QTMovieWin.vc
 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.ActiveCfg = Debug|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = all|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32

diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index 9a9e3ec..d5ef6f4 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -292,6 +292,61 @@
 				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="4"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories=""

+				ForcedIncludeFiles=""

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLibrarianTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

@@ -352,6 +407,16 @@
 						ForcedIncludeFiles="$(NOINHERIT)"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						UsePrecompiledHeader="0"

+						DisableSpecificWarnings="4065;4273;4565;4701;4702"

+						ForcedIncludeFiles="$(NOINHERIT)"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSGrammar.h"

@@ -405,6 +470,15 @@
 						DisableSpecificWarnings="4819"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						UsePrecompiledHeader="0"

+						DisableSpecificWarnings="4819"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HTMLElementFactory.cpp"

@@ -465,6 +539,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSAbstractWorker.h"

@@ -513,6 +595,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSAttr.h"

@@ -561,12 +651,20 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBarInfo.h"

 				>

 			</File>

-                        <File

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeLoadEvent.cpp"

 				>

 				<FileConfiguration

@@ -609,6 +707,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeLoadEvent.h"

@@ -657,6 +763,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasGradient.h"

@@ -705,6 +819,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasPattern.h"

@@ -753,6 +875,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext.h"

@@ -801,6 +931,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext2D.h"

@@ -849,6 +987,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCDATASection.h"

@@ -897,6 +1043,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCharacterData.h"

@@ -945,6 +1099,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSClientRect.h"

@@ -993,6 +1155,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSClientRectList.h"

@@ -1041,6 +1211,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSClipboard.h"

@@ -1089,6 +1267,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSComment.h"

@@ -1137,6 +1323,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSConsole.h"

@@ -1185,6 +1379,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCoordinates.h"

@@ -1233,6 +1435,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCounter.h"

@@ -1281,6 +1491,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSCharsetRule.h"

@@ -1329,6 +1547,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSFontFaceRule.h"

@@ -1377,6 +1603,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSImportRule.h"

@@ -1425,6 +1659,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSMediaRule.h"

@@ -1473,6 +1715,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSPageRule.h"

@@ -1521,6 +1771,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSPrimitiveValue.h"

@@ -1569,6 +1827,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSRule.h"

@@ -1617,6 +1883,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSRuleList.h"

@@ -1665,6 +1939,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSStyleDeclaration.h"

@@ -1713,6 +1995,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSStyleRule.h"

@@ -1761,6 +2051,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSStyleSheet.h"

@@ -1809,6 +2107,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSValue.h"

@@ -1857,6 +2163,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSValueList.h"

@@ -1905,6 +2219,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSVariablesDeclaration.h"

@@ -1953,6 +2275,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCSSVariablesRule.h"

@@ -2001,6 +2331,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDatabase.h"

@@ -2049,6 +2387,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDataGridColumn.h"

@@ -2097,6 +2443,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDataGridColumnList.h"

@@ -2145,6 +2499,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSDedicatedWorkerContext.h"

@@ -2193,6 +2555,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDocument.h"

@@ -2241,6 +2611,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDocumentFragment.h"

@@ -2289,6 +2667,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDocumentType.h"

@@ -2337,6 +2723,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMApplicationCache.h"

@@ -2385,6 +2779,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMCoreException.h"

@@ -2433,6 +2835,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMImplementation.h"

@@ -2481,6 +2891,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMParser.h"

@@ -2529,6 +2947,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMSelection.h"

@@ -2577,6 +3003,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMWindow.h"

@@ -2629,6 +3063,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSElement.h"

@@ -2677,6 +3119,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntity.h"

@@ -2725,6 +3175,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntityReference.h"

@@ -2773,6 +3231,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSErrorEvent.h"

@@ -2821,6 +3287,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEvent.h"

@@ -2869,6 +3343,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEventException.h"

@@ -2917,6 +3399,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEventSource.h"

@@ -2965,6 +3455,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFile.h"

@@ -3013,6 +3511,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileList.h"

@@ -3061,6 +3567,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSGeolocation.h"

@@ -3109,6 +3623,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSGeoposition.h"

@@ -3157,12 +3679,76 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHistory.h"

 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAllCollection.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAllCollection.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAnchorElement.cpp"

 				>

 				<FileConfiguration

@@ -3205,6 +3791,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAnchorElement.h"

@@ -3253,6 +3847,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAppletElement.h"

@@ -3301,6 +3903,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAreaElement.h"

@@ -3349,6 +3959,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLAudioElement.h"

@@ -3397,6 +4015,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLBaseElement.h"

@@ -3445,6 +4071,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLBaseFontElement.h"

@@ -3493,6 +4127,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLBlockquoteElement.h"

@@ -3541,6 +4183,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLBodyElement.h"

@@ -3589,6 +4239,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLBRElement.h"

@@ -3637,6 +4295,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLButtonElement.h"

@@ -3685,6 +4351,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLCanvasElement.h"

@@ -3733,6 +4407,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLCollection.h"

@@ -3781,6 +4463,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataGridCellElement.h"

@@ -3829,6 +4519,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataGridColElement.h"

@@ -3877,6 +4575,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataGridElement.h"

@@ -3925,6 +4631,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataGridRowElement.h"

@@ -3973,6 +4687,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataListElement.h"

@@ -4021,6 +4743,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDirectoryElement.h"

@@ -4069,6 +4799,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDivElement.h"

@@ -4117,6 +4855,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDListElement.h"

@@ -4165,6 +4911,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDocument.h"

@@ -4213,6 +4967,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLElement.h"

@@ -4261,6 +5023,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLElementWrapperFactory.h"

@@ -4309,6 +5079,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLEmbedElement.h"

@@ -4357,6 +5135,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLFieldSetElement.h"

@@ -4405,6 +5191,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLFormElement.h"

@@ -4453,6 +5247,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLFrameElement.h"

@@ -4501,6 +5303,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath=".$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLFrameSetElement.h"

@@ -4549,6 +5359,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLHeadElement.h"

@@ -4597,6 +5415,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLHeadingElement.h"

@@ -4645,6 +5471,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLHRElement.h"

@@ -4693,6 +5527,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLHtmlElement.h"

@@ -4741,6 +5583,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLIFrameElement.h"

@@ -4789,6 +5639,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLImageElement.h"

@@ -4837,6 +5695,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLInputElement.h"

@@ -4885,6 +5751,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLIsIndexElement.h"

@@ -4933,6 +5807,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLLabelElement.h"

@@ -4981,6 +5863,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLLegendElement.h"

@@ -5029,6 +5919,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLLIElement.h"

@@ -5077,6 +5975,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLLinkElement.h"

@@ -5125,6 +6031,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLMapElement.h"

@@ -5173,6 +6087,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLMarqueeElement.h"

@@ -5221,6 +6143,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLMediaElement.h"

@@ -5269,6 +6199,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLMenuElement.h"

@@ -5317,6 +6255,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLMetaElement.h"

@@ -5365,6 +6311,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLModElement.h"

@@ -5413,6 +6367,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLObjectElement.h"

@@ -5461,6 +6423,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLOListElement.h"

@@ -5509,6 +6479,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLOptGroupElement.h"

@@ -5557,6 +6535,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLOptionElement.h"

@@ -5605,6 +6591,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLOptionsCollection.h"

@@ -5653,6 +6647,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLParagraphElement.h"

@@ -5701,6 +6703,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLParamElement.h"

@@ -5749,6 +6759,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLPreElement.h"

@@ -5797,6 +6815,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLQuoteElement.h"

@@ -5845,6 +6871,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLScriptElement.h"

@@ -5893,6 +6927,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLSelectElement.h"

@@ -5941,6 +6983,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLSourceElement.h"

@@ -5989,6 +7039,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLStyleElement.h"

@@ -6037,6 +7095,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTableCaptionElement.h"

@@ -6085,6 +7151,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTableCellElement.h"

@@ -6133,6 +7207,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTableColElement.h"

@@ -6181,6 +7263,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTableElement.h"

@@ -6229,6 +7319,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTableRowElement.h"

@@ -6277,6 +7375,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTableSectionElement.h"

@@ -6325,6 +7431,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTextAreaElement.h"

@@ -6373,6 +7487,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLTitleElement.h"

@@ -6421,6 +7543,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLUListElement.h"

@@ -6469,6 +7599,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLVideoElement.h"

@@ -6517,6 +7655,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSImageData.h"

@@ -6525,6 +7671,10 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

 				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

+				>

 				<FileConfiguration

 					Name="Debug|Win32"

 					ExcludedFromBuild="true"

@@ -6565,6 +7715,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

@@ -6609,10 +7767,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

-				>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.h"

@@ -6661,6 +7823,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSJavaScriptCallFrame.h"

@@ -6709,6 +7879,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSKeyboardEvent.h"

@@ -6757,6 +7935,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSLocation.h"

@@ -6805,6 +7991,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMedia.h"

@@ -6853,6 +8047,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMediaError.h"

@@ -6901,6 +8103,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMediaList.h"

@@ -6949,6 +8159,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMessageChannel.h"

@@ -6997,6 +8215,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMessageEvent.h"

@@ -7045,6 +8271,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMessagePort.h"

@@ -7093,6 +8327,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMimeType.h"

@@ -7141,6 +8383,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMimeTypeArray.h"

@@ -7189,6 +8439,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMouseEvent.h"

@@ -7237,6 +8495,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSMutationEvent.h"

@@ -7285,6 +8551,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNamedNodeMap.h"

@@ -7333,6 +8607,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNavigator.h"

@@ -7381,6 +8663,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNode.h"

@@ -7429,6 +8719,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNodeFilter.h"

@@ -7477,6 +8775,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNodeIterator.h"

@@ -7525,6 +8831,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNodeList.h"

@@ -7573,6 +8887,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotation.h"

@@ -7621,6 +8943,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotification.h"

@@ -7669,6 +8999,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotificationCenter.h"

@@ -7717,6 +9055,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.h"

@@ -7765,6 +9111,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPageTransitionEvent.h"

@@ -7813,6 +9167,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.h"

@@ -7861,6 +9223,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.h"

@@ -7909,6 +9279,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.h"

@@ -7957,6 +9335,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.h"

@@ -8005,6 +9391,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.h"

@@ -8053,6 +9447,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.h"

@@ -8101,6 +9503,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.h"

@@ -8149,6 +9559,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.h"

@@ -8197,6 +9615,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.h"

@@ -8245,6 +9671,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.h"

@@ -8293,6 +9727,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.h"

@@ -8341,6 +9783,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.h"

@@ -8389,6 +9839,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.h"

@@ -8437,6 +9895,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.h"

@@ -8485,6 +9951,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.h"

@@ -8533,6 +10007,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.h"

@@ -8581,6 +10063,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.h"

@@ -8629,6 +10119,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.h"

@@ -8677,6 +10175,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.h"

@@ -8725,6 +10231,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.h"

@@ -8773,6 +10287,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.h"

@@ -8821,6 +10343,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.h"

@@ -8869,6 +10399,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.h"

@@ -8917,6 +10455,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.h"

@@ -8965,6 +10511,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.h"

@@ -9013,6 +10567,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.h"

@@ -9061,6 +10623,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.h"

@@ -9109,6 +10679,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.h"

@@ -9157,6 +10735,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.h"

@@ -9205,6 +10791,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.h"

@@ -9253,6 +10847,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.h"

@@ -9301,6 +10903,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.h"

@@ -9349,6 +10959,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.h"

@@ -9397,6 +11015,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.h"

@@ -9445,6 +11071,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.h"

@@ -9493,6 +11127,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.h"

@@ -9541,6 +11183,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.h"

@@ -9589,6 +11239,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.h"

@@ -9637,6 +11295,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.h"

@@ -9685,6 +11351,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.h"

@@ -9733,6 +11407,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.h"

@@ -9781,6 +11463,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.h"

@@ -9829,6 +11519,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.h"

@@ -9877,6 +11575,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.h"

@@ -9925,6 +11631,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.h"

@@ -9973,6 +11687,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.h"

@@ -10021,6 +11743,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.h"

@@ -10069,6 +11799,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.h"

@@ -10117,6 +11855,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.h"

@@ -10165,6 +11911,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.h"

@@ -10221,6 +11975,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGEllipseElement.h"

@@ -10269,6 +12031,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGException.h"

@@ -10317,6 +12087,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEBlendElement.h"

@@ -10365,6 +12143,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEColorMatrixElement.h"

@@ -10413,6 +12199,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEComponentTransferElement.h"

@@ -10461,6 +12255,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFECompositeElement.h"

@@ -10509,6 +12311,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEDiffuseLightingElement.h"

@@ -10557,6 +12367,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEDisplacementMapElement.h"

@@ -10605,6 +12423,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEDistantLightElement.h"

@@ -10653,6 +12479,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEFloodElement.h"

@@ -10701,6 +12535,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEFuncAElement.h"

@@ -10749,6 +12591,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEFuncBElement.h"

@@ -10797,6 +12647,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEFuncGElement.h"

@@ -10845,6 +12703,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEFuncRElement.h"

@@ -10893,6 +12759,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEGaussianBlurElement.h"

@@ -10941,6 +12815,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEImageElement.h"

@@ -10989,6 +12871,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEMergeElement.h"

@@ -11037,6 +12927,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEMergeNodeElement.h"

@@ -11085,6 +12983,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEOffsetElement.h"

@@ -11133,6 +13039,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEPointLightElement.h"

@@ -11181,6 +13095,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFESpecularLightingElement.h"

@@ -11229,6 +13151,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFESpotLightElement.h"

@@ -11277,6 +13207,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFETileElement.h"

@@ -11325,6 +13263,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFETurbulenceElement.h"

@@ -11373,6 +13319,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFilterElement.h"

@@ -11421,6 +13375,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFontElement.h"

@@ -11469,6 +13431,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFontFaceElement.h"

@@ -11517,6 +13487,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFontFaceFormatElement.h"

@@ -11565,6 +13543,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFontFaceNameElement.h"

@@ -11613,6 +13599,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFontFaceSrcElement.h"

@@ -11661,6 +13655,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFontFaceUriElement.h"

@@ -11709,6 +13711,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGForeignObjectElement.h"

@@ -11757,6 +13767,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGGElement.h"

@@ -11805,6 +13823,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGGlyphElement.h"

@@ -11853,6 +13879,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGGradientElement.h"

@@ -11901,6 +13935,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGImageElement.h"

@@ -11949,6 +13991,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGLength.h"

@@ -11997,6 +14047,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGLengthList.h"

@@ -12045,6 +14103,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGLinearGradientElement.h"

@@ -12093,6 +14159,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGLineElement.h"

@@ -12141,6 +14215,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGMarkerElement.h"

@@ -12189,6 +14271,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGMaskElement.h"

@@ -12237,6 +14327,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGMatrix.h"

@@ -12285,6 +14383,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGMetadataElement.h"

@@ -12333,6 +14439,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGMissingGlyphElement.h"

@@ -12381,6 +14495,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGNumber.h"

@@ -12429,6 +14551,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGNumberList.h"

@@ -12477,6 +14607,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPaint.h"

@@ -12525,6 +14663,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathElement.h"

@@ -12573,6 +14719,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSeg.h"

@@ -12621,6 +14775,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegArcAbs.h"

@@ -12669,6 +14831,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegArcRel.h"

@@ -12717,6 +14887,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegClosePath.h"

@@ -12765,6 +14943,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoCubicAbs.h"

@@ -12813,6 +14999,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoCubicRel.h"

@@ -12861,6 +15055,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoCubicSmoothAbs.h"

@@ -12909,6 +15111,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoCubicSmoothRel.h"

@@ -12957,6 +15167,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoQuadraticAbs.h"

@@ -13005,6 +15223,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoQuadraticRel.h"

@@ -13053,6 +15279,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoQuadraticSmoothAbs.h"

@@ -13101,6 +15335,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegCurvetoQuadraticSmoothRel.h"

@@ -13149,6 +15391,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegLinetoAbs.h"

@@ -13197,6 +15447,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegLinetoHorizontalAbs.h"

@@ -13245,6 +15503,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegLinetoHorizontalRel.h"

@@ -13293,6 +15559,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegLinetoRel.h"

@@ -13341,6 +15615,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegLinetoVerticalAbs.h"

@@ -13389,6 +15671,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegLinetoVerticalRel.h"

@@ -13437,6 +15727,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegList.h"

@@ -13485,6 +15783,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegMovetoAbs.h"

@@ -13533,6 +15839,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPathSegMovetoRel.h"

@@ -13581,6 +15895,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPatternElement.h"

@@ -13629,6 +15951,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPoint.h"

@@ -13677,6 +16007,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPointList.h"

@@ -13725,6 +16063,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPolygonElement.h"

@@ -13773,6 +16119,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPolylineElement.h"

@@ -13821,6 +16175,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGPreserveAspectRatio.h"

@@ -13869,6 +16231,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGRadialGradientElement.h"

@@ -13917,6 +16287,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGRect.h"

@@ -13965,6 +16343,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGRectElement.h"

@@ -14013,6 +16399,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGRenderingIntent.h"

@@ -14061,6 +16455,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGScriptElement.h"

@@ -14109,6 +16511,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGSetElement.h"

@@ -14157,6 +16567,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGStopElement.h"

@@ -14205,6 +16623,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGStringList.h"

@@ -14253,6 +16679,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGStyleElement.h"

@@ -14301,6 +16735,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGSVGElement.h"

@@ -14349,6 +16791,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGSwitchElement.h"

@@ -14397,6 +16847,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGSymbolElement.h"

@@ -14445,6 +16903,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTextContentElement.h"

@@ -14493,6 +16959,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTextElement.h"

@@ -14541,6 +17015,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTextPathElement.h"

@@ -14589,6 +17071,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTextPositioningElement.h"

@@ -14637,6 +17127,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTitleElement.h"

@@ -14685,6 +17183,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTransform.h"

@@ -14733,6 +17239,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTransformList.h"

@@ -14781,6 +17295,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTRefElement.h"

@@ -14829,6 +17351,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGTSpanElement.h"

@@ -14877,6 +17407,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGUnitTypes.h"

@@ -14925,6 +17463,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGUseElement.h"

@@ -14973,6 +17519,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGViewElement.h"

@@ -15021,6 +17575,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGZoomEvent.h"

@@ -15069,6 +17631,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSText.h"

@@ -15117,6 +17687,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTextEvent.h"

@@ -15165,6 +17743,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTextMetrics.h"

@@ -15213,6 +17799,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTimeRanges.h"

@@ -15261,6 +17855,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTreeWalker.h"

@@ -15309,6 +17911,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSUIEvent.h"

@@ -15357,6 +17967,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSValidityState.h"

@@ -15405,6 +18023,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.h"

@@ -15453,6 +18079,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.h"

@@ -15501,6 +18135,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.h"

@@ -15549,6 +18191,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.h"

@@ -15597,6 +18247,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.h"

@@ -15645,6 +18303,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.h"

@@ -15693,6 +18359,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.h"

@@ -15741,6 +18415,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWebSocket.h"

@@ -15789,6 +18471,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWheelEvent.h"

@@ -15837,6 +18527,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWorker.h"

@@ -15885,6 +18583,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWorkerContext.h"

@@ -15937,6 +18643,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWorkerLocation.h"

@@ -15985,6 +18699,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWorkerNavigator.h"

@@ -16033,6 +18755,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXMLHttpRequest.h"

@@ -16081,6 +18811,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXMLHttpRequestException.h"

@@ -16129,6 +18867,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXMLHttpRequestProgressEvent.h"

@@ -16177,6 +18923,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXMLHttpRequestUpload.h"

@@ -16225,6 +18979,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXMLSerializer.h"

@@ -16273,6 +19035,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXPathEvaluator.h"

@@ -16321,6 +19091,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXPathException.h"

@@ -16369,6 +19147,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXPathExpression.h"

@@ -16417,6 +19203,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXPathNSResolver.h"

@@ -16465,6 +19259,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXPathResult.h"

@@ -16513,6 +19315,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSXSLTProcessor.h"

@@ -16623,6 +19433,16 @@
 						ForcedIncludeFiles="$(NOINHERIT)"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						UsePrecompiledHeader="0"

+						DisableSpecificWarnings="4065;4273;4565;4701;4702"

+						ForcedIncludeFiles="$(NOINHERIT)"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\XPathGrammar.h"

@@ -16633,8 +19453,60 @@
 			Name="accessibility"

 			>

 			<File

+				RelativePath="..\accessibility\AccessibilityAllInOne.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\accessibility\AccessibilityARIAGrid.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityARIAGrid.h"

@@ -16643,6 +19515,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityARIAGridCell.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityARIAGridCell.h"

@@ -16651,6 +19571,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityARIAGridRow.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityARIAGridRow.h"

@@ -16659,6 +19627,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityImageMapLink.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityImageMapLink.h"

@@ -16667,6 +19683,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityList.h"

@@ -16675,6 +19739,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityListBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityListBox.h"

@@ -16683,6 +19795,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityListBoxOption.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityListBoxOption.h"

@@ -16691,6 +19851,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityMediaControls.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityMediaControls.h"

@@ -16699,6 +19907,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityObject.h"

@@ -16707,6 +19963,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityRenderObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityRenderObject.h"

@@ -16715,6 +20019,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilitySlider.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilitySlider.h"

@@ -16723,6 +20075,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityTable.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityTable.h"

@@ -16731,6 +20131,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityTableCell.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityTableCell.h"

@@ -16739,6 +20187,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityTableColumn.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityTableColumn.h"

@@ -16747,6 +20243,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityTableHeaderContainer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityTableHeaderContainer.h"

@@ -16755,6 +20299,54 @@
 			<File

 				RelativePath="..\accessibility\AccessibilityTableRow.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AccessibilityTableRow.h"

@@ -16763,6 +20355,54 @@
 			<File

 				RelativePath="..\accessibility\AXObjectCache.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\accessibility\AXObjectCache.h"

@@ -17124,11 +20764,11 @@
 				RelativePath="..\page\Settings.h"

 				>

 			</File>

-                        <File

+			<File

 				RelativePath="..\page\UserContentURLPattern.cpp"

 				>

 			</File>

-                        <File

+			<File

 				RelativePath="..\page\UserContentURLPattern.h"

 				>

 			</File>

@@ -17206,6 +20846,14 @@
 							Name="VCCLCompilerTool"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\page\win\FrameCGWin.cpp"

@@ -17417,6 +21065,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\HistoryController.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\HistoryController.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\ImageDocument.cpp"

 				>

 			</File>

@@ -17557,6 +21213,14 @@
 				</FileConfiguration>

 			</File>

 			<File

+				RelativePath="..\loader\ResourceLoadNotifier.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\ResourceLoadNotifier.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\SubresourceLoader.cpp"

 				>

 			</File>

@@ -18186,6 +21850,14 @@
 							Name="VCCLCompilerTool"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\win\DragImageCGWin.cpp"

@@ -18367,6 +22039,15 @@
 							ForcedIncludeFiles="$(NOINHERIT)"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							UsePrecompiledHeader="0"

+							ForcedIncludeFiles="$(NOINHERIT)"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\win\WCDataObject.h"

@@ -18527,6 +22208,14 @@
 							AdditionalOptions="$(AnalyzeWithLargeStack)"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							AdditionalOptions="$(AnalyzeWithLargeStack)"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\graphics\Font.h"

@@ -18665,6 +22354,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\ImageBuffer.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\ImageBuffer.h"

 					>

 				</File>

@@ -18699,6 +22392,14 @@
 							Name="VCCLCompilerTool"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\graphics\ImageSource.h"

@@ -18866,6 +22567,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\FontDatabase.cpp"

@@ -18922,6 +22631,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\FontPlatformDataCGWin.cpp"

@@ -18990,6 +22707,14 @@
 								AdditionalOptions="$(AnalyzeWithLargeStack)"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+								AdditionalOptions="$(AnalyzeWithLargeStack)"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\GlyphPageTreeNodeCairoWin.cpp"

@@ -19018,6 +22743,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\GlyphPageTreeNodeCGWin.cpp"

@@ -19066,6 +22799,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\GraphicsContextCGWin.cpp"

@@ -19122,6 +22863,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\ImageCGWin.cpp"

@@ -19234,6 +22983,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\win\SimpleFontDataCGWin.cpp"

@@ -19706,6 +23463,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\FontCairo.cpp"

@@ -19734,6 +23499,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\GradientCairo.cpp"

@@ -19762,6 +23535,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\GraphicsContextCairo.cpp"

@@ -19790,6 +23571,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\GraphicsContextPlatformPrivateCairo.h"

@@ -19818,6 +23607,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\ImageBufferCairo.cpp"

@@ -19846,6 +23643,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\ImageCairo.cpp"

@@ -19874,6 +23679,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\PathCairo.cpp"

@@ -19902,6 +23715,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\PatternCairo.cpp"

@@ -19930,6 +23751,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\graphics\cairo\TransformationMatrixCairo.cpp"

@@ -19958,6 +23787,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -20044,6 +23881,78 @@
 						>

 					</File>

 				</Filter>

+				<Filter

+					Name="filters"

+					>

+					<File

+						RelativePath="..\platform\graphics\filters\FEBlend.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEBlend.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEColorMatrix.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEColorMatrix.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEComponentTransfer.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEComponentTransfer.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEComposite.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEComposite.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEGaussianBlur.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FEGaussianBlur.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\Filter.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FilterEffect.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\FilterEffect.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\SourceAlpha.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\SourceAlpha.h"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\SourceGraphic.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\platform\graphics\filters\SourceGraphic.h"

+						>

+					</File>

+				</Filter>

 			</Filter>

 			<Filter

 				Name="network"

@@ -20626,6 +24535,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\CookieJarCurl.cpp"

@@ -20654,6 +24571,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\DNSCurl.cpp"

@@ -20682,6 +24607,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\FormDataStreamCurl.cpp"

@@ -20710,6 +24643,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\FormDataStreamCurl.h"

@@ -20738,6 +24679,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceError.h"

@@ -20766,6 +24715,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceHandleCurl.cpp"

@@ -20794,6 +24751,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceHandleManager.cpp"

@@ -20822,6 +24787,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceHandleManager.h"

@@ -20850,6 +24823,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceRequest.h"

@@ -20878,6 +24859,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\ResourceResponse.h"

@@ -20906,6 +24895,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\network\curl\SocketStreamHandleCurl.cpp"

@@ -20934,6 +24931,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 			</Filter>

@@ -21167,6 +25172,14 @@
 							AdditionalOptions="$(AnalyzeWithLargeStack)"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							AdditionalOptions="$(AnalyzeWithLargeStack)"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\text\TextCodecICU.h"

@@ -21299,6 +25312,14 @@
 							Name="VCCustomBuildTool"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\image-decoders\ImageDecoder.h"

@@ -21327,6 +25348,14 @@
 							Name="VCCustomBuildTool"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<Filter

 					Name="cairo"

@@ -21358,6 +25387,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -21390,6 +25427,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\gif\GIFImageDecoder.h"

@@ -21418,6 +25463,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\gif\GIFImageReader.cpp"

@@ -21446,6 +25499,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\gif\GIFImageReader.h"

@@ -21474,6 +25535,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -21522,6 +25591,14 @@
 								DisableSpecificWarnings="4611"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\jpeg\JPEGImageDecoder.h"

@@ -21550,6 +25627,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -21598,6 +25683,14 @@
 								DisableSpecificWarnings="4611"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\png\PNGImageDecoder.h"

@@ -21626,6 +25719,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -21658,6 +25759,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\bmp\BMPImageDecoder.h"

@@ -21686,6 +25795,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\bmp\BMPImageReader.cpp"

@@ -21714,6 +25831,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\bmp\BMPImageReader.h"

@@ -21742,6 +25867,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -21774,6 +25907,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\ico\ICOImageDecoder.h"

@@ -21802,6 +25943,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 				<Filter

@@ -21834,6 +25983,14 @@
 								Name="VCCLCompilerTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

 					</File>

 					<File

 						RelativePath="..\platform\image-decoders\xbm\XBMImageDecoder.h"

@@ -21862,6 +26019,14 @@
 								Name="VCCustomBuildTool"

 							/>

 						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCustomBuildTool"

+							/>

+						</FileConfiguration>

 					</File>

 				</Filter>

 			</Filter>

@@ -21916,6 +26081,15 @@
 							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							ObjectFile="$(IntDir)\$(InputName)1.obj"

+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\animation\Animation.h"

@@ -21969,6 +26143,15 @@
 							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

 						/>

 					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+							ObjectFile="$(IntDir)\$(InputName)1.obj"

+							XMLDocumentationFileName="$(IntDir)\$(InputName)1.xdc"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\platform\animation\AnimationList.h"

@@ -23297,6 +27480,13 @@
 						Name="VCCustomBuildTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCustomBuildTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTreeAsText.cpp"

@@ -23818,6 +28008,15 @@
 						ForcedIncludeFiles="$(NOINHERIT)"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						UsePrecompiledHeader="0"

+						ForcedIncludeFiles="$(NOINHERIT)"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\xml\XPathParser.h"

@@ -23888,11 +28087,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\xml\XSLStyleSheetLibxslt.cpp"

+				RelativePath="..\xml\XSLStyleSheet.h"

 				>

 			</File>

 			<File

-				RelativePath="..\xml\XSLStyleSheet.h"

+				RelativePath="..\xml\XSLStyleSheetLibxslt.cpp"

 				>

 			</File>

 			<File

@@ -23908,11 +28107,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\xml\XSLTProcessorLibxslt.cpp"

+				RelativePath="..\xml\XSLTProcessor.h"

 				>

 			</File>

 			<File

-				RelativePath="..\xml\XSLTProcessor.h"

+				RelativePath="..\xml\XSLTProcessorLibxslt.cpp"

 				>

 			</File>

 			<File

@@ -23955,7 +28154,7 @@
 				RelativePath="..\dom\Attribute.h"

 				>

 			</File>

-                        <File

+			<File

 				RelativePath="..\dom\BeforeLoadEvent.h"

 				>

 			</File>

@@ -24560,11 +28759,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\dom\TransformSourceLibxslt.cpp"

+				RelativePath="..\dom\TransformSource.h"

 				>

 			</File>

 			<File

-				RelativePath="..\dom\TransformSource.h"

+				RelativePath="..\dom\TransformSourceLibxslt.cpp"

 				>

 			</File>

 			<File

@@ -25328,6 +29527,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLAllCollection.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLAllCollection.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLAnchorElement.cpp"

 				>

 				<FileConfiguration

@@ -25370,6 +29577,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLAnchorElement.h"

@@ -25418,6 +29633,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLAppletElement.h"

@@ -25466,6 +29689,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLAreaElement.h"

@@ -25514,6 +29745,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLAudioElement.h"

@@ -25562,6 +29801,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLBaseElement.h"

@@ -25610,6 +29857,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLBaseFontElement.h"

@@ -25658,6 +29913,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLBlockquoteElement.h"

@@ -25706,6 +29969,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLBodyElement.h"

@@ -25754,6 +30025,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLBRElement.h"

@@ -25802,6 +30081,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLButtonElement.h"

@@ -25850,6 +30137,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLCanvasElement.h"

@@ -25906,6 +30201,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDataGridCellElement.h"

@@ -25954,6 +30257,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDataGridColElement.h"

@@ -26002,6 +30313,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDataGridElement.h"

@@ -26050,6 +30369,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDataGridRowElement.h"

@@ -26106,6 +30433,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDirectoryElement.h"

@@ -26154,6 +30489,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDivElement.h"

@@ -26202,6 +30545,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDListElement.h"

@@ -26258,6 +30609,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLElement.h"

@@ -26310,6 +30669,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLEmbedElement.h"

@@ -26358,6 +30725,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFieldSetElement.h"

@@ -26406,6 +30781,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFontElement.h"

@@ -26462,6 +30845,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFormControlElement.h"

@@ -26510,6 +30901,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFormElement.h"

@@ -26558,6 +30957,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFrameElement.h"

@@ -26606,6 +31013,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFrameElementBase.h"

@@ -26654,6 +31069,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFrameOwnerElement.h"

@@ -26702,6 +31125,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLFrameSetElement.h"

@@ -26750,6 +31181,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLHeadElement.h"

@@ -26798,6 +31237,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLHeadingElement.h"

@@ -26846,6 +31293,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLHRElement.h"

@@ -26894,6 +31349,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLHtmlElement.h"

@@ -26942,6 +31405,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLIFrameElement.h"

@@ -26990,6 +31461,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLImageElement.h"

@@ -27046,6 +31525,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLInputElement.h"

@@ -27094,6 +31581,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLIsIndexElement.h"

@@ -27142,6 +31637,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLKeygenElement.h"

@@ -27190,6 +31693,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLLabelElement.h"

@@ -27238,6 +31749,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLLegendElement.h"

@@ -27286,6 +31805,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLLIElement.h"

@@ -27334,6 +31861,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLLinkElement.h"

@@ -27382,6 +31917,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLMapElement.h"

@@ -27430,6 +31973,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLMarqueeElement.h"

@@ -27478,6 +32029,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLMediaElement.h"

@@ -27526,6 +32085,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLMenuElement.h"

@@ -27574,6 +32141,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLMetaElement.h"

@@ -27622,6 +32197,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLModElement.h"

@@ -27694,6 +32277,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLObjectElement.h"

@@ -27742,6 +32333,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLOListElement.h"

@@ -27790,6 +32389,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLOptGroupElement.h"

@@ -27838,6 +32445,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLOptionElement.h"

@@ -27894,6 +32509,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLParagraphElement.h"

@@ -27942,6 +32565,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLParamElement.h"

@@ -28006,6 +32637,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLPlugInElement.h"

@@ -28054,6 +32693,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLPlugInImageElement.h"

@@ -28102,6 +32749,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLPreElement.h"

@@ -28150,6 +32805,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLQuoteElement.h"

@@ -28198,6 +32861,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLScriptElement.h"

@@ -28246,6 +32917,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLSelectElement.h"

@@ -28294,6 +32973,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLSourceElement.h"

@@ -28342,6 +33029,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLStyleElement.h"

@@ -28390,6 +33085,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableCaptionElement.h"

@@ -28438,6 +33141,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableCellElement.h"

@@ -28486,6 +33197,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableColElement.h"

@@ -28534,6 +33253,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableElement.h"

@@ -28582,6 +33309,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTablePartElement.h"

@@ -28630,6 +33365,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableRowElement.h"

@@ -28686,6 +33429,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTableSectionElement.h"

@@ -28734,6 +33485,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTextAreaElement.h"

@@ -28782,6 +33541,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLTitleElement.h"

@@ -28838,6 +33605,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLUListElement.h"

@@ -28886,6 +33661,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLVideoElement.h"

@@ -28943,6 +33726,10 @@
 		<Filter

 			Name="bindings"

 			>

+			<File

+				RelativePath="..\bindings\ScriptControllerBase.cpp"

+				>

+			</File>

 			<Filter

 				Name="js"

 				>

@@ -28963,27 +33750,27 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSCallbackData.cpp"

+					RelativePath="..\bindings\js\JSAbstractWorkerCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSCallbackData.h"

+					RelativePath="..\bindings\js\JSAttrCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSAbstractWorkerCustom.cpp"

+					RelativePath="..\bindings\js\JSAudioConstructor.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSAttrCustom.cpp"

+					RelativePath="..\bindings\js\JSAudioConstructor.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSAudioConstructor.cpp"

+					RelativePath="..\bindings\js\JSCallbackData.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSAudioConstructor.h"

+					RelativePath="..\bindings\js\JSCallbackData.h"

 					>

 				</File>

 				<File

@@ -29195,19 +33982,23 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSGeolocationCustom.cpp"

+					RelativePath="..\bindings\js\JSExceptionBase.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHistoryCustom.cpp"

+					RelativePath="..\bindings\js\JSExceptionBase.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLAllCollection.cpp"

+					RelativePath="..\bindings\js\JSGeolocationCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLAllCollection.h"

+					RelativePath="..\bindings\js\JSHistoryCustom.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSHTMLAllCollectionCustom.cpp"

 					>

 				</File>

 				<File

@@ -29996,10 +34787,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGFEFloodElement.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\svg\SVGFEFloodElement.h"

 				>

 			</File>

@@ -30435,6 +35222,10 @@
 				RelativePath="..\svg\SVGZoomEvent.h"

 				>

 			</File>

+			<File

+				RelativePath="..\svg\SynchronizablePropertyController.h"

+				>

+			</File>

 			<Filter

 				Name="animation"

 				>

@@ -30570,38 +35361,6 @@
 					Name="filters"

 					>

 					<File

-						RelativePath="..\platform\graphics\filters\FEBlend.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEBlend.h"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEColorMatrix.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEColorMatrix.h"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEComponentTransfer.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEComponentTransfer.h"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEComposite.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\FEComposite.h"

-						>

-					</File>

-					<File

 						RelativePath="..\svg\graphics\filters\SVGDistantLightSource.h"

 						>

 					</File>

@@ -30638,14 +35397,6 @@
 						>

 					</File>

 					<File

-						RelativePath="..\svg\graphics\filters\SVGFEGaussianBlur.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\svg\graphics\filters\SVGFEGaussianBlur.h"

-						>

-					</File>

-					<File

 						RelativePath="..\svg\graphics\filters\SVGFEImage.cpp"

 						>

 					</File>

@@ -30686,6 +35437,10 @@
 						>

 					</File>

 					<File

+						RelativePath="..\svg\graphics\filters\SVGFETile.cpp"

+						>

+					</File>

+					<File

 						RelativePath="..\svg\graphics\filters\SVGFETile.h"

 						>

 					</File>

@@ -30698,6 +35453,22 @@
 						>

 					</File>

 					<File

+						RelativePath="..\svg\graphics\filters\SVGFilter.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\svg\graphics\filters\SVGFilter.h"

+						>

+					</File>

+					<File

+						RelativePath="..\svg\graphics\filters\SVGFilterBuilder.cpp"

+						>

+					</File>

+					<File

+						RelativePath="..\svg\graphics\filters\SVGFilterBuilder.h"

+						>

+					</File>

+					<File

 						RelativePath="..\svg\graphics\filters\SVGLightSource.cpp"

 						>

 					</File>

@@ -31384,14 +36155,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\inspector\DOMDispatchTimelineItem.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\inspector\DOMDispatchTimelineItem.h"

-				>

-			</File>

-			<File

 				RelativePath="..\inspector\InspectorBackend.cpp"

 				>

 			</File>

@@ -31496,17 +36259,21 @@
 				>

 			</File>

 			<File

-				RelativePath="..\inspector\TimelineItem.cpp"

+				RelativePath="..\inspector\TimelineRecordFactory.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\inspector\TimelineItem.h"

+				RelativePath="..\inspector\TimelineRecordFactory.h"

 				>

 			</File>

 			<Filter

 				Name="front-end"

 				>

 				<File

+					RelativePath="..\inspector\front-end\AbstractTimelinePanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\BottomUpProfileDataGridTree.js"

 					>

 				</File>

@@ -31607,15 +36374,19 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\inspectorSyntaxHighlight.css"

+					RelativePath="..\inspector\front-end\inspector.html"

 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\inspector.html"

+					RelativePath="..\inspector\front-end\inspector.js"

 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\inspector.js"

+					RelativePath="..\inspector\front-end\InspectorControllerStub.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\inspectorSyntaxHighlight.css"

 					>

 				</File>

 				<File

@@ -31655,6 +36426,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ProfilesPanel.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\ProfileView.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\PropertiesSection.js"

 					>

 				</File>

@@ -31687,6 +36466,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ScriptsPanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\ScriptView.js"

 					>

 				</File>

@@ -31723,6 +36506,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TestController.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TextPrompt.js"

 					>

 				</File>

@@ -31731,6 +36518,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TimelinePanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TopDownProfileDataGridTree.js"

 					>

 				</File>

@@ -32030,6 +36821,14 @@
 						DisableSpecificWarnings="4819"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						DisableSpecificWarnings="4819"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\wml\WMLSelectElement.h"

@@ -32172,6 +36971,15 @@
 					DisableSpecificWarnings="4819"

 				/>

 			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_All|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					UsePrecompiledHeader="1"

+					DisableSpecificWarnings="4819"

+				/>

+			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\WebCorePrefix.h"

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 6923c15..8727a4d 100644
--- a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
 		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
diff --git a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index 73bde6c..d03e8e5 100644
--- a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -15,7 +15,7 @@
 	</ToolFiles>

 	<Configurations>

 		<Configuration

-			Name="Release|Win32"

+			Name="all|Win32"

 			OutputDirectory="$(WebKitOutputDir)\lib"

 			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

 			ConfigurationType="0"

diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index 16a1e42..7f8f811 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -90,6 +90,10 @@
 		087281580F26B9B600AFC596 /* OptionGroupElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087281540F26B9B600AFC596 /* OptionGroupElement.h */; };
 		08744BAA0EDB7D86004C9E63 /* WMLOnEventElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08744BA90EDB7D86004C9E63 /* WMLOnEventElement.cpp */; };
 		08744BAE0EDB7D92004C9E63 /* WMLOnEventElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08744BAD0EDB7D92004C9E63 /* WMLOnEventElement.h */; };
+		0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */; };
+		0878B1FE10874E3F00A55097 /* SynchronizablePropertyController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0878B1FA10874E3F00A55097 /* SynchronizablePropertyController.cpp */; };
+		0878B1FF10874E3F00A55097 /* SynchronizablePropertyController.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */; };
+		0878B20010874E3F00A55097 /* SynchronizableTypeWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */; };
 		087FFA0F0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 087FFA0D0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp */; };
 		087FFA100EFF3ED3009DBD88 /* WMLInsertedLegendElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087FFA0E0EFF3ED3009DBD88 /* WMLInsertedLegendElement.h */; };
 		08807B760ED709AB003F6975 /* WMLGoElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08807B6A0ED709AB003F6975 /* WMLGoElement.cpp */; };
@@ -639,6 +643,8 @@
 		31C0FF4C0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */; };
 		31C0FF4D0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */; };
 		31C0FF4E0E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */; };
+		3314ACEB10892086000F0E56 /* JSExceptionBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3314ACE910892086000F0E56 /* JSExceptionBase.cpp */; };
+		3314ACEC10892086000F0E56 /* JSExceptionBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 3314ACEA10892086000F0E56 /* JSExceptionBase.h */; };
 		33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationPresenter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503C9F10179AD7003B47E1 /* JSNotification.cpp */; };
 		33503CA410179AD7003B47E1 /* JSNotification.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA010179AD7003B47E1 /* JSNotification.h */; };
@@ -758,6 +764,7 @@
 		46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DA0B0D60170028EE36 /* aliasCursor.png */; };
 		46F9D5DE0B0D60170028EE36 /* noDropCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DB0B0D60170028EE36 /* noDropCursor.png */; };
 		46F9D5DF0B0D60170028EE36 /* progressCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DC0B0D60170028EE36 /* progressCursor.png */; };
+		492273A31083B3B100EE5C84 /* JSCanvasArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
@@ -1184,10 +1191,10 @@
 		65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AF09D14EE6000E61D7 /* UserAgentStyleSheetsData.cpp */; };
 		65FEA86909833ADE00BED4AB /* Page.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FEA86809833ADE00BED4AB /* Page.cpp */; };
 		72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72626E010EF022FE00A07E20 /* FontFastPath.cpp */; };
-		75092BFE104B80F9003DD168 /* DOMDispatchTimelineItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */; };
-		75092BFF104B80F9003DD168 /* DOMDispatchTimelineItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */; };
 		754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 754133A7102E00E800075D00 /* InspectorTimelineAgent.h */; };
 		754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */; };
+		7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */; };
+		7553CFE9108F473F00EA281E /* TimelineRecordFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7553CFE7108F473F00EA281E /* TimelineRecordFactory.cpp */; };
 		75793E830D0CE0B3007FC0AC /* MessageEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75793E800D0CE0B3007FC0AC /* MessageEvent.cpp */; };
 		75793E840D0CE0B3007FC0AC /* MessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793E810D0CE0B3007FC0AC /* MessageEvent.h */; };
 		75793EC80D0CE72D007FC0AC /* JSMessageEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75793EC60D0CE72D007FC0AC /* JSMessageEvent.cpp */; };
@@ -1195,8 +1202,6 @@
 		75793ED30D0CE85B007FC0AC /* DOMMessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */; };
 		75793ED40D0CE85B007FC0AC /* DOMMessageEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */; };
 		75793ED50D0CE85B007FC0AC /* DOMMessageEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */; };
-		75A94A03104B74FB0006673C /* TimelineItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75A94A01104B74FB0006673C /* TimelineItem.cpp */; };
-		75A94A04104B74FB0006673C /* TimelineItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 75A94A02104B74FB0006673C /* TimelineItem.h */; };
 		7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BACE106C2DCA007B0823 /* HaltablePlugin.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7693BACF106C2DCA007B0823 /* PluginHalter.cpp */; };
 		7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD0106C2DCA007B0823 /* PluginHalter.h */; };
@@ -1212,9 +1217,18 @@
 		7A74ECBD101839DA00BF939E /* JSInspectorBackendCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */; };
 		7AED3E050FBB1EAA00D2B03C /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */; };
 		7AED3E060FBB1EAA00D2B03C /* InspectorFrontend.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */; };
+		84224183107E77F400766A87 /* JSSVGFEMorphologyElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */; };
+		84224184107E77F400766A87 /* JSSVGFEMorphologyElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 84224182107E77F400766A87 /* JSSVGFEMorphologyElement.h */; };
+		8422418C107E786F00766A87 /* DOMSVGFEMorphologyElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 84224189107E786F00766A87 /* DOMSVGFEMorphologyElement.h */; };
+		8422418D107E786F00766A87 /* DOMSVGFEMorphologyElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 8422418A107E786F00766A87 /* DOMSVGFEMorphologyElement.mm */; };
+		8422418E107E786F00766A87 /* DOMSVGFEMorphologyElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 8422418B107E786F00766A87 /* DOMSVGFEMorphologyElementInternal.h */; };
+		84224193107E78A700766A87 /* SVGFEMorphologyElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84224190107E78A700766A87 /* SVGFEMorphologyElement.cpp */; };
+		84224194107E78A700766A87 /* SVGFEMorphologyElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 84224191107E78A700766A87 /* SVGFEMorphologyElement.h */; };
 		845E72F80FD261EE00A87D79 /* Filter.h in Headers */ = {isa = PBXBuildFile; fileRef = 845E72F70FD261EE00A87D79 /* Filter.h */; };
 		845E72FB0FD2623900A87D79 /* SVGFilter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 845E72F90FD2623900A87D79 /* SVGFilter.cpp */; };
 		845E72FC0FD2623900A87D79 /* SVGFilter.h in Headers */ = {isa = PBXBuildFile; fileRef = 845E72FA0FD2623900A87D79 /* SVGFilter.h */; };
+		84801954108BAFB300CB2B1F /* FEGaussianBlur.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84801952108BAFB300CB2B1F /* FEGaussianBlur.cpp */; };
+		84801955108BAFB300CB2B1F /* FEGaussianBlur.h in Headers */ = {isa = PBXBuildFile; fileRef = 84801953108BAFB300CB2B1F /* FEGaussianBlur.h */; };
 		849F77760EFEC6200090849D /* StrokeStyleApplier.h in Headers */ = {isa = PBXBuildFile; fileRef = 849F77750EFEC6200090849D /* StrokeStyleApplier.h */; };
 		84A81F3D0FC7DFF000955300 /* SourceAlpha.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84A81F3B0FC7DFF000955300 /* SourceAlpha.cpp */; };
 		84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F3C0FC7DFF000955300 /* SourceAlpha.h */; };
@@ -2192,7 +2206,6 @@
 		934F71420D5A6F4400018D69 /* ResourceError.h in Headers */ = {isa = PBXBuildFile; fileRef = 934F71410D5A6F4400018D69 /* ResourceError.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		934F71440D5A6F5300018D69 /* AuthenticationChallenge.h in Headers */ = {isa = PBXBuildFile; fileRef = 934F71430D5A6F5300018D69 /* AuthenticationChallenge.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		934FE9E50B5CA539003E4A73 /* FileChooser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 934FE9E40B5CA539003E4A73 /* FileChooser.cpp */; };
-		9350E70D0E87500B00189FFF /* JSHTMLAllCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */; };
 		9352071909BD3BA500F2038D /* StaticConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 9352071709BD3BA500F2038D /* StaticConstructors.h */; };
 		935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 935207BD09BD410A00F2038D /* LocalizedStrings.h */; };
 		935207C009BD412100F2038D /* LocalizedStringsMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 935207BF09BD412000F2038D /* LocalizedStringsMac.mm */; };
@@ -2349,10 +2362,15 @@
 		97059978107D975200A50A7C /* PolicyCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059974107D975200A50A7C /* PolicyCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97059975107D975200A50A7C /* PolicyChecker.cpp */; };
 		9705997A107D975200A50A7C /* PolicyChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059976107D975200A50A7C /* PolicyChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */; };
+		973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 973E325510883B7C005BC493 /* ResourceLoadNotifier.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 979F43D11075E44A0000F83B /* RedirectScheduler.cpp */; };
 		979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* RedirectScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97DCE20110807C750057D394 /* HistoryController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DCE1FF10807C750057D394 /* HistoryController.cpp */; };
+		97DCE20210807C750057D394 /* HistoryController.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DCE20010807C750057D394 /* HistoryController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */; };
 		97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */; };
+		97EF7DFE107E55B700D7C49C /* ScriptControllerBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */; };
 		A17C81220F2A5CF7005DAAEB /* HTMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */; };
 		A17C81230F2A5CF7005DAAEB /* HTMLElementFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */; };
 		A718760E0B2A120100A16ECE /* DragActions.h in Headers */ = {isa = PBXBuildFile; fileRef = A718760D0B2A120100A16ECE /* DragActions.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2386,6 +2404,9 @@
 		A7CFB3D20B7ED10A0070C32D /* DragImage.h in Headers */ = {isa = PBXBuildFile; fileRef = A7CFB3D00B7ED10A0070C32D /* DragImage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7CFB3D50B7ED1180070C32D /* DragImageMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A7CFB3D40B7ED1180070C32D /* DragImageMac.mm */; };
 		A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */; };
+		A7D20F62107F406900A80392 /* JSCanvasActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */; };
+		A7D20F63107F406900A80392 /* JSCanvasActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */; };
+		A7D20F6D107F438B00A80392 /* CanvasActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */; };
 		A7D27FC40E0A599F0079AD2B /* SVGFETile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D27FC30E0A599F0079AD2B /* SVGFETile.cpp */; };
 		A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */; };
@@ -2772,7 +2793,7 @@
 		A88DD4870B4629A300C02990 /* PathTraversalState.h in Headers */ = {isa = PBXBuildFile; fileRef = A88DD4860B4629A300C02990 /* PathTraversalState.h */; };
 		A88DD4890B4629B000C02990 /* PathTraversalState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A88DD4880B4629B000C02990 /* PathTraversalState.cpp */; };
 		A88FE3340E5EEE87008D8C0F /* GraphicsContextPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */; };
-		A89943280B42338800D7C802 /* BitmapImage.h in Headers */ = {isa = PBXBuildFile; fileRef = A89943260B42338700D7C802 /* BitmapImage.h */; };
+		A89943280B42338800D7C802 /* BitmapImage.h in Headers */ = {isa = PBXBuildFile; fileRef = A89943260B42338700D7C802 /* BitmapImage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A89943290B42338800D7C802 /* BitmapImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A89943270B42338700D7C802 /* BitmapImage.cpp */; };
 		A89CCC520F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */; };
 		A89CCC530F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */; };
@@ -3532,8 +3553,6 @@
 		B255997F0D00D8BA00BB825C /* SVGFEDisplacementMap.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598E50D00D8B900BB825C /* SVGFEDisplacementMap.h */; };
 		B25599800D00D8BA00BB825C /* SVGFEFlood.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598E60D00D8B900BB825C /* SVGFEFlood.cpp */; };
 		B25599810D00D8BA00BB825C /* SVGFEFlood.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598E70D00D8B900BB825C /* SVGFEFlood.h */; };
-		B25599820D00D8BA00BB825C /* SVGFEGaussianBlur.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598E80D00D8B900BB825C /* SVGFEGaussianBlur.cpp */; };
-		B25599830D00D8BA00BB825C /* SVGFEGaussianBlur.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598E90D00D8B900BB825C /* SVGFEGaussianBlur.h */; };
 		B25599840D00D8BA00BB825C /* SVGFEImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598EA0D00D8B900BB825C /* SVGFEImage.cpp */; };
 		B25599850D00D8BA00BB825C /* SVGFEImage.h in Headers */ = {isa = PBXBuildFile; fileRef = B25598EB0D00D8B900BB825C /* SVGFEImage.h */; };
 		B25599860D00D8BA00BB825C /* SVGFEMerge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25598EC0D00D8B900BB825C /* SVGFEMerge.cpp */; };
@@ -4227,7 +4246,6 @@
 		BC6D6E2609AF943500F59759 /* ScrollView.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6D6E2509AF943500F59759 /* ScrollView.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6DADEF0A195FDF00E5CD14 /* WebFontCache.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC6DADFA0A19602B00E5CD14 /* WebFontCache.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC6DADF90A19602B00E5CD14 /* WebFontCache.mm */; };
-		BC6DC7A10C1A4BFA004E2017 /* JSHTMLAllCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */; };
 		BC74DA371013F3F7007987AD /* RGBColor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC74DA351013F3F7007987AD /* RGBColor.h */; };
 		BC74DA381013F3F7007987AD /* RGBColor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC74DA361013F3F7007987AD /* RGBColor.cpp */; };
 		BC74DA481013F468007987AD /* JSRGBColor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC74DA461013F468007987AD /* JSRGBColor.cpp */; };
@@ -4296,6 +4314,8 @@
 		BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */; };
 		BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */; };
 		BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC946347107A936600857193 /* JSBeforeLoadEvent.h */; };
+		BC946EEF107FDBAC00857193 /* DOMBeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC946EED107FDBAC00857193 /* DOMBeforeLoadEvent.h */; };
+		BC946EF0107FDBAC00857193 /* DOMBeforeLoadEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC946EEE107FDBAC00857193 /* DOMBeforeLoadEvent.mm */; };
 		BC94D1080C274F88006BC617 /* PlatformScreenMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */; };
 		BC94D14E0C275C68006BC617 /* JSHistory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC94D14C0C275C68006BC617 /* JSHistory.cpp */; };
 		BC94D14F0C275C68006BC617 /* JSHistory.h in Headers */ = {isa = PBXBuildFile; fileRef = BC94D14D0C275C68006BC617 /* JSHistory.h */; };
@@ -4303,6 +4323,11 @@
 		BC94D1540C275C8B006BC617 /* History.h in Headers */ = {isa = PBXBuildFile; fileRef = BC94D1510C275C8B006BC617 /* History.h */; };
 		BC96DB430F3A880E00573CB3 /* RenderBoxModelObject.h in Headers */ = {isa = PBXBuildFile; fileRef = BC96DB420F3A880E00573CB3 /* RenderBoxModelObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC96DB460F3A882200573CB3 /* RenderBoxModelObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC96DB450F3A882200573CB3 /* RenderBoxModelObject.cpp */; };
+		BC97E23A109144950010D361 /* HTMLAllCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC97E238109144950010D361 /* HTMLAllCollection.h */; };
+		BC97E23B109144950010D361 /* HTMLAllCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC97E239109144950010D361 /* HTMLAllCollection.cpp */; };
+		BC97E412109154FA0010D361 /* JSHTMLAllCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC97E410109154FA0010D361 /* JSHTMLAllCollection.cpp */; };
+		BC97E413109154FA0010D361 /* JSHTMLAllCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BC97E411109154FA0010D361 /* JSHTMLAllCollection.h */; };
+		BC97E42C10915B060010D361 /* JSHTMLAllCollectionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC97E42B10915B060010D361 /* JSHTMLAllCollectionCustom.cpp */; };
 		BC98543D0CD3D98B00069BC1 /* JSConsole.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC98543B0CD3D98B00069BC1 /* JSConsole.cpp */; };
 		BC98543E0CD3D98C00069BC1 /* JSConsole.h in Headers */ = {isa = PBXBuildFile; fileRef = BC98543C0CD3D98B00069BC1 /* JSConsole.h */; };
 		BC98A27D0C0C9950004BEBF7 /* JSStyleSheetCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC98A27C0C0C9950004BEBF7 /* JSStyleSheetCustom.cpp */; };
@@ -5230,6 +5255,10 @@
 		087281540F26B9B600AFC596 /* OptionGroupElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OptionGroupElement.h; sourceTree = "<group>"; };
 		08744BA90EDB7D86004C9E63 /* WMLOnEventElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLOnEventElement.cpp; sourceTree = "<group>"; };
 		08744BAD0EDB7D92004C9E63 /* WMLOnEventElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLOnEventElement.h; sourceTree = "<group>"; };
+		0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGAnimatedProperty.h; sourceTree = "<group>"; };
+		0878B1FA10874E3F00A55097 /* SynchronizablePropertyController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SynchronizablePropertyController.cpp; sourceTree = "<group>"; };
+		0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SynchronizablePropertyController.h; sourceTree = "<group>"; };
+		0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SynchronizableTypeWrapper.h; sourceTree = "<group>"; };
 		087FFA0D0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLInsertedLegendElement.cpp; sourceTree = "<group>"; };
 		087FFA0E0EFF3ED3009DBD88 /* WMLInsertedLegendElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLInsertedLegendElement.h; sourceTree = "<group>"; };
 		08807B6A0ED709AB003F6975 /* WMLGoElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLGoElement.cpp; sourceTree = "<group>"; };
@@ -5822,6 +5851,8 @@
 		31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEvent.h; sourceTree = "<group>"; };
 		31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitTransitionEvent.mm; sourceTree = "<group>"; };
 		31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEventInternal.h; sourceTree = "<group>"; };
+		3314ACE910892086000F0E56 /* JSExceptionBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSExceptionBase.cpp; sourceTree = "<group>"; };
+		3314ACEA10892086000F0E56 /* JSExceptionBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExceptionBase.h; sourceTree = "<group>"; };
 		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = notifications/Notification.idl; sourceTree = "<group>"; };
 		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = notifications/Notification.h; sourceTree = "<group>"; };
 		33503C9910179A74003B47E1 /* NotificationPresenter.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationPresenter.h; path = notifications/NotificationPresenter.h; sourceTree = "<group>"; };
@@ -5960,6 +5991,7 @@
 		46F9D5DA0B0D60170028EE36 /* aliasCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = aliasCursor.png; sourceTree = "<group>"; };
 		46F9D5DB0B0D60170028EE36 /* noDropCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = noDropCursor.png; sourceTree = "<group>"; };
 		46F9D5DC0B0D60170028EE36 /* progressCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = progressCursor.png; sourceTree = "<group>"; };
+		492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayCustom.cpp; sourceTree = "<group>"; };
 		49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasGradient.cpp; path = canvas/CanvasGradient.cpp; sourceTree = "<group>"; };
 		49484FB4102CF23C00187DD3 /* CanvasGradient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasGradient.h; path = canvas/CanvasGradient.h; sourceTree = "<group>"; };
 		49484FB5102CF23C00187DD3 /* CanvasGradient.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasGradient.idl; path = canvas/CanvasGradient.idl; sourceTree = "<group>"; };
@@ -6449,10 +6481,10 @@
 		65F80697054D9F86008BF776 /* BlockExceptions.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BlockExceptions.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65FEA86809833ADE00BED4AB /* Page.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Page.cpp; sourceTree = "<group>"; };
 		72626E010EF022FE00A07E20 /* FontFastPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFastPath.cpp; sourceTree = "<group>"; };
-		75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMDispatchTimelineItem.cpp; sourceTree = "<group>"; };
-		75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDispatchTimelineItem.h; sourceTree = "<group>"; };
 		754133A7102E00E800075D00 /* InspectorTimelineAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTimelineAgent.h; sourceTree = "<group>"; };
 		754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTimelineAgent.cpp; sourceTree = "<group>"; };
+		7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TimelineRecordFactory.h; sourceTree = "<group>"; };
+		7553CFE7108F473F00EA281E /* TimelineRecordFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TimelineRecordFactory.cpp; sourceTree = "<group>"; };
 		75793E800D0CE0B3007FC0AC /* MessageEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; name = MessageEvent.cpp; path = dom/MessageEvent.cpp; sourceTree = SOURCE_ROOT; };
 		75793E810D0CE0B3007FC0AC /* MessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; name = MessageEvent.h; path = dom/MessageEvent.h; sourceTree = SOURCE_ROOT; };
 		75793E820D0CE0B3007FC0AC /* MessageEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; name = MessageEvent.idl; path = dom/MessageEvent.idl; sourceTree = SOURCE_ROOT; };
@@ -6461,8 +6493,6 @@
 		75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEvent.h; sourceTree = "<group>"; };
 		75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMessageEvent.mm; sourceTree = "<group>"; };
 		75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEventInternal.h; sourceTree = "<group>"; };
-		75A94A01104B74FB0006673C /* TimelineItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TimelineItem.cpp; sourceTree = "<group>"; };
-		75A94A02104B74FB0006673C /* TimelineItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TimelineItem.h; sourceTree = "<group>"; };
 		7693BACE106C2DCA007B0823 /* HaltablePlugin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HaltablePlugin.h; sourceTree = "<group>"; };
 		7693BACF106C2DCA007B0823 /* PluginHalter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginHalter.cpp; sourceTree = "<group>"; };
 		7693BAD0106C2DCA007B0823 /* PluginHalter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalter.h; sourceTree = "<group>"; };
@@ -6479,9 +6509,19 @@
 		7A74ECBC101839DA00BF939E /* JSInspectorBackendCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorBackendCustom.cpp; sourceTree = "<group>"; };
 		7AED3E030FBB1EAA00D2B03C /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
 		7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
+		84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFEMorphologyElement.cpp; sourceTree = "<group>"; };
+		84224182107E77F400766A87 /* JSSVGFEMorphologyElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFEMorphologyElement.h; sourceTree = "<group>"; };
+		84224189107E786F00766A87 /* DOMSVGFEMorphologyElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEMorphologyElement.h; sourceTree = "<group>"; };
+		8422418A107E786F00766A87 /* DOMSVGFEMorphologyElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGFEMorphologyElement.mm; sourceTree = "<group>"; };
+		8422418B107E786F00766A87 /* DOMSVGFEMorphologyElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEMorphologyElementInternal.h; sourceTree = "<group>"; };
+		84224190107E78A700766A87 /* SVGFEMorphologyElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEMorphologyElement.cpp; sourceTree = "<group>"; };
+		84224191107E78A700766A87 /* SVGFEMorphologyElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFEMorphologyElement.h; sourceTree = "<group>"; };
+		84224192107E78A700766A87 /* SVGFEMorphologyElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGFEMorphologyElement.idl; sourceTree = "<group>"; };
 		845E72F70FD261EE00A87D79 /* Filter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Filter.h; path = filters/Filter.h; sourceTree = "<group>"; };
 		845E72F90FD2623900A87D79 /* SVGFilter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFilter.cpp; sourceTree = "<group>"; };
 		845E72FA0FD2623900A87D79 /* SVGFilter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFilter.h; sourceTree = "<group>"; };
+		84801952108BAFB300CB2B1F /* FEGaussianBlur.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FEGaussianBlur.cpp; path = filters/FEGaussianBlur.cpp; sourceTree = "<group>"; };
+		84801953108BAFB300CB2B1F /* FEGaussianBlur.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FEGaussianBlur.h; path = filters/FEGaussianBlur.h; sourceTree = "<group>"; };
 		849F77750EFEC6200090849D /* StrokeStyleApplier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StrokeStyleApplier.h; sourceTree = "<group>"; };
 		84A81F3B0FC7DFF000955300 /* SourceAlpha.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SourceAlpha.cpp; path = filters/SourceAlpha.cpp; sourceTree = "<group>"; };
 		84A81F3C0FC7DFF000955300 /* SourceAlpha.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceAlpha.h; path = filters/SourceAlpha.h; sourceTree = "<group>"; };
@@ -7409,7 +7449,6 @@
 		934F71410D5A6F4400018D69 /* ResourceError.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ResourceError.h; sourceTree = "<group>"; };
 		934F71430D5A6F5300018D69 /* AuthenticationChallenge.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = AuthenticationChallenge.h; sourceTree = "<group>"; };
 		934FE9E40B5CA539003E4A73 /* FileChooser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileChooser.cpp; sourceTree = "<group>"; };
-		9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLAllCollection.cpp; sourceTree = "<group>"; };
 		9352071709BD3BA500F2038D /* StaticConstructors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StaticConstructors.h; sourceTree = "<group>"; };
 		935207BD09BD410A00F2038D /* LocalizedStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalizedStrings.h; sourceTree = "<group>"; };
 		935207BF09BD412000F2038D /* LocalizedStringsMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LocalizedStringsMac.mm; sourceTree = "<group>"; };
@@ -7542,10 +7581,15 @@
 		97059974107D975200A50A7C /* PolicyCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyCallback.h; sourceTree = "<group>"; };
 		97059975107D975200A50A7C /* PolicyChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolicyChecker.cpp; sourceTree = "<group>"; };
 		97059976107D975200A50A7C /* PolicyChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyChecker.h; sourceTree = "<group>"; };
+		973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadNotifier.cpp; sourceTree = "<group>"; };
+		973E325510883B7C005BC493 /* ResourceLoadNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadNotifier.h; sourceTree = "<group>"; };
 		979F43D11075E44A0000F83B /* RedirectScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RedirectScheduler.cpp; sourceTree = "<group>"; };
 		979F43D21075E44A0000F83B /* RedirectScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RedirectScheduler.h; sourceTree = "<group>"; };
+		97DCE1FF10807C750057D394 /* HistoryController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryController.cpp; sourceTree = "<group>"; };
+		97DCE20010807C750057D394 /* HistoryController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HistoryController.h; sourceTree = "<group>"; };
 		97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditor.cpp; sourceTree = "<group>"; };
 		97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditor.h; sourceTree = "<group>"; };
+		97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptControllerBase.cpp; sourceTree = "<group>"; };
 		A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElementFactory.cpp; sourceTree = "<group>"; };
 		A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLElementFactory.h; sourceTree = "<group>"; };
 		A718760D0B2A120100A16ECE /* DragActions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragActions.h; sourceTree = "<group>"; };
@@ -7580,6 +7624,10 @@
 		A7CFB3D00B7ED10A0070C32D /* DragImage.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DragImage.h; sourceTree = "<group>"; };
 		A7CFB3D40B7ED1180070C32D /* DragImageMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DragImageMac.mm; sourceTree = "<group>"; };
 		A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImageDataCustom.cpp; sourceTree = "<group>"; };
+		A7D20F3B107F373800A80392 /* CanvasActiveInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasActiveInfo.idl; path = canvas/CanvasActiveInfo.idl; sourceTree = "<group>"; };
+		A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasActiveInfo.cpp; sourceTree = "<group>"; };
+		A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasActiveInfo.h; sourceTree = "<group>"; };
+		A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasActiveInfo.h; path = canvas/CanvasActiveInfo.h; sourceTree = "<group>"; };
 		A7D27FC30E0A599F0079AD2B /* SVGFETile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFETile.cpp; sourceTree = "<group>"; };
 		A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardHelper.h; sourceTree = "<group>"; };
 		A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerScriptLoader.h; path = workers/WorkerScriptLoader.h; sourceTree = "<group>"; };
@@ -8613,8 +8661,6 @@
 		B25598E50D00D8B900BB825C /* SVGFEDisplacementMap.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFEDisplacementMap.h; sourceTree = "<group>"; };
 		B25598E60D00D8B900BB825C /* SVGFEFlood.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEFlood.cpp; sourceTree = "<group>"; };
 		B25598E70D00D8B900BB825C /* SVGFEFlood.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFEFlood.h; sourceTree = "<group>"; };
-		B25598E80D00D8B900BB825C /* SVGFEGaussianBlur.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEGaussianBlur.cpp; sourceTree = "<group>"; };
-		B25598E90D00D8B900BB825C /* SVGFEGaussianBlur.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFEGaussianBlur.h; sourceTree = "<group>"; };
 		B25598EA0D00D8B900BB825C /* SVGFEImage.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEImage.cpp; sourceTree = "<group>"; };
 		B25598EB0D00D8B900BB825C /* SVGFEImage.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGFEImage.h; sourceTree = "<group>"; };
 		B25598EC0D00D8B900BB825C /* SVGFEMerge.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEMerge.cpp; sourceTree = "<group>"; };
@@ -9325,7 +9371,6 @@
 		BC6D6E2509AF943500F59759 /* ScrollView.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ScrollView.h; sourceTree = "<group>"; };
 		BC6DADEE0A195FDF00E5CD14 /* WebFontCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebFontCache.h; sourceTree = "<group>"; };
 		BC6DADF90A19602B00E5CD14 /* WebFontCache.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebFontCache.mm; sourceTree = "<group>"; };
-		BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLAllCollection.h; sourceTree = "<group>"; };
 		BC74DA351013F3F7007987AD /* RGBColor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RGBColor.h; sourceTree = "<group>"; };
 		BC74DA361013F3F7007987AD /* RGBColor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RGBColor.cpp; sourceTree = "<group>"; };
 		BC74DA461013F468007987AD /* JSRGBColor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSRGBColor.cpp; sourceTree = "<group>"; };
@@ -9400,6 +9445,8 @@
 		BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BeforeLoadEvent.h; sourceTree = "<group>"; };
 		BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBeforeLoadEvent.cpp; sourceTree = "<group>"; };
 		BC946347107A936600857193 /* JSBeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBeforeLoadEvent.h; sourceTree = "<group>"; };
+		BC946EED107FDBAC00857193 /* DOMBeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMBeforeLoadEvent.h; sourceTree = "<group>"; };
+		BC946EEE107FDBAC00857193 /* DOMBeforeLoadEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMBeforeLoadEvent.mm; sourceTree = "<group>"; };
 		BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformScreenMac.mm; sourceTree = "<group>"; };
 		BC94D14C0C275C68006BC617 /* JSHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHistory.cpp; sourceTree = "<group>"; };
 		BC94D14D0C275C68006BC617 /* JSHistory.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHistory.h; sourceTree = "<group>"; };
@@ -9408,6 +9455,12 @@
 		BC94D1520C275C8B006BC617 /* History.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = History.idl; sourceTree = "<group>"; };
 		BC96DB420F3A880E00573CB3 /* RenderBoxModelObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderBoxModelObject.h; sourceTree = "<group>"; };
 		BC96DB450F3A882200573CB3 /* RenderBoxModelObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderBoxModelObject.cpp; sourceTree = "<group>"; };
+		BC97E238109144950010D361 /* HTMLAllCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLAllCollection.h; sourceTree = "<group>"; };
+		BC97E239109144950010D361 /* HTMLAllCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLAllCollection.cpp; sourceTree = "<group>"; };
+		BC97E23C109146F10010D361 /* HTMLAllCollection.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLAllCollection.idl; sourceTree = "<group>"; };
+		BC97E410109154FA0010D361 /* JSHTMLAllCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLAllCollection.cpp; sourceTree = "<group>"; };
+		BC97E411109154FA0010D361 /* JSHTMLAllCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLAllCollection.h; sourceTree = "<group>"; };
+		BC97E42B10915B060010D361 /* JSHTMLAllCollectionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLAllCollectionCustom.cpp; sourceTree = "<group>"; };
 		BC98543B0CD3D98B00069BC1 /* JSConsole.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSConsole.cpp; sourceTree = "<group>"; };
 		BC98543C0CD3D98B00069BC1 /* JSConsole.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSConsole.h; sourceTree = "<group>"; };
 		BC98A27C0C0C9950004BEBF7 /* JSStyleSheetCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStyleSheetCustom.cpp; sourceTree = "<group>"; };
@@ -9924,9 +9977,9 @@
 				93F19B1708245E59001E9ABC /* libicucore.dylib in Frameworks */,
 				1CFAE3230A6D6A3F0032593D /* libobjc.dylib in Frameworks */,
 				DD763BB20992C2C900740B8E /* libxml2.dylib in Frameworks */,
+				49C7BA791042EFAE0009D447 /* OpenGL.framework in Frameworks */,
 				A88AD52F09524B92001DD196 /* QuartzCore.framework in Frameworks */,
 				1A7FA7CC0DDA4B770028F8A5 /* SystemConfiguration.framework in Frameworks */,
-				49C7BA791042EFAE0009D447 /* OpenGL.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -9985,7 +10038,6 @@
 		0867D69AFE84028FC02AAC07 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
-				49C7BA781042EFAE0009D447 /* OpenGL.framework */,
 				F5C2869302846DCD018635CA /* ApplicationServices.framework */,
 				F5C2869402846DCD018635CA /* Carbon.framework */,
 				F5C2869502846DCD018635CA /* Cocoa.framework */,
@@ -9993,6 +10045,7 @@
 				93F1D31A0558CC5C00821BC0 /* libicucore.dylib */,
 				1CFAE3220A6D6A3F0032593D /* libobjc.dylib */,
 				DD763BB10992C2C900740B8E /* libxml2.dylib */,
+				49C7BA781042EFAE0009D447 /* OpenGL.framework */,
 				A85D7A2F0879EBA9006A9172 /* QuartzCore.framework */,
 				1A7FA7CB0DDA4B770028F8A5 /* SystemConfiguration.framework */,
 			);
@@ -10217,10 +10270,6 @@
 		1AE82EC90CAAE177002237AE /* storage */ = {
 			isa = PBXGroup;
 			children = (
-				B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */,
-				B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */,
-				B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */,
-				B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */,
 				514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */,
 				514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */,
 				5196115E0CAC56570010A80C /* Database.cpp */,
@@ -10260,6 +10309,10 @@
 				1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */,
 				1A7CCB230CD946FD00B7B64E /* SQLTransaction.idl */,
 				1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */,
+				B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */,
+				B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */,
+				B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */,
+				B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */,
 				1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */,
 				51E3F9C50DA059DC00250911 /* Storage.cpp */,
 				51E3F9C40DA059DC00250911 /* Storage.h */,
@@ -10303,12 +10356,6 @@
 		1C81B94D0E9732D900266E07 /* inspector */ = {
 			isa = PBXGroup;
 			children = (
-				75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */,
-				75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */,
-				75A94A01104B74FB0006673C /* TimelineItem.cpp */,
-				75A94A02104B74FB0006673C /* TimelineItem.h */,
-				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
-				754133A7102E00E800075D00 /* InspectorTimelineAgent.h */,
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
@@ -10328,6 +10375,8 @@
 				7AED3E040FBB1EAA00D2B03C /* InspectorFrontend.h */,
 				41F062000F5F0B6600A07EAC /* InspectorResource.cpp */,
 				41F061FF0F5F0B6600A07EAC /* InspectorResource.h */,
+				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
+				754133A7102E00E800075D00 /* InspectorTimelineAgent.h */,
 				1C81BA030E97348300266E07 /* JavaScriptCallFrame.cpp */,
 				1C81BA040E97348300266E07 /* JavaScriptCallFrame.h */,
 				1C81BA050E97348300266E07 /* JavaScriptCallFrame.idl */,
@@ -10339,6 +10388,8 @@
 				1C81B9FC0E9733CB00266E07 /* JavaScriptProfileNode.cpp */,
 				1C81B9FB0E9733CB00266E07 /* JavaScriptProfileNode.h */,
 				BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */,
+				7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */,
+				7553CFE7108F473F00EA281E /* TimelineRecordFactory.cpp */,
 			);
 			path = inspector;
 			sourceTree = "<group>";
@@ -10483,13 +10534,13 @@
 			isa = PBXGroup;
 			children = (
 				33503CC61017A1B1003B47E1 /* Notification.cpp */,
-				33503C9910179A74003B47E1 /* NotificationPresenter.h */,
+				333F704F0FB49CA2008E12A6 /* Notification.h */,
+				333F704E0FB49CA2008E12A6 /* Notification.idl */,
 				3390CA510FFC157B00921962 /* NotificationCenter.cpp */,
 				3390CA520FFC157B00921962 /* NotificationCenter.h */,
 				3390CA530FFC157B00921962 /* NotificationCenter.idl */,
 				3390CA540FFC157B00921962 /* NotificationContents.h */,
-				333F704E0FB49CA2008E12A6 /* Notification.idl */,
-				333F704F0FB49CA2008E12A6 /* Notification.h */,
+				33503C9910179A74003B47E1 /* NotificationPresenter.h */,
 			);
 			name = notifications;
 			sourceTree = "<group>";
@@ -10508,16 +10559,16 @@
 		449195900FBE175B00D9F824 /* Exports */ = {
 			isa = PBXGroup;
 			children = (
-				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
 				0F9C6F4B1073EF0400DED9BF /* WebCore.3DRendering.exp */,
+				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
 				FEFD102C105C41470002855E /* WebCore.ContextMenus.exp */,
 				4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */,
 				FEA4133F105D67AE0007236F /* WebCore.DragSupport.exp */,
 				FE49BD301061719100D0E1AE /* WebCore.Inspector.exp */,
 				4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */,
-				4491959B0FBE17D700D9F824 /* WebCore.PluginHostProcess.exp */,
 				4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */,
 				FE136AE710643BE50078CF6D /* WebCore.OrientationEvents.exp */,
+				4491959B0FBE17D700D9F824 /* WebCore.PluginHostProcess.exp */,
 				449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */,
 				449195980FBE17D700D9F824 /* WebCore.SVG.exp */,
 				449195970FBE17D700D9F824 /* WebCore.SVG.Filters.exp */,
@@ -10532,6 +10583,8 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
+				A7D20F6B107F438B00A80392 /* CanvasActiveInfo.h */,
+				A7D20F3B107F373800A80392 /* CanvasActiveInfo.idl */,
 				49EECDC710503C2300099FAB /* CanvasArray.cpp */,
 				49EECDC810503C2300099FAB /* CanvasArray.h */,
 				49EECDC910503C2300099FAB /* CanvasArray.idl */,
@@ -10809,14 +10862,14 @@
 		518A34BD1026C831001B6896 /* websockets */ = {
 			isa = PBXGroup;
 			children = (
-				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
-				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
-				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
-				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
-				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
 				518A34BE1026C831001B6896 /* WebSocket.cpp */,
 				518A34BF1026C831001B6896 /* WebSocket.h */,
 				518A34C01026C831001B6896 /* WebSocket.idl */,
+				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
+				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
+				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
+				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
+				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
 			);
 			path = websockets;
 			sourceTree = "<group>";
@@ -11489,6 +11542,9 @@
 				8502AB320AD438C000378540 /* DOMSVGFEMergeNodeElement.h */,
 				8502AB330AD438C000378540 /* DOMSVGFEMergeNodeElement.mm */,
 				A8E544610CA9D1C20097D09B /* DOMSVGFEMergeNodeElementInternal.h */,
+				84224189107E786F00766A87 /* DOMSVGFEMorphologyElement.h */,
+				8422418A107E786F00766A87 /* DOMSVGFEMorphologyElement.mm */,
+				8422418B107E786F00766A87 /* DOMSVGFEMorphologyElementInternal.h */,
 				8502AB340AD438C000378540 /* DOMSVGFEOffsetElement.h */,
 				8502AB350AD438C000378540 /* DOMSVGFEOffsetElement.mm */,
 				A8E5445F0CA9D1C20097D09B /* DOMSVGFEOffsetElementInternal.h */,
@@ -11784,6 +11840,8 @@
 		85AFA7AB0AAF3BB000E84305 /* Events */ = {
 			isa = PBXGroup;
 			children = (
+				BC946EED107FDBAC00857193 /* DOMBeforeLoadEvent.h */,
+				BC946EEE107FDBAC00857193 /* DOMBeforeLoadEvent.mm */,
 				85AFA8200AAF528A00E84305 /* DOMEvent.h */,
 				85AFA8210AAF528A00E84305 /* DOMEvent.mm */,
 				85D2AD670AB1A40A00C313EA /* DOMEventListener.h */,
@@ -12438,6 +12496,9 @@
 				A8DF3FC9097FA0FB0052981B /* HTMLCollection.cpp */,
 				A8DF3FC8097FA0FB0052981B /* HTMLCollection.h */,
 				85DF2F690AA3C74300AD64C5 /* HTMLCollection.idl */,
+				BC97E23C109146F10010D361 /* HTMLAllCollection.idl */,
+				BC97E238109144950010D361 /* HTMLAllCollection.h */,
+				BC97E239109144950010D361 /* HTMLAllCollection.cpp */,
 				BC77CDB70FEFF1210070887B /* HTMLDataGridCellElement.cpp */,
 				BC77CDBB0FEFF1420070887B /* HTMLDataGridCellElement.h */,
 				BC77CDA20FEFEB530070887B /* HTMLDataGridCellElement.idl */,
@@ -12667,6 +12728,8 @@
 		A75E8B7F0E1DE2B0007F2481 /* filters */ = {
 			isa = PBXGroup;
 			children = (
+				84801952108BAFB300CB2B1F /* FEGaussianBlur.cpp */,
+				84801953108BAFB300CB2B1F /* FEGaussianBlur.h */,
 				A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */,
 				A75E8B810E1DE2D6007F2481 /* FEBlend.h */,
 				A75E8B820E1DE2D6007F2481 /* FEColorMatrix.cpp */,
@@ -12689,6 +12752,8 @@
 		A83B79080CCAFF2B000B0825 /* HTML */ = {
 			isa = PBXGroup;
 			children = (
+				A7D20F60107F406900A80392 /* JSCanvasActiveInfo.cpp */,
+				A7D20F61107F406900A80392 /* JSCanvasActiveInfo.h */,
 				49EECF19105072F300099FAB /* JSCanvasArray.cpp */,
 				49EECF1A105072F300099FAB /* JSCanvasArray.h */,
 				49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */,
@@ -12737,6 +12802,8 @@
 				BC00F0110E0A189500FD04E3 /* JSFile.h */,
 				BC00F0120E0A189500FD04E3 /* JSFileList.cpp */,
 				BC00F0130E0A189500FD04E3 /* JSFileList.h */,
+				BC97E410109154FA0010D361 /* JSHTMLAllCollection.cpp */,
+				BC97E411109154FA0010D361 /* JSHTMLAllCollection.h */,
 				1A4A2DEB0A1B852A00C807F8 /* JSHTMLAnchorElement.cpp */,
 				1A4A2DEC0A1B852A00C807F8 /* JSHTMLAnchorElement.h */,
 				1A4A2DED0A1B852A00C807F8 /* JSHTMLAppletElement.cpp */,
@@ -12988,6 +13055,8 @@
 				B2FA3C9F0AB75A6E000E5AC4 /* JSSVGFEMergeElement.h */,
 				B2FA3CA00AB75A6E000E5AC4 /* JSSVGFEMergeNodeElement.cpp */,
 				B2FA3CA10AB75A6E000E5AC4 /* JSSVGFEMergeNodeElement.h */,
+				84224181107E77F400766A87 /* JSSVGFEMorphologyElement.cpp */,
+				84224182107E77F400766A87 /* JSSVGFEMorphologyElement.h */,
 				B2FA3CA20AB75A6E000E5AC4 /* JSSVGFEOffsetElement.cpp */,
 				B2FA3CA30AB75A6E000E5AC4 /* JSSVGFEOffsetElement.h */,
 				B2FA3CA40AB75A6E000E5AC4 /* JSSVGFEPointLightElement.cpp */,
@@ -13431,6 +13500,7 @@
 				B22277F20D00BF1F0071B782 /* SVGAnimatedPoints.h */,
 				B22277F30D00BF1F0071B782 /* SVGAnimatedPoints.idl */,
 				B22277F40D00BF1F0071B782 /* SVGAnimatedPreserveAspectRatio.idl */,
+				0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */,
 				B22277F50D00BF1F0071B782 /* SVGAnimatedRect.idl */,
 				B22277F60D00BF1F0071B782 /* SVGAnimatedString.idl */,
 				B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */,
@@ -13540,6 +13610,9 @@
 				B22278600D00BF200071B782 /* SVGFEMergeNodeElement.cpp */,
 				B22278610D00BF200071B782 /* SVGFEMergeNodeElement.h */,
 				B22278620D00BF200071B782 /* SVGFEMergeNodeElement.idl */,
+				84224190107E78A700766A87 /* SVGFEMorphologyElement.cpp */,
+				84224191107E78A700766A87 /* SVGFEMorphologyElement.h */,
+				84224192107E78A700766A87 /* SVGFEMorphologyElement.idl */,
 				B22278630D00BF200071B782 /* SVGFEOffsetElement.cpp */,
 				B22278640D00BF200071B782 /* SVGFEOffsetElement.h */,
 				B22278650D00BF200071B782 /* SVGFEOffsetElement.idl */,
@@ -13816,6 +13889,9 @@
 				B2E4EC940D00C22B00432643 /* SVGZoomEvent.cpp */,
 				B2E4EC950D00C22B00432643 /* SVGZoomEvent.h */,
 				B2E4EC960D00C22B00432643 /* SVGZoomEvent.idl */,
+				0878B1FA10874E3F00A55097 /* SynchronizablePropertyController.cpp */,
+				0878B1FB10874E3F00A55097 /* SynchronizablePropertyController.h */,
+				0878B1FC10874E3F00A55097 /* SynchronizableTypeWrapper.h */,
 				B28C6A260D00C44800334AA4 /* xlinkattrs.in */,
 			);
 			path = svg;
@@ -13866,8 +13942,6 @@
 				B25598E50D00D8B900BB825C /* SVGFEDisplacementMap.h */,
 				B25598E60D00D8B900BB825C /* SVGFEFlood.cpp */,
 				B25598E70D00D8B900BB825C /* SVGFEFlood.h */,
-				B25598E80D00D8B900BB825C /* SVGFEGaussianBlur.cpp */,
-				B25598E90D00D8B900BB825C /* SVGFEGaussianBlur.h */,
 				B25598EA0D00D8B900BB825C /* SVGFEImage.cpp */,
 				B25598EB0D00D8B900BB825C /* SVGFEImage.h */,
 				B25598EC0D00D8B900BB825C /* SVGFEMerge.cpp */,
@@ -13942,8 +14016,8 @@
 				B2AFFC790D00A5C10030074D /* FontPlatformData.h */,
 				B2AFFC7A0D00A5C10030074D /* FontPlatformDataMac.mm */,
 				B2AFFC7B0D00A5C10030074D /* GlyphPageTreeNodeMac.cpp */,
-				B277B4030B22F37C0004BEC6 /* GraphicsContextMac.mm */,
 				49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */,
+				B277B4030B22F37C0004BEC6 /* GraphicsContextMac.mm */,
 				0F580B040F12A2550051D689 /* GraphicsLayerCA.h */,
 				0F580B030F12A2540051D689 /* GraphicsLayerCA.mm */,
 				B275358D0B053A66002CE64F /* IconMac.mm */,
@@ -14014,8 +14088,8 @@
 				BC53C5F40DA56B920021EB5D /* Gradient.h */,
 				B2A015920AF6CD53006BCE0E /* GraphicsContext.cpp */,
 				B2A015930AF6CD53006BCE0E /* GraphicsContext.h */,
-				A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */,
 				49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */,
+				A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */,
 				0F580B090F12A2690051D689 /* GraphicsLayer.cpp */,
 				0F580B0A0F12A2690051D689 /* GraphicsLayer.h */,
 				0F580B0B0F12A2690051D689 /* GraphicsLayerClient.h */,
@@ -14148,10 +14222,10 @@
 		B2F34FE70E82F81700F627CD /* cf */ = {
 			isa = PBXGroup;
 			children = (
+				B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */,
+				51ABAE1A103C18FF008C5260 /* SocketStreamError.h */,
 				51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */,
 				51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */,
-				51ABAE1A103C18FF008C5260 /* SocketStreamError.h */,
-				B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */,
 			);
 			name = cf;
 			sourceTree = "<group>";
@@ -14165,6 +14239,7 @@
 				93F8B3070A300FEA00F61AB8 /* generate-bindings.pl */,
 				14813BF309EDF88E00F757E1 /* IDLParser.pm */,
 				93F8B3080A300FEA00F61AB8 /* IDLStructure.pm */,
+				97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */,
 			);
 			path = bindings;
 			sourceTree = "<group>";
@@ -14193,6 +14268,8 @@
 				BCBFB53B0DCD29CF0019B3E5 /* JSDOMWindowShell.h */,
 				BC60901E0E91B8EC000C68B5 /* JSEventTarget.cpp */,
 				BC60901D0E91B8EC000C68B5 /* JSEventTarget.h */,
+				3314ACE910892086000F0E56 /* JSExceptionBase.cpp */,
+				3314ACEA10892086000F0E56 /* JSExceptionBase.h */,
 				C09158840DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp */,
 				C09158850DB4209200E55AF4 /* JSInspectedObjectWrapper.h */,
 				C09158860DB4209200E55AF4 /* JSInspectorCallbackWrapper.cpp */,
@@ -14236,11 +14313,11 @@
 				416F45EF0ED7B311008215B6 /* ScriptString.h */,
 				934CC0DF0ED39D6F00A658F2 /* ScriptValue.cpp */,
 				934CC0E00ED39D6F00A658F2 /* ScriptValue.h */,
+				A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */,
+				A75E497410752ACB00C9B896 /* SerializedScriptValue.h */,
 				65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */,
 				E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */,
 				E1A643F10EC0972500779668 /* WorkerScriptController.h */,
-				A75E497410752ACB00C9B896 /* SerializedScriptValue.h */,
-				A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */,
 			);
 			path = js;
 			sourceTree = "<group>";
@@ -14296,6 +14373,7 @@
 			children = (
 				415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */,
 				BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */,
+				492273A21083B3B100EE5C84 /* JSCanvasArrayCustom.cpp */,
 				49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */,
 				49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */,
 				49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */,
@@ -14307,12 +14385,20 @@
 				49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */,
 				49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
+				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
+				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
 				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
 				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
+				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
+				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
 				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
 				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
+				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
+				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
 				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
 				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
+				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
+				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
 				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
 				FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */,
 				FE80D7A30E9C1ED2000D6F75 /* JSCustomPositionCallback.h */,
@@ -14328,14 +14414,6 @@
 				51EC92620CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h */,
 				1A3417C80CECFF250049CBDE /* JSCustomVoidCallback.cpp */,
 				1A3417C70CECFF250049CBDE /* JSCustomVoidCallback.h */,
-				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
-				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
-				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
-				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
-				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
-				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
-				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
-				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
 				BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */,
 				BC77D1510FF19C730070887B /* JSDataGridColumnListCustom.cpp */,
 				4162A453101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp */,
@@ -14403,6 +14481,7 @@
 				BC348BBD0DB7F531004ABAB9 /* JSXMLHttpRequestCustom.cpp */,
 				BCDFD4910E3056BD009D10AD /* JSXMLHttpRequestUploadCustom.cpp */,
 				BCEFE1E40DCA5F3300739219 /* JSXSLTProcessorCustom.cpp */,
+				BC97E42B10915B060010D361 /* JSHTMLAllCollectionCustom.cpp */,
 			);
 			name = Custom;
 			sourceTree = "<group>";
@@ -14483,8 +14562,8 @@
 				BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */,
 				1403BA0B09EB18C700797C7F /* JSDOMWindow.cpp */,
 				1403BA0E09EB18F800797C7F /* JSDOMWindow.h */,
-				E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */,
 				E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */,
+				E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */,
 				BC94D14C0C275C68006BC617 /* JSHistory.cpp */,
 				BC94D14D0C275C68006BC617 /* JSHistory.h */,
 				BCE1C4390D9830D3003B02F2 /* JSLocation.cpp */,
@@ -14574,6 +14653,8 @@
 				51E4ADB30C42B4CF0042BC55 /* FTPDirectoryDocument.h */,
 				51C81B870C4422F70019ECE3 /* FTPDirectoryParser.cpp */,
 				51C81B880C4422F70019ECE3 /* FTPDirectoryParser.h */,
+				97DCE1FF10807C750057D394 /* HistoryController.cpp */,
+				97DCE20010807C750057D394 /* HistoryController.h */,
 				1A820D8F0A13EBA600AF843C /* ImageDocument.cpp */,
 				1A820D900A13EBA600AF843C /* ImageDocument.h */,
 				089582530E857A7E00F82C83 /* ImageLoader.cpp */,
@@ -14604,6 +14685,8 @@
 				BCB16C160979C3BD00467741 /* Request.h */,
 				93E227DE0AF589AD00D48324 /* ResourceLoader.cpp */,
 				656D37270ADBA5DE00A4554D /* ResourceLoader.h */,
+				973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */,
+				973E325510883B7C005BC493 /* ResourceLoadNotifier.h */,
 				93E227DF0AF589AD00D48324 /* SubresourceLoader.cpp */,
 				656D37300ADBA5DE00A4554D /* SubresourceLoader.h */,
 				1A3178920B20A81600316987 /* SubresourceLoaderClient.h */,
@@ -14680,8 +14763,6 @@
 				49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */,
 				E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */,
 				E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */,
-				9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */,
-				BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */,
 				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
 				BC6C49F20D7DBA0500FFA558 /* JSImageConstructor.h */,
 				E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */,
@@ -14718,11 +14799,11 @@
 		BCF1A5BA097832090061A123 /* platform */ = {
 			isa = PBXGroup;
 			children = (
-				59C77F101054591C00506104 /* mock */,
 				49E912A40EFAC8E6009D0CAF /* animation */,
 				1AE42F670AA4B8CB00C8612D /* cf */,
 				B2A015910AF6CD53006BCE0E /* graphics */,
 				6582A14809999D6C00BEEB6D /* mac */,
+				59C77F101054591C00506104 /* mock */,
 				656B84D70AEA1CE900A095B4 /* network */,
 				516030090CC4245400C8AC25 /* posix */,
 				1A2E6E560CC551E0004A2062 /* sql */,
@@ -14902,14 +14983,14 @@
 				1AB7FC670A8B92EC00D9D37B /* XPathVariableReference.h */,
 				85217E000A5ECD4700DB8D00 /* XSLImportRule.cpp */,
 				85217E010A5ECD4700DB8D00 /* XSLImportRule.h */,
-				BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */,
 				BC06F24A06D18A7E004A6FA3 /* XSLStyleSheet.h */,
+				BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */,
 				E1F1E82D0C3C2BB9006DB391 /* XSLTExtensions.cpp */,
 				E1F1E82E0C3C2BB9006DB391 /* XSLTExtensions.h */,
 				BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */,
 				BC06F24C06D18A7E004A6FA3 /* XSLTProcessor.h */,
-				BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */,
 				BCEFE1DC0DCA5CFD00739219 /* XSLTProcessor.idl */,
+				BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */,
 				E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */,
 				E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */,
 			);
@@ -15063,13 +15144,13 @@
 				93CA4C9A09DF93FA00DF8677 /* make-css-file-arrays.pl */,
 				93CA4C9B09DF93FA00DF8677 /* makeprop.pl */,
 				93CA4C9D09DF93FA00DF8677 /* makevalues.pl */,
+				0FF5026E102BA9660066F39A /* Media.cpp */,
+				0FF5026F102BA96A0066F39A /* Media.h */,
+				0FF50270102BA96A0066F39A /* Media.idl */,
 				070DD8F50F01868000727DEB /* mediaControls.css */,
 				07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */,
 				4E19591F0A39DABA00220FE5 /* MediaFeatureNames.cpp */,
 				4E1959200A39DABA00220FE5 /* MediaFeatureNames.h */,
-				0FF5026E102BA9660066F39A /* Media.cpp */,
-				0FF5026F102BA96A0066F39A /* Media.h */,
-				0FF50270102BA96A0066F39A /* Media.idl */,
 				A8EA80010A19516E00A8EF5F /* MediaList.cpp */,
 				A8EA80060A19516E00A8EF5F /* MediaList.h */,
 				85C56C5B0AA87AFD00D95755 /* MediaList.idl */,
@@ -15339,12 +15420,12 @@
 				93EEC1E509C2877700C515D1 /* Attr.idl */,
 				A8C4A7FA09D563270003AC8D /* Attribute.cpp */,
 				A8C4A7F909D563270003AC8D /* Attribute.h */,
+				BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */,
+				BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */,
 				AB23A32509BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp */,
 				AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */,
-				BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */,
 				85031B260A44EFC700F992E0 /* BeforeUnloadEvent.cpp */,
 				85031B270A44EFC700F992E0 /* BeforeUnloadEvent.h */,
-				BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */,
 				6550B693099DF0270090D781 /* CDATASection.cpp */,
 				6550B694099DF0270090D781 /* CDATASection.h */,
 				85089CC90A98C2AB00A275AA /* CDATASection.idl */,
@@ -15637,6 +15718,7 @@
 				51741D0F0B07259A00ED442C /* BackForwardList.h in Headers */,
 				BC124EE80C2641CD009E2349 /* BarInfo.h in Headers */,
 				B2C3DA220D006C1D00EF6F26 /* Base64.h in Headers */,
+				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
 				AB23A32809BBA7D00067CC53 /* BeforeTextInsertedEvent.h in Headers */,
 				85031B3D0A44EFC700F992E0 /* BeforeUnloadEvent.h in Headers */,
 				B2C3DA240D006C1D00EF6F26 /* BidiContext.h in Headers */,
@@ -15669,6 +15751,31 @@
 				BCB16C260979C3BD00467741 /* CachedXBLDocument.h in Headers */,
 				BCB16C280979C3BD00467741 /* CachedXSLStyleSheet.h in Headers */,
 				93F1995008245E59001E9ABC /* CachePolicy.h in Headers */,
+				49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */,
+				A7D20F6D107F438B00A80392 /* CanvasActiveInfo.h in Headers */,
+				49EECDE010503C2400099FAB /* CanvasArray.h in Headers */,
+				49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */,
+				49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */,
+				49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */,
+				49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */,
+				49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */,
+				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
+				49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */,
+				49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */,
+				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
+				49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */,
+				49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */,
+				49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */,
+				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
+				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
+				49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */,
+				49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */,
+				49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */,
+				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
+				49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */,
+				49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */,
+				49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */,
+				49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */,
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
 				514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */,
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
@@ -15705,6 +15812,7 @@
 				065AD4F50B0C2EDA005A2B1D /* ContextMenuClient.h in Headers */,
 				065AD4F70B0C2EDA005A2B1D /* ContextMenuController.h in Headers */,
 				06027CAD0B1CBFC000884B2D /* ContextMenuItem.h in Headers */,
+				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
 				9352088209BD45E900F2038D /* CookieJar.h in Headers */,
 				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
 				3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */,
@@ -15714,6 +15822,7 @@
 				9392F14C0AD1861B00691BD4 /* CounterNode.h in Headers */,
 				D0B0556809C6700100307E43 /* CreateLinkCommand.h in Headers */,
 				514C766E0CE923A1007EF3CD /* Credential.h in Headers */,
+				51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */,
 				E1C416120F6562FD0092D2FB /* CrossOriginAccessControl.h in Headers */,
 				E1C415DA0F655D6F0092D2FB /* CrossOriginPreflightResultCache.h in Headers */,
 				2E4346590F546A9900B0F1BA /* CrossThreadCopier.h in Headers */,
@@ -15810,6 +15919,7 @@
 				1A8F6BC30DB55CDC001DB794 /* DOMApplicationCache.h in Headers */,
 				85D389B20A991A7F00282145 /* DOMAttr.h in Headers */,
 				85E7118D0AC5D5350053270F /* DOMAttrInternal.h in Headers */,
+				BC946EEF107FDBAC00857193 /* DOMBeforeLoadEvent.h in Headers */,
 				85089CD70A98C42800A275AA /* DOMCDATASection.h in Headers */,
 				85E7118E0AC5D5350053270F /* DOMCDATASectionInternal.h in Headers */,
 				85ACA9860A9B520300671E90 /* DOMCharacterData.h in Headers */,
@@ -16008,6 +16118,8 @@
 				BC1A37B9097C715F0019F3D8 /* DOMInternal.h in Headers */,
 				85FF315A0AAFBFCB00374F38 /* DOMKeyboardEvent.h in Headers */,
 				85989DCC0ACC8BBD00A0BC51 /* DOMKeyboardEventInternal.h in Headers */,
+				0FF5025B102BA9010066F39A /* DOMMedia.h in Headers */,
+				0FF50263102BA92C0066F39A /* DOMMediaInternal.h in Headers */,
 				850656FE0AAB4763002D15C0 /* DOMMediaList.h in Headers */,
 				85E711D10AC5D5350053270F /* DOMMediaListInternal.h in Headers */,
 				75793ED30D0CE85B007FC0AC /* DOMMessageEvent.h in Headers */,
@@ -16033,6 +16145,7 @@
 				A8EDB03D1016849400FE8113 /* DOMObjectWithSVGContext.h in Headers */,
 				85C7F5D00AAFB8D9004014DD /* DOMOverflowEvent.h in Headers */,
 				85989DCF0ACC8BBD00A0BC51 /* DOMOverflowEventInternal.h in Headers */,
+				E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */,
 				1ACE53E80A8D18E70022947D /* DOMParser.h in Headers */,
 				BC1A37BB097C715F0019F3D8 /* DOMPrivate.h in Headers */,
 				85F56A7A0A98CE3700ADB60A /* DOMProcessingInstruction.h in Headers */,
@@ -16212,6 +16325,8 @@
 				8502AB5E0AD438C000378540 /* DOMSVGFEMergeNodeElement.h in Headers */,
 				8502AB9D0AD4394E00378540 /* DOMSVGFEMergeNodeElementInternal.h in Headers */,
 				A8E5455F0CA9D1C20097D09B /* DOMSVGFEMergeNodeElementInternal.h in Headers */,
+				8422418C107E786F00766A87 /* DOMSVGFEMorphologyElement.h in Headers */,
+				8422418E107E786F00766A87 /* DOMSVGFEMorphologyElementInternal.h in Headers */,
 				8502AB600AD438C000378540 /* DOMSVGFEOffsetElement.h in Headers */,
 				8502AB9E0AD4394E00378540 /* DOMSVGFEOffsetElementInternal.h in Headers */,
 				A8E5455D0CA9D1C20097D09B /* DOMSVGFEOffsetElementInternal.h in Headers */,
@@ -16595,6 +16710,7 @@
 				B2AFFC810D00A5C10030074D /* FontPlatformData.h in Headers */,
 				37ACCE420DA2980F0089E602 /* FontRenderingMode.h in Headers */,
 				B2C3DA6B0D006CD600EF6F26 /* FontSelector.h in Headers */,
+				37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */,
 				3784C34B0E11AA34007D8D48 /* FontTraitsMask.h in Headers */,
 				A80E6CED0A1989CA007FB8C5 /* FontValue.h in Headers */,
 				D05CED2A0A40BB2C00C5AF38 /* FormatBlockCommand.h in Headers */,
@@ -16621,6 +16737,7 @@
 				FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */,
 				FEAB90130EA51B9C006348C3 /* GeolocationService.h in Headers */,
 				BCE494AB0F4F5E9E0084E319 /* GeolocationServiceMac.h in Headers */,
+				59C77F2B10545B3B00506104 /* GeolocationServiceMock.h in Headers */,
 				FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */,
 				B2C3DA6C0D006CD600EF6F26 /* GlyphBuffer.h in Headers */,
 				B2C3DA6E0D006CD600EF6F26 /* GlyphPageTreeNode.h in Headers */,
@@ -16628,14 +16745,16 @@
 				BC53C5F50DA56B920021EB5D /* Gradient.h in Headers */,
 				B22279640D00BF220071B782 /* GradientAttributes.h in Headers */,
 				B2A015A90AF6CD53006BCE0E /* GraphicsContext.h in Headers */,
+				49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */,
 				A80D67080E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h in Headers */,
 				A88FE3340E5EEE87008D8C0F /* GraphicsContextPrivate.h in Headers */,
-				49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */,
 				0F580B0D0F12A2690051D689 /* GraphicsLayer.h in Headers */,
 				0F580B060F12A2550051D689 /* GraphicsLayerCA.h in Headers */,
 				0F580B0E0F12A2690051D689 /* GraphicsLayerClient.h in Headers */,
 				B2A015AB0AF6CD53006BCE0E /* GraphicsTypes.h in Headers */,
+				7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */,
 				BC94D1540C275C8B006BC617 /* History.h in Headers */,
+				97DCE20210807C750057D394 /* HistoryController.h in Headers */,
 				51741D110B07259A00ED442C /* HistoryItem.h in Headers */,
 				9363B62D0F8E8FE000803810 /* HistoryPropertyList.h in Headers */,
 				930908910AF7EDE40081DF01 /* HitTestRequest.h in Headers */,
@@ -16768,6 +16887,7 @@
 				41F061740F5F00AC00A07EAC /* InspectorDOMStorageResource.h in Headers */,
 				7AED3E060FBB1EAA00D2B03C /* InspectorFrontend.h in Headers */,
 				41F062010F5F0B6600A07EAC /* InspectorResource.h in Headers */,
+				754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */,
 				B27535720B053814002CE64F /* IntPoint.h in Headers */,
 				B27535740B053814002CE64F /* IntRect.h in Headers */,
 				B27535750B053814002CE64F /* IntSize.h in Headers */,
@@ -16787,8 +16907,37 @@
 				65DF31DB09D1C123000BE325 /* JSAttr.h in Headers */,
 				E4EEFFC90D34550C00469A58 /* JSAudioConstructor.h in Headers */,
 				BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */,
+				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
+				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
+				A7D20F63107F406900A80392 /* JSCanvasActiveInfo.h in Headers */,
+				49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */,
+				49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */,
+				49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */,
+				49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */,
+				49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */,
+				49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */,
+				49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */,
+				49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */,
+				49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */,
 				65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */,
+				49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */,
+				49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */,
 				65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */,
+				49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */,
+				49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */,
+				49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */,
+				49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */,
+				49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */,
+				49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */,
+				49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */,
+				49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */,
+				49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */,
+				49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */,
+				49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */,
+				49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */,
+				49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */,
+				49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */,
+				49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */,
 				93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */,
 				65DF31F409D1CC60000BE325 /* JSCharacterData.h in Headers */,
 				BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */,
@@ -16854,7 +17003,6 @@
 				FE80DA640E9C4703000D6F75 /* JSGeolocation.h in Headers */,
 				FE80DA660E9C4703000D6F75 /* JSGeoposition.h in Headers */,
 				BC94D14F0C275C68006BC617 /* JSHistory.h in Headers */,
-				BC6DC7A10C1A4BFA004E2017 /* JSHTMLAllCollection.h in Headers */,
 				1A4A2DF00A1B852A00C807F8 /* JSHTMLAnchorElement.h in Headers */,
 				1A4A2DF20A1B852A00C807F8 /* JSHTMLAppletElement.h in Headers */,
 				1AE2AA1F0A1CDAB400B42B25 /* JSHTMLAreaElement.h in Headers */,
@@ -16935,12 +17083,14 @@
 				A86629D309DA2B48009633A5 /* JSKeyboardEvent.h in Headers */,
 				935F45430F7C3B5F00D7C1FB /* JSLazyEventListener.h in Headers */,
 				BCE1C43C0D9830D3003B02F2 /* JSLocation.h in Headers */,
+				0FF5026A102BA9430066F39A /* JSMedia.h in Headers */,
 				E44614190CD6826900FADA75 /* JSMediaError.h in Headers */,
 				BC3C39B70C0D3D8D005F4D7A /* JSMediaList.h in Headers */,
 				E107400E0E77BDC00033AF24 /* JSMessageChannel.h in Headers */,
 				E10743270E7835A50033AF24 /* JSMessageChannelConstructor.h in Headers */,
 				75793EC90D0CE72D007FC0AC /* JSMessageEvent.h in Headers */,
 				E1ADEDDA0E76BD93004A1A5E /* JSMessagePort.h in Headers */,
+				41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */,
 				A9D248070D757E7D00FDF959 /* JSMimeType.h in Headers */,
 				A9D248090D757E7D00FDF959 /* JSMimeTypeArray.h in Headers */,
 				A86629D109DA2B48009633A5 /* JSMouseEvent.h in Headers */,
@@ -16956,6 +17106,7 @@
 				33503CA610179AD7003B47E1 /* JSNotificationCenter.h in Headers */,
 				A826E8AE0A1A8F2300CD1BB6 /* JSOptionConstructor.h in Headers */,
 				1A0D57410A5C7867007EDD4C /* JSOverflowEvent.h in Headers */,
+				E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */,
 				A9D247FF0D757E6900FDF959 /* JSPlugin.h in Headers */,
 				A9D248010D757E6900FDF959 /* JSPluginArray.h in Headers */,
 				93B70D6C09EB0C7C009D8468 /* JSPluginElementFunctions.h in Headers */,
@@ -17027,6 +17178,7 @@
 				B2FA3D850AB75A6F000E5AC4 /* JSSVGFEImageElement.h in Headers */,
 				B2FA3D870AB75A6F000E5AC4 /* JSSVGFEMergeElement.h in Headers */,
 				B2FA3D890AB75A6F000E5AC4 /* JSSVGFEMergeNodeElement.h in Headers */,
+				84224184107E77F400766A87 /* JSSVGFEMorphologyElement.h in Headers */,
 				B2FA3D8B0AB75A6F000E5AC4 /* JSSVGFEOffsetElement.h in Headers */,
 				B2FA3D8D0AB75A6F000E5AC4 /* JSSVGFEPointLightElement.h in Headers */,
 				B2FA3D8F0AB75A6F000E5AC4 /* JSSVGFESpecularLightingElement.h in Headers */,
@@ -17177,8 +17329,12 @@
 				A8C4A80509D563270003AC8D /* MappedAttribute.h in Headers */,
 				A8C4A84C09D5649D0003AC8D /* MappedAttributeEntry.h in Headers */,
 				93309DF8099E64920056E581 /* markup.h in Headers */,
+				FABE72F51059C1EB00D999DD /* MathMLElement.h in Headers */,
+				FABE72F71059C1EB00D999DD /* MathMLInlineContainerElement.h in Headers */,
+				FABE72F91059C1EB00D999DD /* MathMLMathElement.h in Headers */,
 				49D5DC2C0F423A73008F20FD /* Matrix3DTransformOperation.h in Headers */,
 				49E911C70EF86D47009D0CAF /* MatrixTransformOperation.h in Headers */,
+				0FF50272102BA96A0066F39A /* Media.h in Headers */,
 				ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */,
 				AB40484E0E083FA8007D6920 /* MediaDocument.h in Headers */,
 				E44613AD0CD6331000FADA75 /* MediaError.h in Headers */,
@@ -17243,6 +17399,7 @@
 				1CF6BE150E9BB4670025E1CD /* ObjCNodeFilterCondition.h in Headers */,
 				087281560F26B9B600AFC596 /* OptionElement.h in Headers */,
 				087281580F26B9B600AFC596 /* OptionGroupElement.h in Headers */,
+				0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */,
 				51A9267D0D53F0570063ECC2 /* OriginQuotaManager.h in Headers */,
 				51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */,
 				BC5EB5DD0E81B8DD00B25965 /* OutlineValue.h in Headers */,
@@ -17252,6 +17409,7 @@
 				1477E7770BF4134A00152872 /* PageCache.h in Headers */,
 				9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */,
 				7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */,
+				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				A80E6CFB0A1989CA007FB8C5 /* Pair.h in Headers */,
 				BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */,
@@ -17276,9 +17434,13 @@
 				A9C6E4F00D745E38006442E9 /* PluginArray.h in Headers */,
 				A9C6E4F40D745E48006442E9 /* PluginData.h in Headers */,
 				1AC694C80A3B1676003F5049 /* PluginDocument.h in Headers */,
+				7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */,
+				7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */,
 				5DCF836D0D59159800953BC6 /* PluginInfoStore.h in Headers */,
 				1ADA14110E1AE5D900023EE5 /* PluginMainThreadScheduler.h in Headers */,
 				B2B1F7170D00CAA8004AEA64 /* PointerEventsHitRules.h in Headers */,
+				97059978107D975200A50A7C /* PolicyCallback.h in Headers */,
+				9705997A107D975200A50A7C /* PolicyChecker.h in Headers */,
 				0668E18B0ADD9624004128E0 /* PopupMenu.h in Headers */,
 				ABC128770B33AA6D00C693D5 /* PopupMenuClient.h in Headers */,
 				BC3BE12B0E98092F00835588 /* PopupMenuStyle.h in Headers */,
@@ -17293,6 +17455,7 @@
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
+				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
 				E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
 				B22279720D00BF220071B782 /* RadialGradientAttributes.h in Headers */,
@@ -17300,6 +17463,7 @@
 				93D9D53C0DA27E180077216C /* RangeBoundaryPoint.h in Headers */,
 				D23CA56C0AB0EB8D005108A5 /* RangeException.h in Headers */,
 				BC4368E80C226E32005EFB5F /* Rect.h in Headers */,
+				979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */,
 				85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */,
 				B2C3DA2D0D006C1D00EF6F26 /* RegularExpression.h in Headers */,
 				93309E01099E64920056E581 /* RemoveCSSPropertyCommand.h in Headers */,
@@ -17337,6 +17501,7 @@
 				ABDDFE7A0A5C6E7000A3E11D /* RenderMenuList.h in Headers */,
 				BCEA4880097D93020094C9E4 /* RenderObject.h in Headers */,
 				BC2CC8DF0F32881000A9DF26 /* RenderObjectChildList.h in Headers */,
+				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
 				A871DED70A1530C700B12A68 /* RenderPart.h in Headers */,
 				A871DED50A1530C700B12A68 /* RenderPartObject.h in Headers */,
 				853CA9F10AEEC657002372DC /* RenderPath.h in Headers */,
@@ -17440,6 +17605,7 @@
 				084AEBE50FB505FA0038483E /* SelectElement.h in Headers */,
 				93309E0E099E64920056E581 /* SelectionController.h in Headers */,
 				BC7FA6810D1F167900DB22A9 /* SelectorNodeList.h in Headers */,
+				A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */,
 				93309E10099E64920056E581 /* SetNodeAttributeCommand.h in Headers */,
 				93F1994F08245E59001E9ABC /* Settings.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
@@ -17456,6 +17622,11 @@
 				4B6FA6F40C39E48C00087011 /* SmartReplace.h in Headers */,
 				E4AFD00C0DAF335400F5F55C /* SMILTime.h in Headers */,
 				E4AFD00E0DAF335500F5F55C /* SMILTimeContainer.h in Headers */,
+				51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */,
+				510D4A34103165EE0049EA54 /* SocketStreamErrorBase.h in Headers */,
+				51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */,
+				510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */,
+				510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */,
 				0A4844990CA44CB200B7BD48 /* SoftLinking.h in Headers */,
 				4B3043C70AE0370300A82647 /* Sound.h in Headers */,
 				84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */,
@@ -17475,6 +17646,8 @@
 				1A7CCB1A0CD9469A00B7B64E /* SQLStatementErrorCallback.h in Headers */,
 				1A7CCB240CD946FD00B7B64E /* SQLTransaction.h in Headers */,
 				1A7CCB1B0CD9469A00B7B64E /* SQLTransactionCallback.h in Headers */,
+				B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */,
+				B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */,
 				1A7CCB1C0CD9469A00B7B64E /* SQLTransactionErrorCallback.h in Headers */,
 				1A2E6E5A0CC55213004A2062 /* SQLValue.h in Headers */,
 				93F1996308245E59001E9ABC /* SSLKeyGenerator.h in Headers */,
@@ -17484,6 +17657,7 @@
 				C5160EEB1004543A00A7CEE2 /* StorageAreaImpl.h in Headers */,
 				C5102ECF0FD9EF8C00FAFF04 /* StorageAreaSync.h in Headers */,
 				51E0BABB0DA5547100A9E417 /* StorageEvent.h in Headers */,
+				C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */,
 				51E0BB380DA5ACB600A9E417 /* StorageMap.h in Headers */,
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
@@ -17528,6 +17702,7 @@
 				B222797A0D00BF220071B782 /* SVGAnimateColorElement.h in Headers */,
 				B22279850D00BF220071B782 /* SVGAnimatedPathData.h in Headers */,
 				B22279880D00BF220071B782 /* SVGAnimatedPoints.h in Headers */,
+				0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */,
 				B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */,
 				B22279900D00BF220071B782 /* SVGAnimateElement.h in Headers */,
 				B22279930D00BF220071B782 /* SVGAnimateMotionElement.h in Headers */,
@@ -17567,7 +17742,6 @@
 				B22279E30D00BF220071B782 /* SVGFEFuncBElement.h in Headers */,
 				B22279E60D00BF220071B782 /* SVGFEFuncGElement.h in Headers */,
 				B22279E90D00BF220071B782 /* SVGFEFuncRElement.h in Headers */,
-				B25599830D00D8BA00BB825C /* SVGFEGaussianBlur.h in Headers */,
 				B22279EC0D00BF220071B782 /* SVGFEGaussianBlurElement.h in Headers */,
 				B25599850D00D8BA00BB825C /* SVGFEImage.h in Headers */,
 				B22279EF0D00BF220071B782 /* SVGFEImageElement.h in Headers */,
@@ -17576,6 +17750,7 @@
 				B22279F40D00BF220071B782 /* SVGFEMergeElement.h in Headers */,
 				B22279F70D00BF220071B782 /* SVGFEMergeNodeElement.h in Headers */,
 				B25599890D00D8BA00BB825C /* SVGFEMorphology.h in Headers */,
+				84224194107E78A700766A87 /* SVGFEMorphologyElement.h in Headers */,
 				B255998B0D00D8BA00BB825C /* SVGFEOffset.h in Headers */,
 				B22279FA0D00BF220071B782 /* SVGFEOffsetElement.h in Headers */,
 				B22279FD0D00BF220071B782 /* SVGFEPointLightElement.h in Headers */,
@@ -17700,6 +17875,8 @@
 				B2227AF30D00BF220071B782 /* SVGViewSpec.h in Headers */,
 				B2227AF60D00BF220071B782 /* SVGZoomAndPan.h in Headers */,
 				B2E4EC980D00C22B00432643 /* SVGZoomEvent.h in Headers */,
+				0878B1FF10874E3F00A55097 /* SynchronizablePropertyController.h in Headers */,
+				0878B20010874E3F00A55097 /* SynchronizableTypeWrapper.h in Headers */,
 				93E62D9B0985F41600E1B5E3 /* SystemTime.h in Headers */,
 				A8CFF0510A154F09000A4234 /* TableLayout.h in Headers */,
 				BCE3BEC30D222B1D007E06E4 /* TagNodeList.h in Headers */,
@@ -17724,6 +17901,7 @@
 				93309E18099E64920056E581 /* TextGranularity.h in Headers */,
 				93309E1C099E64920056E581 /* TextIterator.h in Headers */,
 				BCEF45E90E687767001C1287 /* TextMetrics.h in Headers */,
+				930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */,
 				93F198F608245E59001E9ABC /* TextResourceDecoder.h in Headers */,
 				A824B4650E2EF2EA0081A7B7 /* TextRun.h in Headers */,
 				B2C3DA4B0D006C1D00EF6F26 /* TextStream.h in Headers */,
@@ -17742,6 +17920,7 @@
 				49E911C40EF86D47009D0CAF /* TransformationMatrix.h in Headers */,
 				49E911CE0EF86D47009D0CAF /* TransformOperation.h in Headers */,
 				49E911D00EF86D47009D0CAF /* TransformOperations.h in Headers */,
+				5DB1BC6A10715A6400EFAA49 /* TransformSource.h in Headers */,
 				0F500AAF0F54DB1B00EEF928 /* TransformState.h in Headers */,
 				49E911D20EF86D47009D0CAF /* TranslateTransformOperation.h in Headers */,
 				854FE7370A2297BE0058D7AD /* Traversal.h in Headers */,
@@ -17754,6 +17933,11 @@
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
 				656581B209D14EE6000E61D7 /* UserAgentStyleSheets.h in Headers */,
+				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
+				BCA2B061105047600043BD1C /* UserScript.h in Headers */,
+				BCA2B08B10505BCD0043BD1C /* UserScriptTypes.h in Headers */,
+				BC8BF151105813BF00A40A07 /* UserStyleSheet.h in Headers */,
+				BC8BF15A1058141800A40A07 /* UserStyleSheetTypes.h in Headers */,
 				15C7708D100D3C6B005BA267 /* ValidityState.h in Headers */,
 				93309E1E099E64920056E581 /* visible_units.h in Headers */,
 				93309E20099E64920056E581 /* VisiblePosition.h in Headers */,
@@ -17784,6 +17968,9 @@
 				1A569D1B0D7E2B82007C3983 /* WebScriptObject.h in Headers */,
 				1CAF34830A6C405200ABE06E /* WebScriptObjectPrivate.h in Headers */,
 				518A34C21026C831001B6896 /* WebSocket.h in Headers */,
+				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
+				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
+				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
 				0FCF332D0F2B9A25004B6795 /* WebTiledLayer.h in Headers */,
 				85031B510A44EFC700F992E0 /* WheelEvent.h in Headers */,
 				9380F47409A11AB4001FDB34 /* Widget.h in Headers */,
@@ -17835,6 +18022,7 @@
 				2E4346500F546A8200B0F1BA /* WorkerMessagingProxy.h in Headers */,
 				E1271A0B0EEEC77A00F61213 /* WorkerNavigator.h in Headers */,
 				2E4346510F546A8200B0F1BA /* WorkerObjectProxy.h in Headers */,
+				416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */,
 				2E4346530F546A8200B0F1BA /* WorkerRunLoop.h in Headers */,
 				E1A643F20EC0972500779668 /* WorkerScriptController.h in Headers */,
 				A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */,
@@ -17874,106 +18062,12 @@
 				93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */,
-				0FF5025B102BA9010066F39A /* DOMMedia.h in Headers */,
-				0FF50263102BA92C0066F39A /* DOMMediaInternal.h in Headers */,
-				0FF5026A102BA9430066F39A /* JSMedia.h in Headers */,
-				0FF50272102BA96A0066F39A /* Media.h in Headers */,
-				754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */,
-				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
-				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
-				49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */,
-				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
-				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
-				416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */,
-				B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */,
-				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
-				41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */,
-				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
-				0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */,
-				B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */,
-				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
-				49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */,
-				49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */,
-				49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */,
-				49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */,
-				49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */,
-				49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */,
-				49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */,
-				49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */,
-				49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */,
-				49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */,
-				49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */,
-				49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */,
-				49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */,
-				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
-				49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */,
-				49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */,
-				49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */,
-				49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */,
-				BCA2B061105047600043BD1C /* UserScript.h in Headers */,
-				BCA2B08B10505BCD0043BD1C /* UserScriptTypes.h in Headers */,
-				E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */,
-				E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */,
-				510D4A34103165EE0049EA54 /* SocketStreamErrorBase.h in Headers */,
-				510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */,
-				510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */,
-				51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */,
-				51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */,
-				75A94A04104B74FB0006673C /* TimelineItem.h in Headers */,
-				75092BFF104B80F9003DD168 /* DOMDispatchTimelineItem.h in Headers */,
-				49EECDE010503C2400099FAB /* CanvasArray.h in Headers */,
-				49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */,
-				49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */,
-				49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */,
-				49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */,
-				49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */,
-				49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */,
-				49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */,
-				49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */,
-				49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */,
-				49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */,
-				49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */,
-				49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */,
-				49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */,
-				49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */,
-				49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */,
-				49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */,
-				49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */,
-				49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */,
-				49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */,
-				49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */,
-				49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */,
-				49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */,
-				49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */,
-				49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */,
-				49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */,
-				49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */,
-				59C77F2B10545B3B00506104 /* GeolocationServiceMock.h in Headers */,
-				51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */,
-				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
-				BC8BF151105813BF00A40A07 /* UserStyleSheet.h in Headers */,
-				BC8BF15A1058141800A40A07 /* UserStyleSheetTypes.h in Headers */,
-				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
-				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
-				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
-				C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */,
-				FABE72F51059C1EB00D999DD /* MathMLElement.h in Headers */,
-				FABE72F71059C1EB00D999DD /* MathMLInlineContainerElement.h in Headers */,
-				FABE72F91059C1EB00D999DD /* MathMLMathElement.h in Headers */,
-				37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */,
-				7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */,
-				7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */,
-				7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */,
-				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
-				5DB1BC6A10715A6400EFAA49 /* TransformSource.h in Headers */,
-				930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */,
-				979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */,
-				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
-				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
-				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
-				A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */,
-				97059978107D975200A50A7C /* PolicyCallback.h in Headers */,
-				9705997A107D975200A50A7C /* PolicyChecker.h in Headers */,
+				3314ACEC10892086000F0E56 /* JSExceptionBase.h in Headers */,
+				973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */,
+				84801955108BAFB300CB2B1F /* FEGaussianBlur.h in Headers */,
+				7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */,
+				BC97E23A109144950010D361 /* HTMLAllCollection.h in Headers */,
+				BC97E413109154FA0010D361 /* JSHTMLAllCollection.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18042,6 +18136,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				46F9D5DD0B0D60170028EE36 /* aliasCursor.png in Resources */,
+				BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */,
 				46D4F2490AF97E810035385A /* cellCursor.png in Resources */,
 				46D4F24A0AF97E810035385A /* contextMenuCursor.png in Resources */,
 				4614A1FE0B23A8D600446E1C /* copyCursor.png in Resources */,
@@ -18074,7 +18169,6 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
-				BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -18283,6 +18377,30 @@
 				BCB16C230979C3BD00467741 /* CachedScript.cpp in Sources */,
 				BCB16C250979C3BD00467741 /* CachedXBLDocument.cpp in Sources */,
 				BCB16C270979C3BD00467741 /* CachedXSLStyleSheet.cpp in Sources */,
+				49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */,
+				49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */,
+				49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */,
+				49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */,
+				49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */,
+				49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */,
+				49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */,
+				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
+				49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */,
+				49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */,
+				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
+				49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */,
+				49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */,
+				49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */,
+				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
+				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
+				49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */,
+				49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */,
+				49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */,
+				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
+				49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */,
+				49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */,
+				49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */,
+				49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */,
 				6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */,
 				514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */,
 				6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */,
@@ -18321,6 +18439,7 @@
 				9392F1500AD1862300691BD4 /* CounterNode.cpp in Sources */,
 				D0B0556909C6700100307E43 /* CreateLinkCommand.cpp in Sources */,
 				514C766D0CE923A1007EF3CD /* Credential.cpp in Sources */,
+				51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */,
 				E1C416170F6563180092D2FB /* CrossOriginAccessControl.cpp in Sources */,
 				E1C415DE0F655D7C0092D2FB /* CrossOriginPreflightResultCache.cpp in Sources */,
 				2E4346580F546A9900B0F1BA /* CrossThreadCopier.cpp in Sources */,
@@ -18397,6 +18516,7 @@
 				BCD0FBD00DBD625E00B2F630 /* DOMAbstractView.mm in Sources */,
 				1A8F6BC20DB55CDC001DB794 /* DOMApplicationCache.cpp in Sources */,
 				85D389B30A991A7F00282145 /* DOMAttr.mm in Sources */,
+				BC946EF0107FDBAC00857193 /* DOMBeforeLoadEvent.mm in Sources */,
 				85089CD80A98C42800A275AA /* DOMCDATASection.mm in Sources */,
 				85ACA9870A9B520300671E90 /* DOMCharacterData.mm in Sources */,
 				85089CDA0A98C42800A275AA /* DOMComment.mm in Sources */,
@@ -18496,6 +18616,7 @@
 				93C841FF09CE858300DFF5E5 /* DOMImplementationFront.cpp in Sources */,
 				BC1A37BA097C715F0019F3D8 /* DOMInternal.mm in Sources */,
 				85FF315B0AAFBFCB00374F38 /* DOMKeyboardEvent.mm in Sources */,
+				0FF5025C102BA9010066F39A /* DOMMedia.mm in Sources */,
 				850656FF0AAB4763002D15C0 /* DOMMediaList.mm in Sources */,
 				75793ED40D0CE85B007FC0AC /* DOMMessageEvent.mm in Sources */,
 				E1ACAF4C0E791AAF0087D12B /* DOMMessagePort.mm in Sources */,
@@ -18508,6 +18629,7 @@
 				85CA96EB0A9624E900690CCF /* DOMNotation.mm in Sources */,
 				856C8AE50A912649005C687B /* DOMObject.mm in Sources */,
 				85C7F5D10AAFB8D9004014DD /* DOMOverflowEvent.mm in Sources */,
+				E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */,
 				1ACE53E70A8D18E70022947D /* DOMParser.cpp in Sources */,
 				85F56A7B0A98CE3700ADB60A /* DOMProcessingInstruction.mm in Sources */,
 				BCC573360D695BBE006EF517 /* DOMProgressEvent.mm in Sources */,
@@ -18564,6 +18686,7 @@
 				8502AB5B0AD438C000378540 /* DOMSVGFEImageElement.mm in Sources */,
 				8502AB5D0AD438C000378540 /* DOMSVGFEMergeElement.mm in Sources */,
 				8502AB5F0AD438C000378540 /* DOMSVGFEMergeNodeElement.mm in Sources */,
+				8422418D107E786F00766A87 /* DOMSVGFEMorphologyElement.mm in Sources */,
 				8502AB610AD438C000378540 /* DOMSVGFEOffsetElement.mm in Sources */,
 				8502AB630AD438C000378540 /* DOMSVGFEPointLightElement.mm in Sources */,
 				8502AB650AD438C000378540 /* DOMSVGFESpecularLightingElement.mm in Sources */,
@@ -18752,18 +18875,21 @@
 				FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */,
 				FEAB90120EA51B9C006348C3 /* GeolocationService.cpp in Sources */,
 				BCE494AC0F4F5E9E0084E319 /* GeolocationServiceMac.mm in Sources */,
+				59C77F2A10545B3B00506104 /* GeolocationServiceMock.cpp in Sources */,
 				B2C3DA6D0D006CD600EF6F26 /* GlyphPageTreeNode.cpp in Sources */,
 				B2AFFC830D00A5C10030074D /* GlyphPageTreeNodeMac.cpp in Sources */,
 				B2C3DA6F0D006CD600EF6F26 /* GlyphWidthMap.cpp in Sources */,
 				BC53C6080DA56C570021EB5D /* Gradient.cpp in Sources */,
 				BC53C60B0DA56CF10021EB5D /* GradientCG.cpp in Sources */,
 				B2A015A80AF6CD53006BCE0E /* GraphicsContext.cpp in Sources */,
+				49C7BA021042D38C0009D447 /* GraphicsContext3DMac.cpp in Sources */,
 				B2ED97710B1F55CE00257D0F /* GraphicsContextCG.cpp in Sources */,
 				B277B4040B22F37C0004BEC6 /* GraphicsContextMac.mm in Sources */,
 				0F580B0C0F12A2690051D689 /* GraphicsLayer.cpp in Sources */,
 				0F580B050F12A2550051D689 /* GraphicsLayerCA.mm in Sources */,
 				B2A015AA0AF6CD53006BCE0E /* GraphicsTypes.cpp in Sources */,
 				BC94D1530C275C8B006BC617 /* History.cpp in Sources */,
+				97DCE20110807C750057D394 /* HistoryController.cpp in Sources */,
 				51741D120B07259A00ED442C /* HistoryItem.cpp in Sources */,
 				5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */,
 				9363B62C0F8E8FE000803810 /* HistoryPropertyList.cpp in Sources */,
@@ -18893,6 +19019,7 @@
 				41F061750F5F00AC00A07EAC /* InspectorDOMStorageResource.cpp in Sources */,
 				7AED3E050FBB1EAA00D2B03C /* InspectorFrontend.cpp in Sources */,
 				41F062020F5F0B6600A07EAC /* InspectorResource.cpp in Sources */,
+				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
 				B27535600B053814002CE64F /* IntPointCG.cpp in Sources */,
 				B275357C0B053814002CE64F /* IntPointMac.mm in Sources */,
 				B27535730B053814002CE64F /* IntRect.cpp in Sources */,
@@ -18917,8 +19044,48 @@
 				BC2ED6BC0C6BD2F000920BFF /* JSAttrCustom.cpp in Sources */,
 				E4EEFFC80D34550C00469A58 /* JSAudioConstructor.cpp in Sources */,
 				BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */,
+				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
+				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
+				A7D20F62107F406900A80392 /* JSCanvasActiveInfo.cpp in Sources */,
+				49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */,
+				49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */,
+				49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */,
+				492273A31083B3B100EE5C84 /* JSCanvasArrayCustom.cpp in Sources */,
+				49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */,
+				49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */,
+				49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */,
+				49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */,
+				49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */,
+				49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */,
+				49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */,
+				49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */,
 				65DF323909D1DE65000BE325 /* JSCanvasGradient.cpp in Sources */,
+				49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */,
+				49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */,
+				49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */,
 				65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */,
+				49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */,
+				49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */,
+				49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */,
+				49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */,
+				49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
+				49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */,
+				49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */,
+				49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */,
+				49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */,
+				49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */,
+				49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */,
+				49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */,
+				49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */,
+				49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */,
+				49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */,
+				49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */,
+				49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */,
+				49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */,
+				49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */,
+				49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */,
+				49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */,
+				49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */,
 				93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */,
 				93BA59B20F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp in Sources */,
 				65DF31F309D1CC60000BE325 /* JSCharacterData.cpp in Sources */,
@@ -18941,6 +19108,7 @@
 				14CF7B3309F6ECD700EB3665 /* JSCSSRule.cpp in Sources */,
 				BC46C1EE0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp in Sources */,
 				A8D05FA70A23B301005E7203 /* JSCSSRuleList.cpp in Sources */,
+				9392262F10321084006E7D5D /* JSCSSRuleListCustom.cpp in Sources */,
 				142011B60A003133008303F9 /* JSCSSStyleDeclaration.cpp in Sources */,
 				BC5825F30C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp in Sources */,
 				BC46C2060C0DDCA10020CFC3 /* JSCSSStyleRule.cpp in Sources */,
@@ -18959,6 +19127,7 @@
 				1A3417CA0CECFF250049CBDE /* JSCustomVoidCallback.cpp in Sources */,
 				E10B93C30B73C291003ED890 /* JSCustomXPathNSResolver.cpp in Sources */,
 				1AE82F8F0CAAFA9D002237AE /* JSDatabase.cpp in Sources */,
+				BCCE58AC1061E8CF008FB35A /* JSDatabaseCustom.cpp in Sources */,
 				BC77D1690FF19F560070887B /* JSDataGridColumn.cpp in Sources */,
 				BC77D16B0FF19F560070887B /* JSDataGridColumnList.cpp in Sources */,
 				BC77D1520FF19C730070887B /* JSDataGridColumnListCustom.cpp in Sources */,
@@ -18967,7 +19136,9 @@
 				4162A454101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp in Sources */,
 				33503CC010179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp in Sources */,
 				659DDC8209E198BA001BF3C6 /* JSDocument.cpp in Sources */,
+				49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */,
 				1A494EDE0A123F4C00FDAFC1 /* JSDocumentFragment.cpp in Sources */,
+				BCCE58AF1061E90C008FB35A /* JSDocumentFragmentCustom.cpp in Sources */,
 				65DF31F509D1CC60000BE325 /* JSDocumentType.cpp in Sources */,
 				1AC2260C0DB69F190089B669 /* JSDOMApplicationCache.cpp in Sources */,
 				1AC226170DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp in Sources */,
@@ -19001,7 +19172,6 @@
 				FE80DA650E9C4703000D6F75 /* JSGeoposition.cpp in Sources */,
 				BC94D14E0C275C68006BC617 /* JSHistory.cpp in Sources */,
 				BCE7B1930D4E86960075A539 /* JSHistoryCustom.cpp in Sources */,
-				9350E70D0E87500B00189FFF /* JSHTMLAllCollection.cpp in Sources */,
 				1A4A2DEF0A1B852A00C807F8 /* JSHTMLAnchorElement.cpp in Sources */,
 				1A4A2DF10A1B852A00C807F8 /* JSHTMLAppletElement.cpp in Sources */,
 				BC4EDEF40C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp in Sources */,
@@ -19014,6 +19184,7 @@
 				1AE2AA240A1CDAB400B42B25 /* JSHTMLBRElement.cpp in Sources */,
 				A80E7EA00A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp in Sources */,
 				938E666009F09B81008A48EC /* JSHTMLCanvasElement.cpp in Sources */,
+				9392262D1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp in Sources */,
 				BCCBAD400C18C14200CE890F /* JSHTMLCollection.cpp in Sources */,
 				BCCBAD3B0C18BFF800CE890F /* JSHTMLCollectionCustom.cpp in Sources */,
 				BC77CDCE0FEFF33B0070887B /* JSHTMLDataGridCellElement.cpp in Sources */,
@@ -19099,12 +19270,14 @@
 				935F45420F7C3B5F00D7C1FB /* JSLazyEventListener.cpp in Sources */,
 				BCE1C43B0D9830D3003B02F2 /* JSLocation.cpp in Sources */,
 				BCE1C4400D9830F4003B02F2 /* JSLocationCustom.cpp in Sources */,
+				0FF50269102BA9430066F39A /* JSMedia.cpp in Sources */,
 				E44614180CD6826900FADA75 /* JSMediaError.cpp in Sources */,
 				BC3C39B60C0D3D8D005F4D7A /* JSMediaList.cpp in Sources */,
 				E107400D0E77BDC00033AF24 /* JSMessageChannel.cpp in Sources */,
 				E10743240E7835830033AF24 /* JSMessageChannelConstructor.cpp in Sources */,
 				E1A5F99B0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp in Sources */,
 				75793EC80D0CE72D007FC0AC /* JSMessageEvent.cpp in Sources */,
+				410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */,
 				E1ADEDDB0E76BD93004A1A5E /* JSMessagePort.cpp in Sources */,
 				E1ADED470E76B8DD004A1A5E /* JSMessagePortCustom.cpp in Sources */,
 				A9D248060D757E7D00FDF959 /* JSMimeType.cpp in Sources */,
@@ -19130,6 +19303,7 @@
 				33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */,
 				A826EC480A1B0CBE00CD1BB6 /* JSOptionConstructor.cpp in Sources */,
 				1A0D57400A5C7867007EDD4C /* JSOverflowEvent.cpp in Sources */,
+				E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */,
 				A9D247FE0D757E6900FDF959 /* JSPlugin.cpp in Sources */,
 				A9D248000D757E6900FDF959 /* JSPluginArray.cpp in Sources */,
 				A9C6E64C0D7465E7006442E9 /* JSPluginArrayCustom.cpp in Sources */,
@@ -19147,6 +19321,7 @@
 				41D07A7E0FF935CA0095EDCE /* JSSharedWorker.cpp in Sources */,
 				415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */,
 				41D1690510238B66009BC827 /* JSSharedWorkerContext.cpp in Sources */,
+				14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */,
 				514C76370CE9225E007EF3CD /* JSSQLError.cpp in Sources */,
 				1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */,
 				1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */,
@@ -19210,6 +19385,7 @@
 				B2FA3D840AB75A6F000E5AC4 /* JSSVGFEImageElement.cpp in Sources */,
 				B2FA3D860AB75A6F000E5AC4 /* JSSVGFEMergeElement.cpp in Sources */,
 				B2FA3D880AB75A6F000E5AC4 /* JSSVGFEMergeNodeElement.cpp in Sources */,
+				84224183107E77F400766A87 /* JSSVGFEMorphologyElement.cpp in Sources */,
 				B2FA3D8A0AB75A6F000E5AC4 /* JSSVGFEOffsetElement.cpp in Sources */,
 				B2FA3D8C0AB75A6F000E5AC4 /* JSSVGFEPointLightElement.cpp in Sources */,
 				B2FA3D8E0AB75A6F000E5AC4 /* JSSVGFESpecularLightingElement.cpp in Sources */,
@@ -19371,8 +19547,14 @@
 				1A8F6BC50DB55CDC001DB794 /* ManifestParser.cpp in Sources */,
 				A8C4A80609D563270003AC8D /* MappedAttribute.cpp in Sources */,
 				93309DF7099E64920056E581 /* markup.cpp in Sources */,
+				FABE72F41059C1EB00D999DD /* MathMLElement.cpp in Sources */,
+				FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */,
+				FABE72F61059C1EB00D999DD /* MathMLInlineContainerElement.cpp in Sources */,
+				FABE72F81059C1EB00D999DD /* MathMLMathElement.cpp in Sources */,
+				FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */,
 				49D5DC2B0F423A73008F20FD /* Matrix3DTransformOperation.cpp in Sources */,
 				49E911C60EF86D47009D0CAF /* MatrixTransformOperation.cpp in Sources */,
+				0FF50271102BA96A0066F39A /* Media.cpp in Sources */,
 				ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */,
 				AB40484D0E083FA8007D6920 /* MediaDocument.cpp in Sources */,
 				4E1959210A39DABA00220FE5 /* MediaFeatureNames.cpp in Sources */,
@@ -19425,6 +19607,7 @@
 				1CF6BE140E9BB4670025E1CD /* ObjCNodeFilterCondition.mm in Sources */,
 				087281550F26B9B600AFC596 /* OptionElement.cpp in Sources */,
 				087281570F26B9B600AFC596 /* OptionGroupElement.cpp in Sources */,
+				0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */,
 				51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */,
 				51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */,
 				1A0D57360A5C77FE007EDD4C /* OverflowEvent.cpp in Sources */,
@@ -19433,6 +19616,7 @@
 				9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */,
 				7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */,
 				1C26497C0D7E24EC00BD10F2 /* PageMac.cpp in Sources */,
+				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				4B2709830AF2E5E00065127F /* PasteboardMac.mm in Sources */,
 				B275357F0B053814002CE64F /* Path.cpp in Sources */,
@@ -19452,8 +19636,11 @@
 				A9C6E4F30D745E48006442E9 /* PluginData.cpp in Sources */,
 				A9C6E4F60D745E61006442E9 /* PluginDataMac.mm in Sources */,
 				1AC694C70A3B1676003F5049 /* PluginDocument.cpp in Sources */,
+				7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */,
 				1ADA14100E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp in Sources */,
 				B2B1F7160D00CAA8004AEA64 /* PointerEventsHitRules.cpp in Sources */,
+				97059977107D975200A50A7C /* PolicyCallback.cpp in Sources */,
+				97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */,
 				0668E1900ADD9640004128E0 /* PopupMenuMac.mm in Sources */,
 				93F19AF808245E59001E9ABC /* Position.cpp in Sources */,
 				37919C230B7D188600A56998 /* PositionIterator.cpp in Sources */,
@@ -19465,6 +19652,7 @@
 				E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */,
 				550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */,
 				93F19AB908245E59001E9ABC /* Range.cpp in Sources */,
+				979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */,
 				85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */,
 				B2C3DA2C0D006C1D00EF6F26 /* RegularExpression.cpp in Sources */,
 				93309E00099E64920056E581 /* RemoveCSSPropertyCommand.cpp in Sources */,
@@ -19577,6 +19765,7 @@
 				416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */,
 				416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */,
 				93B70D6F09EB0C7C009D8468 /* ScriptController.cpp in Sources */,
+				97EF7DFE107E55B700D7C49C /* ScriptControllerBase.cpp in Sources */,
 				A83E1C740E49042C00140B9C /* ScriptControllerMac.mm in Sources */,
 				08A484770E5272C500C3FE76 /* ScriptElement.cpp in Sources */,
 				411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */,
@@ -19600,6 +19789,7 @@
 				93309E0D099E64920056E581 /* SelectionController.cpp in Sources */,
 				4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */,
 				BC7FA6820D1F167900DB22A9 /* SelectorNodeList.cpp in Sources */,
+				A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */,
 				93309E0F099E64920056E581 /* SetNodeAttributeCommand.cpp in Sources */,
 				14C9A5EA0B3D105F005A0232 /* Settings.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
@@ -19619,6 +19809,9 @@
 				4B6FA6F70C39E4A100087011 /* SmartReplaceCF.cpp in Sources */,
 				E4AFD00B0DAF335400F5F55C /* SMILTime.cpp in Sources */,
 				E4AFD00D0DAF335500F5F55C /* SMILTimeContainer.cpp in Sources */,
+				510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */,
+				510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */,
+				51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */,
 				4B3043C90AE0371D00A82647 /* SoundMac.mm in Sources */,
 				84A81F3D0FC7DFF000955300 /* SourceAlpha.cpp in Sources */,
 				84A81F410FC7E02700955300 /* SourceGraphic.cpp in Sources */,
@@ -19634,6 +19827,8 @@
 				1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */,
 				515B039A0CD1642A00B7EA9C /* SQLStatement.cpp in Sources */,
 				1ABFE7530CD968D000FE4834 /* SQLTransaction.cpp in Sources */,
+				B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */,
+				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
 				1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */,
 				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.mm in Sources */,
 				BC7FA62E0D1F0EFF00DB22A9 /* StaticNodeList.cpp in Sources */,
@@ -19641,6 +19836,7 @@
 				C5160EEA1004543A00A7CEE2 /* StorageAreaImpl.cpp in Sources */,
 				C5102ED00FD9EF8C00FAFF04 /* StorageAreaSync.cpp in Sources */,
 				51E0BABC0DA5547100A9E417 /* StorageEvent.cpp in Sources */,
+				C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */,
 				51E0BB390DA5ACB600A9E417 /* StorageMap.cpp in Sources */,
 				C50D0E820FF4272900AC2644 /* StorageNamespace.cpp in Sources */,
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
@@ -19719,7 +19915,6 @@
 				B22279E20D00BF220071B782 /* SVGFEFuncBElement.cpp in Sources */,
 				B22279E50D00BF220071B782 /* SVGFEFuncGElement.cpp in Sources */,
 				B22279E80D00BF220071B782 /* SVGFEFuncRElement.cpp in Sources */,
-				B25599820D00D8BA00BB825C /* SVGFEGaussianBlur.cpp in Sources */,
 				B22279EB0D00BF220071B782 /* SVGFEGaussianBlurElement.cpp in Sources */,
 				B25599840D00D8BA00BB825C /* SVGFEImage.cpp in Sources */,
 				B22279EE0D00BF220071B782 /* SVGFEImageElement.cpp in Sources */,
@@ -19728,6 +19923,7 @@
 				B22279F30D00BF220071B782 /* SVGFEMergeElement.cpp in Sources */,
 				B22279F60D00BF220071B782 /* SVGFEMergeNodeElement.cpp in Sources */,
 				B25599880D00D8BA00BB825C /* SVGFEMorphology.cpp in Sources */,
+				84224193107E78A700766A87 /* SVGFEMorphologyElement.cpp in Sources */,
 				B255998A0D00D8BA00BB825C /* SVGFEOffset.cpp in Sources */,
 				B22279F90D00BF220071B782 /* SVGFEOffsetElement.cpp in Sources */,
 				B22279FC0D00BF220071B782 /* SVGFEPointLightElement.cpp in Sources */,
@@ -19844,6 +20040,7 @@
 				B2227AF20D00BF220071B782 /* SVGViewSpec.cpp in Sources */,
 				B2227AF50D00BF220071B782 /* SVGZoomAndPan.cpp in Sources */,
 				B2E4EC970D00C22B00432643 /* SVGZoomEvent.cpp in Sources */,
+				0878B1FE10874E3F00A55097 /* SynchronizablePropertyController.cpp in Sources */,
 				6582A16309999D6D00BEEB6D /* SystemTimeMac.cpp in Sources */,
 				BCE3BEC20D222B1D007E06E4 /* TagNodeList.cpp in Sources */,
 				6550B6A5099DF0270090D781 /* Text.cpp in Sources */,
@@ -19876,6 +20073,7 @@
 				49E911C30EF86D47009D0CAF /* TransformationMatrix.cpp in Sources */,
 				B27535580B053814002CE64F /* TransformationMatrixCG.cpp in Sources */,
 				49E911CF0EF86D47009D0CAF /* TransformOperations.cpp in Sources */,
+				5DB1BC6B10715A6400EFAA49 /* TransformSourceLibxslt.cpp in Sources */,
 				0F500AB10F54DB3100EEF928 /* TransformState.cpp in Sources */,
 				49E911D10EF86D47009D0CAF /* TranslateTransformOperation.cpp in Sources */,
 				854FE7360A2297BE0058D7AD /* Traversal.cpp in Sources */,
@@ -19886,6 +20084,7 @@
 				B2C3DA4C0D006C1D00EF6F26 /* UnicodeRange.cpp in Sources */,
 				D086FE9909D53AAB005BC74D /* UnlinkCommand.cpp in Sources */,
 				65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */,
+				BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */,
 				15C7708E100D3C6B005BA267 /* ValidityState.cpp in Sources */,
 				93309E1D099E64920056E581 /* visible_units.cpp in Sources */,
 				93309E1F099E64920056E581 /* VisiblePosition.cpp in Sources */,
@@ -19908,6 +20107,8 @@
 				0FCF332E0F2B9A25004B6795 /* WebLayer.mm in Sources */,
 				1CAF34820A6C405200ABE06E /* WebScriptObject.mm in Sources */,
 				518A34C11026C831001B6896 /* WebSocket.cpp in Sources */,
+				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
+				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
 				0FCF332C0F2B9A25004B6795 /* WebTiledLayer.mm in Sources */,
 				85031B500A44EFC700F992E0 /* WheelEvent.cpp in Sources */,
 				935C477309AC4D7700A6AAB4 /* WheelEventMac.mm in Sources */,
@@ -19995,108 +20196,13 @@
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */,
-				0FF5025C102BA9010066F39A /* DOMMedia.mm in Sources */,
-				0FF50269102BA9430066F39A /* JSMedia.cpp in Sources */,
-				0FF50271102BA96A0066F39A /* Media.cpp in Sources */,
-				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
-				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
-				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
-				49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */,
-				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
-				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
-				9392262D1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp in Sources */,
-				9392262F10321084006E7D5D /* JSCSSRuleListCustom.cpp in Sources */,
-				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
-				410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */,
-				0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */,
-				B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */,
-				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
-				49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */,
-				49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */,
-				49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */,
-				49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */,
-				49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */,
-				49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */,
-				49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */,
-				49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */,
-				49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */,
-				49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */,
-				49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */,
-				49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */,
-				49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */,
-				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
-				49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */,
-				49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */,
-				49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */,
-				49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */,
-				49C7BA021042D38C0009D447 /* GraphicsContext3DMac.cpp in Sources */,
-				49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */,
-				E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */,
-				E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */,
-				510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */,
-				510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */,
-				51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */,
-				75A94A03104B74FB0006673C /* TimelineItem.cpp in Sources */,
-				75092BFE104B80F9003DD168 /* DOMDispatchTimelineItem.cpp in Sources */,
-				49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */,
-				49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */,
-				49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */,
-				49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */,
-				49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */,
-				49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */,
-				49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */,
-				49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */,
-				49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */,
-				49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */,
-				49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */,
-				49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */,
-				49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */,
-				49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */,
-				49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */,
-				49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */,
-				49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */,
-				49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */,
-				49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */,
-				49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */,
-				49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */,
-				49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */,
-				49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */,
-				49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */,
-				49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */,
-				49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */,
-				49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */,
-				49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */,
-				49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */,
-				49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */,
-				49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */,
-				49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */,
-				49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */,
-				49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */,
-				49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
-				49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */,
-				49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */,
-				59C77F2A10545B3B00506104 /* GeolocationServiceMock.cpp in Sources */,
-				51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */,
-				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
-				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
-				FABE72F41059C1EB00D999DD /* MathMLElement.cpp in Sources */,
-				FABE72F61059C1EB00D999DD /* MathMLInlineContainerElement.cpp in Sources */,
-				FABE72F81059C1EB00D999DD /* MathMLMathElement.cpp in Sources */,
-				FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */,
-				FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */,
-				BCCE58AC1061E8CF008FB35A /* JSDatabaseCustom.cpp in Sources */,
-				BCCE58AF1061E90C008FB35A /* JSDocumentFragmentCustom.cpp in Sources */,
-				C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */,
-				14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */,
-				7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */,
-				BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */,
-				5DB1BC6B10715A6400EFAA49 /* TransformSourceLibxslt.cpp in Sources */,
-				979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */,
-				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
-				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
-				A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */,
-				97059977107D975200A50A7C /* PolicyCallback.cpp in Sources */,
-				97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */,
+				3314ACEB10892086000F0E56 /* JSExceptionBase.cpp in Sources */,
+				973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */,
+				84801954108BAFB300CB2B1F /* FEGaussianBlur.cpp in Sources */,
+				7553CFE9108F473F00EA281E /* TimelineRecordFactory.cpp in Sources */,
+				BC97E23B109144950010D361 /* HTMLAllCollection.cpp in Sources */,
+				BC97E412109154FA0010D361 /* JSHTMLAllCollection.cpp in Sources */,
+				BC97E42C10915B060010D361 /* JSHTMLAllCollectionCustom.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/WebCoreSources.bkl b/WebCore/WebCoreSources.bkl
index 013b4d6..c579084 100644
--- a/WebCore/WebCoreSources.bkl
+++ b/WebCore/WebCoreSources.bkl
@@ -161,6 +161,7 @@ This file contains the list of files needed to build WebCore.
         bindings/js/ScheduledAction.cpp
         bindings/js/JSWebKitCSSMatrixConstructor.cpp
         bindings/js/JSWebKitPointConstructor.cpp
+        bindings/ScriptControllerBase.cpp
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_BRIDGE">
@@ -719,6 +720,7 @@ This file contains the list of files needed to build WebCore.
         loader/FrameLoader.cpp
         loader/FTPDirectoryDocument.cpp
         loader/FTPDirectoryParser.cpp
+        loader/HistoryController.cpp
         loader/ImageDocument.cpp
         loader/ImageLoader.cpp
         loader/MainResourceLoader.cpp
@@ -731,6 +733,7 @@ This file contains the list of files needed to build WebCore.
         loader/RedirectScheduler.cpp
         loader/Request.cpp
         loader/ResourceLoader.cpp
+        loader/ResourceLoadNotifier.cpp
         loader/SubresourceLoader.cpp
         loader/TextDocument.cpp
         loader/TextResourceDecoder.cpp
diff --git a/WebCore/accessibility/AccessibilityAllInOne.cpp b/WebCore/accessibility/AccessibilityAllInOne.cpp
new file mode 100755
index 0000000..04124bd
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityAllInOne.cpp
@@ -0,0 +1,44 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

+ */

+

+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.

+

+#include <AccessibilityARIAGrid.cpp>

+#include <AccessibilityARIAGridCell.cpp>

+#include <AccessibilityARIAGridRow.cpp>

+#include <AccessibilityImageMapLink.cpp>

+#include <AccessibilityList.cpp>

+#include <AccessibilityListBox.cpp>

+#include <AccessibilityListBoxOption.cpp>

+#include <AccessibilityMediaControls.cpp>

+#include <AccessibilityObject.cpp>

+#include <AccessibilityRenderObject.cpp>

+#include <AccessibilitySlider.cpp>

+#include <AccessibilityTable.cpp>

+#include <AccessibilityTableCell.cpp>

+#include <AccessibilityTableColumn.cpp>

+#include <AccessibilityTableHeaderContainer.cpp>

+#include <AccessibilityTableRow.cpp>

+#include <AXObjectCache.cpp>

diff --git a/WebCore/accessibility/AccessibilityListBoxOption.h b/WebCore/accessibility/AccessibilityListBoxOption.h
index 1b588cd..933cdeb 100644
--- a/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -68,6 +68,7 @@ public:
 private:
     HTMLElement* m_optionElement;
     
+    virtual bool canHaveChildren() const { return false; }
     HTMLSelectElement* listBoxOptionParentNode() const;
     int listBoxOptionIndex() const;
     IntRect listBoxOptionRect() const;
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index c5ba1ed..8fc40e8 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -160,6 +160,7 @@ enum AccessibilityRole {
     DefinitionListDefinitionRole,
     AnnotationRole,
     SliderThumbRole,
+    IgnoredRole,
     
     // ARIA Grouping roles
     LandmarkApplicationRole,
@@ -188,6 +189,12 @@ enum AccessibilityOrientation {
     AccessibilityOrientationHorizontal,
 };
     
+enum AccessibilityObjectPlatformInclusion {
+    IncludeObject,
+    IgnoreObject,
+    DefaultBehavior,
+};
+
 struct VisiblePositionRange {
 
     VisiblePosition start;
@@ -459,6 +466,13 @@ public:
     bool accessibilityIgnoreAttachment() const { return true; }
 #endif
 
+    // gives platforms the opportunity to indicate if and how an object should be included
+#if HAVE(ACCESSIBILITY)
+    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const;
+#else
+    AccessibilityObjectPlatformInclusion accessibilityPlatformIncludesObject() const { return DefaultBehavior; }
+#endif
+
     // allows for an AccessibilityObject to update its render tree or perform
     // other operations update type operations
     virtual void updateBackingStore() { }
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index 834e931..4c50b9a 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1258,6 +1258,14 @@ bool AccessibilityRenderObject::ariaIsHidden() const
 
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
+    // is the platform is interested in this object?
+    AccessibilityObjectPlatformInclusion decision = accessibilityPlatformIncludesObject();
+    if (decision == IncludeObject)
+        return false;
+    if (decision == IgnoreObject)
+        return true;
+    // the decision must, therefore, be DefaultBehavior.
+
     // ignore invisible element
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
         return true;
@@ -1268,6 +1276,9 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (isPresentationalChildOfAriaRole())
         return true;
         
+    if (roleValue() == IgnoredRole)
+        return true;
+    
     // ignore popup menu items because AppKit does
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
         if (parent->isMenuList())
@@ -2212,6 +2223,21 @@ AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElem
     return axObjectCache()->getOrCreate(correspondingControl->renderer());     
 }
 
+AccessibilityObject* AccessibilityRenderObject::correspondingLabelForControlElement() const
+{
+    if (!m_renderer)
+        return 0;
+
+    Node* node = m_renderer->node();
+    if (node && node->isHTMLElement()) {
+        HTMLLabelElement* label = labelForElement(static_cast<Element*>(node));
+        if (label)
+            return axObjectCache()->getOrCreate(label->renderer());
+    }
+
+    return 0;
+}
+
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
     for (RenderObject* renderer = m_renderer; renderer && renderer->node(); renderer = renderer->parent()) {
@@ -2224,13 +2250,13 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
 typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
 
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
+
 static const ARIARoleMap& createARIARoleMap()
 {
-    struct RoleEntry {
-        String ariaRole;
-        AccessibilityRole webcoreRole;
-    };
-
     const RoleEntry roles[] = {
         { "application", LandmarkApplicationRole },
         { "article", DocumentArticleRole },
@@ -2263,6 +2289,8 @@ static const ARIARoleMap& createARIARoleMap()
         { "menuitemradio", MenuItemRole },
         { "note", DocumentNoteRole },
         { "navigation", LandmarkNavigationRole },
+        { "option", ListBoxOptionRole },
+        { "presentation", IgnoredRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
         { "radiogroup", RadioGroupRole },
@@ -2508,6 +2536,8 @@ bool AccessibilityRenderObject::canHaveChildren() const
         case PopUpButtonRole:
         case CheckBoxRole:
         case RadioButtonRole:
+        case StaticTextRole:
+        case ListBoxOptionRole:
             return false;
         default:
             return true;
@@ -2561,7 +2591,7 @@ void AccessibilityRenderObject::addChildren()
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
                 // add an <area> element for this child if it has a link
-                if (current->isLink()) {
+                if (current->hasTagName(areaTag) && current->isLink()) {
                     AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->getOrCreate(ImageMapLinkRole));
                     areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(current));
                     areaObject->setHTMLMapElement(map);
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index d82ca71..c6fd748 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -134,6 +134,7 @@ public:
     virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
     virtual AccessibilityObject* correspondingControlForLabelElement() const;
+    virtual AccessibilityObject* correspondingLabelForControlElement() const;
 
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
diff --git a/WebCore/accessibility/chromium/AccessibilityObjectChromium.cpp b/WebCore/accessibility/chromium/AccessibilityObjectChromium.cpp
index 650fb3a..7ab7d79 100644
--- a/WebCore/accessibility/chromium/AccessibilityObjectChromium.cpp
+++ b/WebCore/accessibility/chromium/AccessibilityObjectChromium.cpp
@@ -34,4 +34,9 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    return DefaultBehavior;
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
index 854816f..7fd59ac 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
@@ -32,6 +32,24 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    AccessibilityObject* parent = parentObject();
+    if (!parent)
+        return DefaultBehavior;
+
+    // When a list item is made up entirely of children (e.g. paragraphs)
+    // the list item gets ignored. We need it.
+    if (isGroup() && parent->isList())
+        return IncludeObject;
+
+    // Entries and password fields have extraneous children which we want to ignore.
+    if (parent->isPasswordField() || parent->isTextControl())
+        return IgnoreObject;
+
+    return DefaultBehavior;
+}
+
 AccessibilityObjectWrapper* AccessibilityObject::wrapper() const
 {
     return m_wrapper;
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 811903d..c5f09ae 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -36,6 +36,10 @@
 #include "AXObjectCache.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityRenderObject.h"
+#include "AccessibilityTable.h"
+#include "AccessibilityTableCell.h"
+#include "AccessibilityTableColumn.h"
+#include "AccessibilityTableRow.h"
 #include "AtomicString.h"
 #include "CString.h"
 #include "Document.h"
@@ -44,6 +48,8 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "HTMLNames.h"
+#include "HTMLTableCaptionElement.h"
+#include "HTMLTableElement.h"
 #include "InlineTextBox.h"
 #include "IntRect.h"
 #include "NotImplemented.h"
@@ -120,21 +126,81 @@ static AccessibilityObject* core(AtkImage* image)
     return core(ATK_OBJECT(image));
 }
 
+static AccessibilityObject* core(AtkTable* table)
+{
+    return core(ATK_OBJECT(table));
+}
+
 static const gchar* webkit_accessible_get_name(AtkObject* object)
 {
-    return returnString(core(object)->stringValue());
+    AccessibilityObject* coreObject = core(object);
+    if (coreObject->isControl()) {
+        AccessibilityRenderObject* renderObject = static_cast<AccessibilityRenderObject*>(coreObject);
+        AccessibilityObject* label = renderObject->correspondingLabelForControlElement();
+        if (label) {
+            AccessibilityRenderObject::AccessibilityChildrenVector children = label->children();
+            // Currently, label->stringValue() should be an empty String. This
+            // might not be the case down the road.
+            String name = label->stringValue();
+            for (unsigned i = 0; i < children.size(); ++i)
+                name += children.at(i).get()->stringValue();
+            return returnString(name);
+        }
+    }
+    return returnString(coreObject->stringValue());
 }
 
 static const gchar* webkit_accessible_get_description(AtkObject* object)
 {
-    // TODO: the Mozilla MSAA implementation prepends "Description: "
-    // Should we do this too?
-    return returnString(core(object)->accessibilityDescription());
+    AccessibilityObject* coreObject = core(object);
+
+    // atk_table_get_summary returns an AtkObject. We have no summary object, so expose summary here.
+    if (coreObject->roleValue() == TableRole && coreObject->ariaRoleAttribute() == UnknownRole) {
+        Node* node = static_cast<AccessibilityRenderObject*>(coreObject)->renderer()->node();
+        if (node && node->isHTMLElement()) {
+            String summary = static_cast<HTMLTableElement*>(node)->summary();
+            if (!summary.isEmpty())
+                return returnString(summary);
+        }
+    }
+
+    return returnString(coreObject->accessibilityDescription());
+}
+
+static void setAtkRelationSetFromCoreObject(AccessibilityObject* coreObject, AtkRelationSet* relationSet)
+{
+    AccessibilityRenderObject* accObject = static_cast<AccessibilityRenderObject*>(coreObject);
+    if (accObject->isControl()) {
+        AccessibilityObject* label = accObject->correspondingLabelForControlElement();
+        if (label)
+            atk_relation_set_add_relation_by_type(relationSet, ATK_RELATION_LABELLED_BY, label->wrapper());
+    } else {
+        AccessibilityObject* control = accObject->correspondingControlForLabelElement();
+        if (control)
+            atk_relation_set_add_relation_by_type(relationSet, ATK_RELATION_LABEL_FOR, control->wrapper());
+    }
 }
 
+static gpointer webkit_accessible_parent_class = NULL;
+
 static AtkObject* webkit_accessible_get_parent(AtkObject* object)
 {
-    AccessibilityObject* coreParent = core(object)->parentObject();
+    AccessibilityObject* coreParent = core(object)->parentObjectUnignored();
+
+    // The top level web view claims to not have a parent. This makes it
+    // impossible for assistive technologies to ascend the accessible
+    // hierarchy all the way to the application. (Bug 30489)
+    if (!coreParent && core(object)->isWebArea()) {
+        HostWindow* hostWindow = core(object)->document()->view()->hostWindow();
+        if (hostWindow) {
+            PlatformPageClient webView = hostWindow->platformPageClient();
+            if (webView) {
+                GtkWidget* webViewParent = gtk_widget_get_parent(webView);
+                if (webViewParent)
+                    return gtk_widget_get_accessible(webViewParent);
+            }
+        }
+    }
 
     if (!coreParent)
         return NULL;
@@ -160,8 +226,7 @@ static AtkObject* webkit_accessible_ref_child(AtkObject* object, gint index)
         return NULL;
 
     AtkObject* child = coreChild->wrapper();
-    // TODO: Should we call atk_object_set_parent() here?
-    //atk_object_set_parent(child, object);
+    atk_object_set_parent(child, object);
     g_object_ref(child);
 
     return child;
@@ -169,11 +234,43 @@ static AtkObject* webkit_accessible_ref_child(AtkObject* object, gint index)
 
 static gint webkit_accessible_get_index_in_parent(AtkObject* object)
 {
-    // FIXME: This needs to be implemented.
-    notImplemented();
+    AccessibilityObject* coreObject = core(object);
+    AccessibilityObject* parent = coreObject->parentObjectUnignored();
+
+    g_return_val_if_fail(parent, 0);
+
+    AccessibilityObject::AccessibilityChildrenVector children = parent->children();
+    unsigned count = children.size();
+    for (unsigned i = 0; i < count; ++i) {
+        if (children[i] == coreObject)
+            return i;
+    }
+
     return 0;
 }
 
+static AtkAttributeSet* addAttributeToSet(AtkAttributeSet* attributeSet, const char* name, const char* value)
+{
+    AtkAttribute* attribute = static_cast<AtkAttribute*>(g_malloc(sizeof(AtkAttribute)));
+    attribute->name = g_strdup(name);
+    attribute->value = g_strdup(value);
+    attributeSet = g_slist_prepend(attributeSet, attribute);
+
+    return attributeSet;
+}
+
+static AtkAttributeSet* webkit_accessible_get_attributes(AtkObject* object)
+{
+    AtkAttributeSet* attributeSet = NULL;
+
+    int headingLevel = core(object)->headingLevel();
+    if (headingLevel) {
+        String value = String::number(headingLevel);
+        attributeSet = addAttributeToSet(attributeSet, "level", value.utf8().data());
+    }
+    return attributeSet;
+}
+
 static AtkRole atkRole(AccessibilityRole role)
 {
     switch (role) {
@@ -234,8 +331,6 @@ static AtkRole atkRole(AccessibilityRole role)
         return ATK_ROLE_TABLE;
     case ApplicationRole:
         return ATK_ROLE_APPLICATION;
-    //case LabelRole: // TODO: should this be covered in the switch?
-    //    return ATK_ROLE_LABEL;
     case GroupRole:
     case RadioGroupRole:
         return ATK_ROLE_PANEL;
@@ -278,11 +373,17 @@ static AtkRole webkit_accessible_get_role(AtkObject* object)
             return ATK_ROLE_LIST_ITEM;
     }
 
-    // WebCore does not know about paragraph role
+    // WebCore does not know about paragraph role, label role, or section role
     if (AXObject->isAccessibilityRenderObject()) {
         Node* node = static_cast<AccessibilityRenderObject*>(AXObject)->renderer()->node();
-        if (node && node->hasTagName(HTMLNames::pTag))
-            return ATK_ROLE_PARAGRAPH;
+        if (node) {
+            if (node->hasTagName(HTMLNames::pTag))
+                return ATK_ROLE_PARAGRAPH;
+            if (node->hasTagName(HTMLNames::labelTag))
+                return ATK_ROLE_LABEL;
+            if (node->hasTagName(HTMLNames::divTag))
+                return ATK_ROLE_SECTION;
+        }
     }
 
     // Note: Why doesn't WebCore have a password field for this
@@ -294,15 +395,20 @@ static AtkRole webkit_accessible_get_role(AtkObject* object)
 
 static void setAtkStateSetFromCoreObject(AccessibilityObject* coreObject, AtkStateSet* stateSet)
 {
-    // Please keep the state list in alphabetical order
+    AccessibilityObject* parent = coreObject->parentObject();
+    bool isListBoxOption = parent && parent->isListBox();
 
+    // Please keep the state list in alphabetical order
     if (coreObject->isChecked())
         atk_state_set_add_state(stateSet, ATK_STATE_CHECKED);
 
     // FIXME: isReadOnly does not seem to do the right thing for
-    // controls, so check explicitly for them
-    if (!coreObject->isReadOnly() ||
-        (coreObject->isControl() && coreObject->canSetValueAttribute()))
+    // controls, so check explicitly for them. In addition, because
+    // isReadOnly is false for listBoxOptions, we need to add one
+    // more check so that we do not present them as being "editable".
+    if ((!coreObject->isReadOnly() ||
+        (coreObject->isControl() && coreObject->canSetValueAttribute())) &&
+        !isListBoxOption)
         atk_state_set_add_state(stateSet, ATK_STATE_EDITABLE);
 
     // FIXME: Put both ENABLED and SENSITIVE together here for now
@@ -332,8 +438,23 @@ static void setAtkStateSetFromCoreObject(AccessibilityObject* coreObject, AtkSta
 
     // TODO: ATK_STATE_SELECTABLE_TEXT
 
-    if (coreObject->isSelected())
+    if (coreObject->canSetSelectedAttribute()) {
+        atk_state_set_add_state(stateSet, ATK_STATE_SELECTABLE);
+        // Items in focusable lists in Gtk have both STATE_SELECT{ABLE,ED}
+        // and STATE_FOCUS{ABLE,ED}. We'll fake the latter based on the
+        // former.
+        if (isListBoxOption)
+            atk_state_set_add_state(stateSet, ATK_STATE_FOCUSABLE);
+    }
+
+    if (coreObject->isSelected()) {
         atk_state_set_add_state(stateSet, ATK_STATE_SELECTED);
+        // Items in focusable lists in Gtk have both STATE_SELECT{ABLE,ED}
+        // and STATE_FOCUS{ABLE,ED}. We'll fake the latter based on the
+        // former.
+        if (isListBoxOption)
+            atk_state_set_add_state(stateSet, ATK_STATE_FOCUSED);
+    }
 
     // FIXME: Group both SHOWING and VISIBLE here for now
     // Not sure how to handle this in WebKit, see bug
@@ -358,8 +479,6 @@ static void setAtkStateSetFromCoreObject(AccessibilityObject* coreObject, AtkSta
         atk_state_set_add_state(stateSet, ATK_STATE_VISITED);
 }
 
-static gpointer webkit_accessible_parent_class = NULL;
-
 static AtkStateSet* webkit_accessible_ref_state_set(AtkObject* object)
 {
     AtkStateSet* stateSet = ATK_OBJECT_CLASS(webkit_accessible_parent_class)->ref_state_set(object);
@@ -375,6 +494,16 @@ static AtkStateSet* webkit_accessible_ref_state_set(AtkObject* object)
     return stateSet;
 }
 
+static AtkRelationSet* webkit_accessible_ref_relation_set(AtkObject* object)
+{
+    AtkRelationSet* relationSet = ATK_OBJECT_CLASS(webkit_accessible_parent_class)->ref_relation_set(object);
+    AccessibilityObject* coreObject = core(object);
+
+    setAtkRelationSetFromCoreObject(coreObject, relationSet);
+
+    return relationSet;
+}
+
 static void webkit_accessible_init(AtkObject* object, gpointer data)
 {
     if (ATK_OBJECT_CLASS(webkit_accessible_parent_class)->initialize)
@@ -408,6 +537,8 @@ static void webkit_accessible_class_init(AtkObjectClass* klass)
     klass->get_role = webkit_accessible_get_role;
     klass->ref_state_set = webkit_accessible_ref_state_set;
     klass->get_index_in_parent = webkit_accessible_get_index_in_parent;
+    klass->get_attributes = webkit_accessible_get_attributes;
+    klass->ref_relation_set = webkit_accessible_ref_relation_set;
 }
 
 GType
@@ -939,6 +1070,110 @@ static void atk_image_interface_init(AtkImageIface* iface)
     iface->get_image_size = webkit_accessible_image_get_image_size;
 }
 
+// Table
+
+static AccessibilityTableCell* cell(AtkTable* table, guint row, guint column)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject())
+        return static_cast<AccessibilityTable*>(accTable)->cellForColumnAndRow(column, row);
+    return 0;
+}
+
+static gint cellIndex(AccessibilityTableCell* AXCell, AccessibilityTable* AXTable)
+{
+    // Calculate the cell's index as if we had a traditional Gtk+ table in
+    // which cells are all direct children of the table, arranged row-first.
+    AccessibilityObject::AccessibilityChildrenVector allCells;
+    AXTable->cells(allCells);
+    AccessibilityObject::AccessibilityChildrenVector::iterator position;
+    position = std::find(allCells.begin(), allCells.end(), AXCell);
+    if (position == allCells.end())
+        return -1;
+    return position - allCells.begin();
+}
+
+static AtkObject* webkit_accessible_table_ref_at(AtkTable* table, gint row, gint column)
+{
+    AccessibilityTableCell* AXCell = cell(table, row, column);
+    if (!AXCell)
+        return 0;
+    return AXCell->wrapper();
+}
+
+static gint webkit_accessible_table_get_index_at(AtkTable* table, gint row, gint column)
+{
+    AccessibilityTableCell* AXCell = cell(table, row, column);
+    AccessibilityTable* AXTable = static_cast<AccessibilityTable*>(core(table));
+    return cellIndex(AXCell, AXTable);
+}
+
+static gint webkit_accessible_table_get_n_columns(AtkTable* table)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject())
+        return static_cast<AccessibilityTable*>(accTable)->columnCount();
+    return 0;
+}
+
+static gint webkit_accessible_table_get_n_rows(AtkTable* table)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject())
+        return static_cast<AccessibilityTable*>(accTable)->rowCount();
+    return 0;
+}
+
+static gint webkit_accessible_table_get_column_extent_at(AtkTable* table, gint row, gint column)
+{
+    AccessibilityTableCell* AXCell = cell(table, row, column);
+    if (AXCell) {
+        pair<int, int> columnRange;
+        AXCell->columnIndexRange(columnRange);
+        return columnRange.second;
+    }
+    return 0;
+}
+
+static gint webkit_accessible_table_get_row_extent_at(AtkTable* table, gint row, gint column)
+{
+    AccessibilityTableCell* AXCell = cell(table, row, column);
+    if (AXCell) {
+        pair<int, int> rowRange;
+        AXCell->rowIndexRange(rowRange);
+        return rowRange.second;
+    }
+    return 0;
+}
+
+static AtkObject* webkit_accessible_table_get_row_header(AtkTable* table, gint row)
+{
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject()) {
+        AccessibilityObject::AccessibilityChildrenVector allRowHeaders;
+        static_cast<AccessibilityTable*>(accTable)->rowHeaders(allRowHeaders);
+
+        unsigned rowCount = allRowHeaders.size();
+        for (unsigned k = 0; k < rowCount; ++k) {
+            AccessibilityObject* rowObject = allRowHeaders[k]->parentObject();
+            if (static_cast<AccessibilityTableRow*>(rowObject)->rowIndex() == row)
+                return allRowHeaders[k]->wrapper();
+        }
+    }
+    return 0;
+}
+
+static void atk_table_interface_init(AtkTableIface* iface)
+{
+    iface->ref_at = webkit_accessible_table_ref_at;
+    iface->get_index_at = webkit_accessible_table_get_index_at;
+    iface->get_n_columns = webkit_accessible_table_get_n_columns;
+    iface->get_n_rows = webkit_accessible_table_get_n_rows;
+    iface->get_column_extent_at = webkit_accessible_table_get_column_extent_at;
+    iface->get_row_extent_at = webkit_accessible_table_get_row_extent_at;
+    iface->get_row_header = webkit_accessible_table_get_row_header;
+}
+
 static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atk_action_interface_init,
      (GInterfaceFinalizeFunc) NULL, NULL},
@@ -949,6 +1184,8 @@ static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atk_component_interface_init,
      (GInterfaceFinalizeFunc) NULL, NULL},
     {(GInterfaceInitFunc)atk_image_interface_init,
+     (GInterfaceFinalizeFunc) NULL, NULL},
+    {(GInterfaceInitFunc)atk_table_interface_init,
      (GInterfaceFinalizeFunc) NULL, NULL}
 };
 
@@ -957,7 +1194,8 @@ enum WAIType {
     WAI_EDITABLE_TEXT,
     WAI_TEXT,
     WAI_COMPONENT,
-    WAI_IMAGE
+    WAI_IMAGE,
+    WAI_TABLE
 };
 
 static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
@@ -973,6 +1211,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
       return ATK_TYPE_COMPONENT;
   case WAI_IMAGE:
       return ATK_TYPE_IMAGE;
+  case WAI_TABLE:
+      return ATK_TYPE_TABLE;
   }
 
   return G_TYPE_INVALID;
@@ -994,11 +1234,9 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
 
     if (role == StaticTextRole)
         interfaceMask |= 1 << WAI_TEXT;
-
-    if (coreObject->isAccessibilityRenderObject() && coreObject->isTextControl()) {
-        if (coreObject->isReadOnly())
-            interfaceMask |= 1 << WAI_TEXT;
-        else
+    else if (coreObject->isAccessibilityRenderObject() && coreObject->isTextControl()) {
+        interfaceMask |= 1 << WAI_TEXT;
+        if (!coreObject->isReadOnly())
             interfaceMask |= 1 << WAI_EDITABLE_TEXT;
     }
 
@@ -1006,6 +1244,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (coreObject->isImage())
         interfaceMask |= 1 << WAI_IMAGE;
 
+    // Table
+    if (role == TableRole)
+        interfaceMask |= 1 << WAI_TABLE;
+
     return interfaceMask;
 }
 
diff --git a/WebCore/accessibility/mac/AccessibilityObjectMac.mm b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
index 80bb5bb..217af54 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectMac.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectMac.mm
@@ -40,6 +40,11 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     
     return [attachment accessibilityIsIgnored];
 }
+
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    return DefaultBehavior;
+}
     
 } // WebCore
 
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index e56e77c..58e5018 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -1102,21 +1102,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if (m_object->isAttachment())
         return [[self attachmentView] accessibilityAttributeValue:NSAccessibilityRoleDescriptionAttribute];
     
-    // FIXME 3447564: It would be better to call some AppKit API to get these strings
-    // (which would be the best way to localize them)
-    
     NSString* axRole = [self role];
-    if ([axRole isEqualToString:NSAccessibilityButtonRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityButtonRole, [self subrole]);
-    
-    if ([axRole isEqualToString:NSAccessibilityPopUpButtonRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityPopUpButtonRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityStaticTextRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityStaticTextRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityImageRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityImageRole, [self subrole]);
     
     if ([axRole isEqualToString:NSAccessibilityGroupRole]) {
         switch (m_object->roleValue()) {
@@ -1157,42 +1143,6 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }
     }        
     
-    if ([axRole isEqualToString:NSAccessibilityCheckBoxRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityCheckBoxRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityRadioButtonRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityRadioButtonRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityRadioGroupRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityRadioGroupRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityTextFieldRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityTextFieldRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityTextAreaRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityTextAreaRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityListRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityListRole, [self subrole]);
-    
-    if ([axRole isEqualToString:NSAccessibilityTableRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityTableRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityRowRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityRowRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityColumnRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityColumnRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityCellRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityCellRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilitySliderRole])
-        return NSAccessibilityRoleDescription(NSAccessibilitySliderRole, [self subrole]);
-
-    if ([axRole isEqualToString:NSAccessibilityValueIndicatorRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityValueIndicatorRole, [self subrole]);
-
     if ([axRole isEqualToString:@"AXWebArea"])
         return AXWebAreaText();
     
@@ -1207,20 +1157,13 @@ static NSString* roleValueToNSString(AccessibilityRole value)
 
     if ([axRole isEqualToString:@"AXHeading"])
         return AXHeadingText();
-        
-    if ([axRole isEqualToString:(NSString*)kAXMenuBarItemRole] ||
-        [axRole isEqualToString:NSAccessibilityMenuRole])
-        return nil;
 
-    if ([axRole isEqualToString:NSAccessibilityMenuButtonRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityMenuButtonRole, [self subrole]);
-    
-    if ([axRole isEqualToString:NSAccessibilityToolbarRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityToolbarRole, [self subrole]);
+    // We should try the system default role description for all other roles.
+    // If we get the same string back, then as a last resort, return unknown.
+    NSString* defaultRoleDescription = NSAccessibilityRoleDescription(axRole, [self subrole]);
+    if (![defaultRoleDescription isEqualToString:axRole])
+        return defaultRoleDescription;
 
-    if ([axRole isEqualToString:NSAccessibilitySplitterRole])
-        return NSAccessibilityRoleDescription(NSAccessibilitySplitterRole, [self subrole]);
-    
     return NSAccessibilityRoleDescription(NSAccessibilityUnknownRole, nil);
 }
 
diff --git a/WebCore/accessibility/qt/AccessibilityObjectQt.cpp b/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 1710027..07f13d4 100644
--- a/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
+++ b/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
@@ -29,6 +29,11 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    return DefaultBehavior;
+}
+
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/accessibility/win/AccessibilityObjectWin.cpp b/WebCore/accessibility/win/AccessibilityObjectWin.cpp
index 0a386c7..895fc43 100644
--- a/WebCore/accessibility/win/AccessibilityObjectWin.cpp
+++ b/WebCore/accessibility/win/AccessibilityObjectWin.cpp
@@ -35,6 +35,11 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    return DefaultBehavior;
+}
+
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/accessibility/wx/AccessibilityObjectWx.cpp b/WebCore/accessibility/wx/AccessibilityObjectWx.cpp
index 1710027..07f13d4 100644
--- a/WebCore/accessibility/wx/AccessibilityObjectWx.cpp
+++ b/WebCore/accessibility/wx/AccessibilityObjectWx.cpp
@@ -29,6 +29,11 @@ bool AccessibilityObject::accessibilityIgnoreAttachment() const
     return false;
 }
 
+AccessibilityObjectPlatformInclusion AccessibilityObject::accessibilityPlatformIncludesObject() const
+{
+    return DefaultBehavior;
+}
+
 } // namespace WebCore
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/bindings/ScriptControllerBase.cpp b/WebCore/bindings/ScriptControllerBase.cpp
new file mode 100644
index 0000000..c232e84
--- /dev/null
+++ b/WebCore/bindings/ScriptControllerBase.cpp
@@ -0,0 +1,85 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
+#include "Settings.h"
+#include "XSSAuditor.h"
+
+namespace WebCore {
+
+ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture)
+{
+    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()));
+}
+
+ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode)
+{
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluate(sourceCode);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
+
+bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
+{
+    if (!protocolIsJavaScript(url))
+        return false;
+
+    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
+        return true;
+
+    const int javascriptSchemeLength = sizeof("javascript:") - 1;
+
+    String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
+    ScriptValue result;
+    if (xssAuditor()->canEvaluateJavaScriptURL(script))
+        result = executeScript(script, userGesture);
+
+    String scriptResult;
+    if (!result.getString(scriptResult))
+        return true;
+
+    // FIXME: We should always replace the document, but doing so
+    //        synchronously can cause crashes:
+    //        http://bugs.webkit.org/show_bug.cgi?id=16782
+    if (replaceDocument) 
+        m_frame->loader()->replaceDocument(scriptResult);
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 9411ad8..6eca7bd 100644
--- a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -46,29 +46,21 @@ namespace WebCore {
 
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
index d08f760..38292c7 100644
--- a/WebCore/bindings/js/JSCallbackData.cpp
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -48,7 +48,12 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
 
     ExecState* exec = globalObject()->globalExec();
     
-    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function;
+    {
+        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
+        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
+        function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    }
     CallData callData;
     CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -59,7 +64,7 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     }
     
     globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = call(exec, function, callType, callData, callback(), args);
+    JSValue result = callInWorld(exec, function, callType, callData, callback(), args, m_isolatedWorld.get());
     globalObject()->globalData()->timeoutChecker.stop();
 
     Document::updateStyleForAllDocuments();
diff --git a/WebCore/bindings/js/JSCallbackData.h b/WebCore/bindings/js/JSCallbackData.h
index 4fc9f84..5c86701 100644
--- a/WebCore/bindings/js/JSCallbackData.h
+++ b/WebCore/bindings/js/JSCallbackData.h
@@ -29,6 +29,7 @@
 #ifndef JSCallbackData_h
 #define JSCallbackData_h
 
+#include "JSDOMBinding.h"
 #include "JSDOMGlobalObject.h"
 #include <runtime/JSObject.h>
 #include <runtime/Protect.h>
@@ -47,6 +48,7 @@ public:
     JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
         : m_callback(callback)
         , m_globalObject(globalObject)
+        , m_isolatedWorld(currentWorld(globalObject->globalExec()))
     {
     }
     
@@ -63,6 +65,7 @@ public:
 private:
     JSC::ProtectedPtr<JSC::JSObject> m_callback;
     JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    RefPtr<DOMWrapperWorld> m_isolatedWorld;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
index 4aa1547..14548d7 100644
--- a/WebCore/bindings/js/JSCanvasArrayCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -29,6 +29,13 @@
 
 #include "config.h"
 #include "JSCanvasArray.h"
+#include "JSCanvasByteArray.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include "JSCanvasShortArray.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include "JSCanvasFloatArray.h"
 
 #include "CanvasArray.h"
 
@@ -38,17 +45,21 @@ namespace WebCore {
 
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
 {
-    if (!object)
-        return jsUndefined();
-        
-    
-
-#if ENABLE(3D_CANVAS)
-    if (object->is3d())
-        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
-#endif
-    ASSERT(object->is2d());
-    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+    if (object->isFloatArray())
+        return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, static_cast<CanvasFloatArray*>(object));
+    if (object->isUnsignedByteArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, static_cast<CanvasUnsignedByteArray*>(object));
+    if (object->isByteArray())
+        return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, static_cast<CanvasByteArray*>(object));
+    if (object->isIntArray())
+        return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, static_cast<CanvasIntArray*>(object));
+    if (object->isUnsignedIntArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, static_cast<CanvasUnsignedIntArray*>(object));
+    if (object->isShortArray())
+        return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, static_cast<CanvasShortArray*>(object));
+    if (object->isUnsignedShortArray())
+        return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, static_cast<CanvasUnsignedShortArray*>(object));
+    return jsUndefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index da4a53a..c2884d7 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -90,7 +90,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     args.append(jsString(exec, prefix));
 
     m_globalObject->globalData()->timeoutChecker.start();
-    JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
+    JSValue retval = callInWorld(exec, function, callType, callData, m_customResolver, args, currentWorld(m_globalObject->globalExec()));
     m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
diff --git a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 49ef5e3..91ee51a 100644
--- a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -87,29 +87,21 @@ JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 515c088..ef69c7b 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -21,10 +21,13 @@
 #include "config.h"
 #include "JSDOMBinding.h"
 
+#include "debugger/DebuggerCallFrame.h"
+
 #include "ActiveDOMObject.h"
 #include "DOMCoreException.h"
 #include "Document.h"
 #include "EventException.h"
+#include "ExceptionBase.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
@@ -35,6 +38,7 @@
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
 #include "JSEventException.h"
+#include "JSExceptionBase.h"
 #include "JSNode.h"
 #include "JSRangeException.h"
 #include "JSXMLHttpRequestException.h"
@@ -42,6 +46,7 @@
 #include "MessagePort.h"
 #include "RangeException.h"
 #include "ScriptController.h"
+#include "Settings.h"
 #include "XMLHttpRequestException.h"
 #include <runtime/Error.h>
 #include <runtime/JSFunction.h>
@@ -70,6 +75,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 typedef Document::JSWrapperCache JSWrapperCache;
+typedef Document::JSWrapperCacheMap JSWrapperCacheMap;
 
 // For debugging, keep a set of wrappers currently registered, and check that
 // all are unregistered before they are destroyed. This has helped us fix at
@@ -78,6 +84,7 @@ typedef Document::JSWrapperCache JSWrapperCache;
 static void addWrapper(DOMObject* wrapper);
 static void removeWrapper(DOMObject* wrapper);
 static void removeWrappers(const JSWrapperCache& wrappers);
+static void removeWrappers(const DOMObjectWrapperMap& wrappers);
 
 #ifdef NDEBUG
 
@@ -93,6 +100,10 @@ static inline void removeWrappers(const JSWrapperCache&)
 {
 }
 
+static inline void removeWrappers(const DOMObjectWrapperMap&)
+{
+}
+
 #else
 
 static HashSet<DOMObject*>& wrapperSet()
@@ -122,7 +133,15 @@ static void removeWrapper(DOMObject* wrapper)
 
 static void removeWrappers(const JSWrapperCache& wrappers)
 {
-    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappers.end(); ++it)
+    JSWrapperCache::const_iterator wrappersEnd = wrappers.end();
+    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
+        removeWrapper(it->second);
+}
+
+static inline void removeWrappers(const DOMObjectWrapperMap& wrappers)
+{
+    DOMObjectWrapperMap::const_iterator wrappersEnd = wrappers.end();
+    for (DOMObjectWrapperMap::const_iterator it = wrappers.begin(); it != wrappersEnd; ++it)
         removeWrapper(it->second);
 }
 
@@ -133,67 +152,120 @@ DOMObject::~DOMObject()
 
 #endif
 
-class DOMObjectWrapperMap {
-public:
-    static DOMObjectWrapperMap& mapFor(JSGlobalData&);
+DOMWrapperWorld::DOMWrapperWorld(JSC::JSGlobalData* globalData)
+    : m_globalData(globalData)
+{
+}
+
+DOMWrapperWorld::~DOMWrapperWorld()
+{
+    JSGlobalData::ClientData* clientData = m_globalData->clientData;
+    ASSERT(clientData);
+    static_cast<WebCoreJSClientData*>(clientData)->forgetWorld(this);
+
+    removeWrappers(m_wrappers);
 
-    DOMObject* get(void* objectHandle)
+    for (HashSet<Document*>::iterator iter = documentsWithWrappers.begin(); iter != documentsWithWrappers.end(); ++iter)
+        forgetWorldOfDOMNodesForDocument(*iter, this);
+    for (HashSet<ScriptController*>::iterator iter = scriptControllersWithShells.begin(); iter != scriptControllersWithShells.end(); ++iter)
+        (*iter)->forgetWorld(this);
+}
+
+EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::JSGlobalData& globalData, DOMWrapperWorld* isolatedWorld)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
+    m_clientData->m_worldStack.append(isolatedWorld);
+}
+
+EnterDOMWrapperWorld::EnterDOMWrapperWorld(JSC::ExecState* exec, DOMWrapperWorld* isolatedWorld)
+{
+    JSGlobalData::ClientData* clientData = exec->globalData().clientData;
+    ASSERT(clientData);
+    m_clientData = static_cast<WebCoreJSClientData*>(clientData);
+    m_clientData->m_worldStack.append(isolatedWorld);
+}
+
+EnterDOMWrapperWorld::~EnterDOMWrapperWorld()
+{
+    m_clientData->m_worldStack.removeLast();
+}
+
+class JSGlobalDataWorldIterator {
+public:
+    JSGlobalDataWorldIterator(JSGlobalData* globalData)
+        : m_pos(static_cast<WebCoreJSClientData*>(globalData->clientData)->m_worldSet.begin())
+        , m_end(static_cast<WebCoreJSClientData*>(globalData->clientData)->m_worldSet.end())
     {
-        return m_map.get(objectHandle);
     }
 
-    void set(void* objectHandle, DOMObject* wrapper)
+    operator bool()
     {
-        addWrapper(wrapper);
-        m_map.set(objectHandle, wrapper);
+        return m_pos != m_end;
     }
 
-    void remove(void* objectHandle)
+    DOMWrapperWorld* operator*()
     {
-        removeWrapper(m_map.take(objectHandle));
+        ASSERT(m_pos != m_end);
+        return *m_pos;
     }
 
-private:
-    HashMap<void*, DOMObject*> m_map;
-};
-
-// Map from static HashTable instances to per-GlobalData ones.
-class DOMObjectHashTableMap {
-public:
-    static DOMObjectHashTableMap& mapFor(JSGlobalData&);
-
-    ~DOMObjectHashTableMap()
+    DOMWrapperWorld* operator->()
     {
-        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
-        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
-            iter->second.deleteTable();
+        ASSERT(m_pos != m_end);
+        return *m_pos;
     }
 
-    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    JSGlobalDataWorldIterator& operator++()
     {
-        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
-        if (iter != m_map.end())
-            return &iter->second;
-        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+        ++m_pos;
+        return *this;
     }
 
 private:
-    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+    HashSet<DOMWrapperWorld*>::iterator m_pos;
+    HashSet<DOMWrapperWorld*>::iterator m_end;
 };
 
-class WebCoreJSClientData : public JSGlobalData::ClientData {
-public:
-    DOMObjectHashTableMap hashTableMap;
-    DOMObjectWrapperMap wrapperMap;
-};
+static inline DOMWrapperWorld* currentWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+}
+
+DOMWrapperWorld* currentWorld(JSC::ExecState* exec)
+{
+    return currentWorld(exec->globalData());
+}
+
+DOMWrapperWorld* normalWorld(JSC::JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->normalWorld();
+}
+
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    ASSERT(isMainThread());
+    return normalWorld(*JSDOMWindow::commonJSGlobalData());
+}
+
+DOMWrapperWorld* mainThreadCurrentWorld()
+{
+    ASSERT(isMainThread());
+
+    JSGlobalData::ClientData* clientData = JSDOMWindowBase::commonJSGlobalData()->clientData;
+    ASSERT(clientData);
+    return static_cast<WebCoreJSClientData*>(clientData)->currentWorld();
+}
 
 DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
 {
     JSGlobalData::ClientData* clientData = globalData.clientData;
-    if (!clientData) {
-        clientData = new WebCoreJSClientData;
-        globalData.clientData = clientData;
-    }
+    ASSERT(clientData);
     return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
 }
 
@@ -202,64 +274,102 @@ const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const
     return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
 }
 
-inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
+//inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
+inline DOMObjectWrapperMap& DOMObjectWrapperMapFor(JSGlobalData& globalData)
 {
-    JSGlobalData::ClientData* clientData = globalData.clientData;
-    if (!clientData) {
-        clientData = new WebCoreJSClientData;
-        globalData.clientData = clientData;
-    }
-    return static_cast<WebCoreJSClientData*>(clientData)->wrapperMap;
+    return currentWorld(globalData)->m_wrappers;
 }
 
 DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
 {
-    return DOMObjectWrapperMap::mapFor(globalData).get(objectHandle);
+    return DOMObjectWrapperMapFor(globalData).get(objectHandle);
 }
 
 void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
 {
-    DOMObjectWrapperMap::mapFor(globalData).set(objectHandle, wrapper);
+    addWrapper(wrapper);
+    DOMObjectWrapperMapFor(globalData).set(objectHandle, wrapper);
 }
 
-void forgetDOMObject(JSGlobalData& globalData, void* objectHandle)
+JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
 {
-    DOMObjectWrapperMap::mapFor(globalData).remove(objectHandle);
+    if (document)
+        return document->getWrapperCache(mainThreadCurrentWorld())->get(node);
+    return static_cast<JSNode*>(DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
 }
 
-JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
+void forgetDOMObject(DOMObject* wrapper, void* objectHandle)
 {
-    if (!document)
-        return static_cast<JSNode*>(DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
-    return document->wrapperCache().get(node);
+    JSC::JSGlobalData* globalData = Heap::heap(wrapper)->globalData();
+    for (JSGlobalDataWorldIterator worldIter(globalData); worldIter; ++worldIter) {
+        DOMObjectWrapperMap& wrappers = worldIter->m_wrappers;
+        DOMObjectWrapperMap::iterator iter = wrappers.find(objectHandle);
+        if ((iter != wrappers.end()) && (iter->second == wrapper)) {
+            removeWrapper(wrapper);
+            wrappers.remove(iter);
+            return;
+        }
+    }
+
+    // If the world went away, it should have removed this wrapper from the set.
+    ASSERT(!wrapperSet().contains(wrapper));
 }
 
-void forgetDOMNode(Document* document, Node* node)
+void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document)
 {
     if (!document) {
-        DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).remove(node);
+        forgetDOMObject(wrapper, node);
         return;
     }
-    removeWrapper(document->wrapperCache().take(node));
+
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
+        JSWrapperCache* wrappers = wrappersIter->second;
+        JSWrapperCache::iterator iter = wrappers->find(node);
+        if ((iter != wrappers->end()) && (iter->second == wrapper)) {
+            wrappers->remove(iter);
+            removeWrapper(wrapper);
+            return;
+        }
+    }
+
+    // If the world went away, it should have removed this wrapper from the set.
+    ASSERT(!wrapperSet().contains(wrapper));
 }
 
 void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
 {
     if (!document) {
-        DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
+        addWrapper(wrapper);
+        DOMObjectWrapperMapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
         return;
     }
     addWrapper(wrapper);
-    document->wrapperCache().set(node, wrapper);
+    document->getWrapperCache(mainThreadCurrentWorld())->set(node, wrapper);
 }
 
 void forgetAllDOMNodesForDocument(Document* document)
 {
     ASSERT(document);
-    removeWrappers(document->wrapperCache());
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    JSWrapperCacheMap::const_iterator wrappersMapEnd = wrapperCacheMap.end();
+    for (JSWrapperCacheMap::const_iterator wrappersMapIter = wrapperCacheMap.begin(); wrappersMapIter != wrappersMapEnd; ++wrappersMapIter) {
+        JSWrapperCache* wrappers = wrappersMapIter->second;
+        removeWrappers(*wrappers);
+        delete wrappers;
+        wrappersMapIter->first->forgetDocument(document);
+    }
+}
+
+void forgetWorldOfDOMNodesForDocument(Document* document, DOMWrapperWorld* world)
+{
+    JSWrapperCache* wrappers = document->wrapperCacheMap().take(world);
+    ASSERT(wrappers); // 'world' should only know about 'document' if 'document' knows about 'world'!
+    removeWrappers(*wrappers);
+    delete wrappers;
 }
 
-static inline bool isObservableThroughDOM(JSNode* jsNode)
+static inline bool isObservableThroughDOM(JSNode* jsNode, DOMWrapperWorld* world)
 {
     // Certain conditions implicitly make a JS DOM node wrapper observable
     // through the DOM, even if no explicit reference to it remains.
@@ -285,14 +395,14 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
         // the custom markChildren functions rather than here.
         if (node->isElementNode()) {
             if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
-                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                if (DOMObject* wrapper = world->m_wrappers.get(attributes)) {
                     if (wrapper->hasCustomProperties())
                         return true;
                 }
             }
             if (node->isStyledElement()) {
                 if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
-                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                    if (DOMObject* wrapper = world->m_wrappers.get(style)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -300,7 +410,7 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
             }
             if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
                 if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
-                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                    if (DOMObject* wrapper = world->m_wrappers.get(context)) {
                         if (wrapper->hasCustomProperties())
                             return true;
                     }
@@ -331,14 +441,19 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     return false;
 }
 
-void markDOMNodesForDocument(MarkStack& markStack, Document* doc)
+void markDOMNodesForDocument(MarkStack& markStack, Document* document)
 {
-    JSWrapperCache& nodeDict = doc->wrapperCache();
-    JSWrapperCache::iterator nodeEnd = nodeDict.end();
-    for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
-        JSNode* jsNode = nodeIt->second;
-        if (isObservableThroughDOM(jsNode))
-            markStack.append(jsNode);
+    JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+    for (JSWrapperCacheMap::iterator wrappersIter = wrapperCacheMap.begin(); wrappersIter != wrapperCacheMap.end(); ++wrappersIter) {
+        DOMWrapperWorld* world = wrappersIter->first;
+        JSWrapperCache* nodeDict = wrappersIter->second;
+
+        JSWrapperCache::iterator nodeEnd = nodeDict->end();
+        for (JSWrapperCache::iterator nodeIt = nodeDict->begin(); nodeIt != nodeEnd; ++nodeIt) {
+            JSNode* jsNode = nodeIt->second;
+            if (isObservableThroughDOM(jsNode, world))
+                markStack.append(jsNode);
+        }
     }
 }
 
@@ -351,12 +466,10 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     HashMap<ActiveDOMObject*, void*>::const_iterator activeObjectsEnd = activeObjects.end();
     for (HashMap<ActiveDOMObject*, void*>::const_iterator iter = activeObjects.begin(); iter != activeObjectsEnd; ++iter) {
         if (iter->first->hasPendingActivity()) {
-            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, iter->second);
             // Generally, an active object with pending activity must have a wrapper to mark its listeners.
             // However, some ActiveDOMObjects don't have JS wrappers (timers created by setTimeout is one example).
             // FIXME: perhaps need to make sure even timers have a markable 'wrapper'.
-            if (wrapper)
-                markStack.append(wrapper);
+            markDOMObjectWrapper(markStack, globalData, iter->second);
         }
     }
 
@@ -364,10 +477,31 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
     HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end();
     for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) {
         // If the message port is remotely entangled, then always mark it as in-use because we can't determine reachability across threads.
-        if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity()) {
-            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
-            if (wrapper)
-                markStack.append(wrapper);
+        if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity())
+            markDOMObjectWrapper(markStack, globalData, *iter);
+    }
+}
+
+typedef std::pair<JSNode*, DOMWrapperWorld*> WrapperAndWorld;
+typedef WTF::Vector<WrapperAndWorld, 8> WrapperSet;
+
+static inline void takeWrappers(Node* node, Document* document, WrapperSet& wrapperSet)
+{
+    if (document) {
+        JSWrapperCacheMap& wrapperCacheMap = document->wrapperCacheMap();
+        for (JSWrapperCacheMap::iterator iter = wrapperCacheMap.begin(); iter != wrapperCacheMap.end(); ++iter) {
+            if (JSNode* wrapper = iter->second->take(node)) {
+                removeWrapper(wrapper);
+                wrapperSet.append(WrapperAndWorld(wrapper, iter->first));
+            }
+        }
+    } else {
+        for (JSGlobalDataWorldIterator worldIter(JSDOMWindow::commonJSGlobalData()); worldIter; ++worldIter) {
+            DOMWrapperWorld* world = *worldIter;
+            if (JSNode* wrapper = static_cast<JSNode*>(world->m_wrappers.take(node))) {
+                removeWrapper(wrapper);
+                wrapperSet.append(WrapperAndWorld(wrapper, world));
+            }
         }
     }
 }
@@ -375,13 +509,18 @@ void markActiveObjectsForContext(MarkStack& markStack, JSGlobalData& globalData,
 void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocument)
 {
     ASSERT(oldDocument != newDocument);
-    JSNode* wrapper = getCachedDOMNodeWrapper(oldDocument, node);
-    if (!wrapper)
-        return;
-    removeWrapper(wrapper);
-    cacheDOMNodeWrapper(newDocument, node, wrapper);
-    forgetDOMNode(oldDocument, node);
-    addWrapper(wrapper);
+
+    WrapperSet wrapperSet;
+    takeWrappers(node, oldDocument, wrapperSet);
+
+    for (unsigned i = 0; i < wrapperSet.size(); ++i) {
+        JSNode* wrapper = wrapperSet[i].first;
+        if (newDocument)
+            newDocument->getWrapperCache(wrapperSet[i].second)->set(node, wrapper);
+        else
+            wrapperSet[i].second->m_wrappers.set(node, wrapper);
+        addWrapper(wrapper);
+    }
 }
 
 void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
@@ -391,10 +530,11 @@ void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void*
     // but doing this correctly would be challenging.
     if (!object)
         return;
-    DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
-    if (!wrapper)
-        return;
-    markStack.append(wrapper);
+
+    for (JSGlobalDataWorldIterator worldIter(&globalData); worldIter; ++worldIter) {
+        if (DOMObject* wrapper = worldIter->m_wrappers.get(object))
+            markStack.append(wrapper);
+    }
 }
 
 JSValue jsStringOrNull(ExecState* exec, const String& s)
@@ -468,6 +608,9 @@ void reportException(ExecState* exec, JSValue exception)
     UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL")).toString(exec);
     exec->clearException();
 
+    if (ExceptionBase* exceptionBase = toExceptionBase(exception))
+        errorMessage = exceptionBase->message() + ": "  + exceptionBase->description();
+
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
     ASSERT(scriptExecutionContext);
 
@@ -538,7 +681,7 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame)
 {
     if (!frame)
         return false;
-    JSDOMWindow* window = toJSDOMWindow(frame);
+    JSDOMWindow* window = toJSDOMWindow(frame, currentWorld(exec));
     return window && window->allowsAccessFrom(exec);
 }
 
@@ -546,7 +689,7 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame, String& message)
 {
     if (!frame)
         return false;
-    JSDOMWindow* window = toJSDOMWindow(frame);
+    JSDOMWindow* window = toJSDOMWindow(frame, currentWorld(exec));
     return window && window->allowsAccessFrom(exec, message);
 }
 
@@ -560,8 +703,16 @@ void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
         return;
-    if (JSDOMWindow* window = toJSDOMWindow(frame))
-        window->printErrorMessage(message);
+    if (message.isEmpty())
+        return;
+
+    Settings* settings = frame->settings();
+    if (!settings)
+        return;
+    if (settings->privateBrowsingEnabled())
+        return;
+
+    frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
 }
 
 Frame* toLexicalFrame(ExecState* exec)
@@ -659,4 +810,28 @@ bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDe
     return false;
 }
 
+JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const UString& script, JSValue& exception)
+{
+    EnterDOMWrapperWorld worldEntry(debuggerCallFrame.dynamicGlobalObject()->globalExec(), debuggerWorld());
+    return debuggerCallFrame.evaluate(script, exception);
+}
+
+JSValue callInWorld(ExecState* exec, JSValue function, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+{
+    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
+    return JSC::call(exec, function, callType, callData, thisValue, args);
+}
+
+JSObject* constructInWorld(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args, DOMWrapperWorld* isolatedWorld)
+{
+    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
+    return JSC::construct(exec, object, constructType, constructData, args);
+}
+
+Completion evaluateInWorld(ExecState* exec, ScopeChain& scopeChain, const SourceCode& sourceCode, JSValue thisValue, DOMWrapperWorld* isolatedWorld)
+{
+    EnterDOMWrapperWorld worldEntry(exec, isolatedWorld);
+    return JSC::evaluate(exec, scopeChain, sourceCode, thisValue);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index 9c0ad7e..ba41d85 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -30,16 +30,18 @@
 
 namespace JSC {
     class JSGlobalData;
+    class DebuggerCallFrame;
 }
 
 namespace WebCore {
 
     class Document;
     class Frame;
+    class JSNode;
     class KURL;
     class Node;
     class String;
-    class JSNode;
+    class ScriptController;
 
     typedef int ExceptionCode;
 
@@ -76,10 +78,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::OverridesMarkChildren | DOMObject::StructureFlags;
+
         DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
             , m_globalObject(globalObject)
@@ -106,10 +110,11 @@ namespace WebCore {
     public:
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot | JSC::ImplementsHasInstance));
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::ImplementsHasInstance | JSC::OverridesMarkChildren | DOMObjectWithGlobalPointer::StructureFlags;
         DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObjectWithGlobalPointer(structure, globalObject)
         {
@@ -133,14 +138,104 @@ namespace WebCore {
         }
     };
 
+    typedef HashMap<void*, DOMObject*> DOMObjectWrapperMap;
+
+    class DOMWrapperWorld : public RefCounted<DOMWrapperWorld> {
+    public:
+        DOMWrapperWorld(JSC::JSGlobalData*);
+        ~DOMWrapperWorld();
+
+        void rememberDocument(Document* document) { documentsWithWrappers.add(document); }
+        void forgetDocument(Document* document) { documentsWithWrappers.remove(document); }
+        void rememberScriptController(ScriptController* scriptController) { scriptControllersWithShells.add(scriptController); }
+        void forgetScriptController(ScriptController* scriptController) { scriptControllersWithShells.remove(scriptController); }
+
+        // FIXME: can we make this private?
+        DOMObjectWrapperMap m_wrappers;
+
+    private:
+        JSC::JSGlobalData* m_globalData;
+        HashSet<Document*> documentsWithWrappers;
+        HashSet<ScriptController*> scriptControllersWithShells;
+    };
+
+    // Map from static HashTable instances to per-GlobalData ones.
+    class DOMObjectHashTableMap {
+    public:
+        static DOMObjectHashTableMap& mapFor(JSC::JSGlobalData&);
+
+        ~DOMObjectHashTableMap()
+        {
+            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+            for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+                iter->second.deleteTable();
+        }
+
+        const JSC::HashTable* get(const JSC::HashTable* staticTable)
+        {
+            HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+            if (iter != m_map.end())
+                return &iter->second;
+            return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+        }
+
+    private:
+        HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+    };
+
+    class WebCoreJSClientData : public JSC::JSGlobalData::ClientData {
+        friend class EnterDOMWrapperWorld;
+        friend class JSGlobalDataWorldIterator;
+
+    public:
+        WebCoreJSClientData(JSC::JSGlobalData* globalData)
+            : m_normalWorld(globalData)
+        {
+            m_worldStack.append(&m_normalWorld);
+            m_worldSet.add(&m_normalWorld);
+        }
+        // FIXME: add a destructor to assert m_worldSet only contains m_normalWorld?
+
+        DOMWrapperWorld* currentWorld() { return m_worldStack.last(); }
+        DOMWrapperWorld* normalWorld() { return &m_normalWorld; }
+
+        void rememberWorld(DOMWrapperWorld* world)
+        {
+            ASSERT(!m_worldSet.contains(world));
+            m_worldSet.add(world);
+        }
+        void forgetWorld(DOMWrapperWorld* world)
+        {
+            ASSERT(m_worldSet.contains(world));
+            m_worldSet.remove(world);
+        }
+
+        DOMObjectHashTableMap hashTableMap;
+    private:
+        Vector<DOMWrapperWorld*> m_worldStack;
+        HashSet<DOMWrapperWorld*> m_worldSet;
+        DOMWrapperWorld m_normalWorld;
+    };
+
+    class EnterDOMWrapperWorld {
+    public:
+        EnterDOMWrapperWorld(JSC::JSGlobalData&, DOMWrapperWorld*);
+        EnterDOMWrapperWorld(JSC::ExecState*, DOMWrapperWorld*);
+        ~EnterDOMWrapperWorld();
+
+    private:
+        WebCoreJSClientData* m_clientData;
+    };
+
     DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
     void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
-    void forgetDOMObject(JSC::JSGlobalData&, void* objectHandle);
+    void forgetDOMNode(DOMObject* wrapper, Node* node, Document* document);
+    void forgetDOMObject(DOMObject* wrapper, void* objectHandle);
 
     JSNode* getCachedDOMNodeWrapper(Document*, Node*);
     void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
-    void forgetDOMNode(Document*, Node*);
     void forgetAllDOMNodesForDocument(Document*);
+    void forgetWorldOfDOMNodesForDocument(Document*, DOMWrapperWorld*);
     void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
     void markDOMNodesForDocument(JSC::MarkStack&, Document*);
     void markActiveObjectsForContext(JSC::MarkStack&, JSC::JSGlobalData&, ScriptExecutionContext*);
@@ -151,6 +246,13 @@ namespace WebCore {
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
+    DOMWrapperWorld* currentWorld(JSC::ExecState*);
+    DOMWrapperWorld* normalWorld(JSC::JSGlobalData&);
+    DOMWrapperWorld* mainThreadCurrentWorld();
+    DOMWrapperWorld* mainThreadNormalWorld();
+    inline DOMWrapperWorld* debuggerWorld() { return mainThreadNormalWorld(); }
+    inline DOMWrapperWorld* pluginWorld() { return mainThreadNormalWorld(); }
+
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
@@ -302,6 +404,11 @@ namespace WebCore {
     bool processingUserGesture(JSC::ExecState*);
     KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
+    JSC::JSValue DebuggerCallFrame_evaluateInWorld(const JSC::DebuggerCallFrame& debuggerCallFrame, const JSC::UString& script, JSC::JSValue& exception);
+    JSC::JSValue callInWorld(JSC::ExecState*, JSC::JSValue function, JSC::CallType, const JSC::CallData&, JSC::JSValue thisValue, const JSC::ArgList&, DOMWrapperWorld*);
+    JSC::JSObject* constructInWorld(JSC::ExecState* exec, JSC::JSValue object, JSC::ConstructType constructType, const JSC::ConstructData& constructData, const JSC::ArgList& args, DOMWrapperWorld*);
+    JSC::Completion evaluateInWorld(JSC::ExecState*, JSC::ScopeChain&, const JSC::SourceCode&, JSC::JSValue thisValue, DOMWrapperWorld*);
+
 } // namespace WebCore
 
 #endif // JSDOMBinding_h
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.cpp b/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 372684c..011a4e4 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -51,7 +51,7 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 
     JSDOMStructureMap::iterator end = structures().end();
     for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
-        it->second->markAggregate(markStack);
+        markStack.append(it->second->storedPrototype());
 
     JSDOMConstructorMap::iterator end2 = constructors().end();
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
@@ -63,7 +63,7 @@ PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JS
     if (!val.isObject())
         return 0;
 
-    return JSEventListener::create(asObject(val), true).get();
+    return JSEventListener::create(asObject(val), true, currentWorld(globalExec())).get();
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -81,15 +81,34 @@ void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData
     delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
 }
 
-JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
+JSDOMGlobalObject* toJSDOMGlobalObject(Document* document, JSC::ExecState* exec)
 {
-    return toJSDOMWindow(document->frame());
+    return toJSDOMWindow(document->frame(), currentWorld(exec));
 }
 
-JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext)
+JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext, JSC::ExecState* exec)
 {
     if (scriptExecutionContext->isDocument())
-        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext));
+        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext), exec);
+
+#if ENABLE(WORKERS)
+    if (scriptExecutionContext->isWorkerContext())
+        return static_cast<WorkerContext*>(scriptExecutionContext)->script()->workerContextWrapper();
+#endif
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+JSDOMGlobalObject* toJSDOMGlobalObject(Document* document, DOMWrapperWorld* world)
+{
+    return toJSDOMWindow(document->frame(), world);
+}
+
+JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext, DOMWrapperWorld* world)
+{
+    if (scriptExecutionContext->isDocument())
+        return toJSDOMGlobalObject(static_cast<Document*>(scriptExecutionContext), world);
 
 #if ENABLE(WORKERS)
     if (scriptExecutionContext->isWorkerContext())
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index ce26857..6b75a6f 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -33,6 +33,7 @@ namespace WebCore {
 
     class Document;
     class Event;
+    class DOMWrapperWorld;
     class JSLazyEventListener;
     class JSEventListener;
     class ScriptExecutionContext;
@@ -102,8 +103,11 @@ namespace WebCore {
         return constructor;
     }
 
-    JSDOMGlobalObject* toJSDOMGlobalObject(Document*);
-    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*);
+    JSDOMGlobalObject* toJSDOMGlobalObject(Document*, JSC::ExecState*);
+    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*, JSC::ExecState*);
+
+    JSDOMGlobalObject* toJSDOMGlobalObject(Document*, DOMWrapperWorld*);
+    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*, DOMWrapperWorld*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index a04ef89..86ff149 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -53,10 +53,11 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
 }
 
-void JSDOMWindowBase::updateDocument()
+void JSDOMWindowBase::updateDocument(DOMWrapperWorld* world)
 {
     ASSERT(d()->impl->document());
     ExecState* exec = globalExec();
+    EnterDOMWrapperWorld worldEntry(exec, world);
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
 }
 
@@ -79,21 +80,7 @@ String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* othe
 
 void JSDOMWindowBase::printErrorMessage(const String& message) const
 {
-    if (message.isEmpty())
-        return;
-
-    Frame* frame = impl()->frame();
-    if (!frame)
-        return;
-
-    Settings* settings = frame->settings();
-    if (!settings)
-        return;
-    
-    if (settings->privateBrowsingEnabled())
-        return;
-
-    impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
+    printErrorMessageForFrame(impl()->frame(), message);
 }
 
 ExecState* JSDOMWindowBase::globalExec()
@@ -157,13 +144,16 @@ JSDOMWindowShell* JSDOMWindowBase::shell() const
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
 {
-    static JSGlobalData* globalData;
+    ASSERT(isMainThread());
+
+    static JSGlobalData* globalData = 0;
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
         globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
 #ifndef NDEBUG
         globalData->mainThreadOnly = true;
 #endif
+        globalData->clientData = new WebCoreJSClientData(globalData);
     }
 
     return globalData;
@@ -181,21 +171,21 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
     return toJS(exec, domWindow);
 }
 
-JSValue toJS(ExecState*, DOMWindow* domWindow)
+JSValue toJS(ExecState* exec, DOMWindow* domWindow)
 {
     if (!domWindow)
         return jsNull();
     Frame* frame = domWindow->frame();
     if (!frame)
         return jsNull();
-    return frame->script()->windowShell();
+    return frame->script()->windowShell(currentWorld(exec));
 }
 
-JSDOMWindow* toJSDOMWindow(Frame* frame)
+JSDOMWindow* toJSDOMWindow(Frame* frame, DOMWrapperWorld* world)
 {
     if (!frame)
         return 0;
-    return frame->script()->windowShell()->window();
+    return frame->script()->windowShell(world)->window();
 }
 
 JSDOMWindow* toJSDOMWindow(JSValue value)
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index 52c3c1d..31e2486 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -32,6 +32,7 @@ namespace WebCore {
     class DOMWindow;
     class Event;
     class Frame;
+    class DOMWrapperWorld;
     class JSDOMWindow;
     class JSDOMWindowShell;
     class JSLocation;
@@ -46,7 +47,7 @@ namespace WebCore {
         JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        void updateDocument();
+        void updateDocument(DOMWrapperWorld*);
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
@@ -102,7 +103,7 @@ namespace WebCore {
     JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
 
     // Returns JSDOMWindow or 0
-    JSDOMWindow* toJSDOMWindow(Frame*);
+    JSDOMWindow* toJSDOMWindow(Frame*, DOMWrapperWorld*);
     JSDOMWindow* toJSDOMWindow(JSC::JSValue);
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 47339d4..2804b3c 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -730,8 +730,6 @@ JSValue JSDOMWindow::webSocket(ExecState* exec) const
     Settings* settings = frame->settings();
     if (!settings)
         return jsUndefined();
-    if (!settings->experimentalWebSocketsEnabled())
-        return jsUndefined();
     return getDOMConstructor<JSWebSocketConstructor>(exec, this);
 }
 #endif
@@ -773,7 +771,8 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
     newFrame->loader()->setOpener(openerFrame);
     newFrame->page()->setOpenedByDOM();
 
-    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+    // FIXME: If a window is created from an isolated world, what are the consequences of this? 'dialogArguments' only appears back in the normal world?
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame, normalWorld(exec->globalData()));
 
     if (dialogArgs)
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
@@ -833,7 +832,7 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
         if (!shouldAllowNavigation(exec, frame))
             return jsUndefined();
 
-        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame, currentWorld(exec));
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
             bool userGesture = processingUserGesture(exec);
 
@@ -934,7 +933,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!dialogFrame)
         return jsUndefined();
 
-    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame, currentWorld(exec));
     dialogFrame->page()->chrome()->runModal();
 
     Identifier returnValue(exec, "returnValue");
@@ -977,7 +976,7 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
@@ -986,7 +985,7 @@ JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
@@ -1054,7 +1053,7 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -1068,7 +1067,7 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index 3c3ff4c..9072f91 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -171,18 +171,18 @@ void* JSDOMWindowShell::operator new(size_t size)
 // Conversion methods
 // ----
 
-JSValue toJS(ExecState*, Frame* frame)
+JSValue toJS(ExecState* exec, Frame* frame)
 {
     if (!frame)
         return jsNull();
-    return frame->script()->windowShell();
+    return frame->script()->windowShell(currentWorld(exec));
 }
 
-JSDOMWindowShell* toJSDOMWindowShell(Frame* frame)
+JSDOMWindowShell* toJSDOMWindowShell(Frame* frame, DOMWrapperWorld* isolatedWorld)
 {
     if (!frame)
         return 0;
-    return frame->script()->windowShell();
+    return frame->script()->windowShell(isolatedWorld);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 23af340..36cb8d6 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -60,10 +60,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
     private:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | DOMObject::StructureFlags;
+
         virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
@@ -86,7 +88,7 @@ namespace WebCore {
     };
 
     JSC::JSValue toJS(JSC::ExecState*, Frame*);
-    JSDOMWindowShell* toJSDOMWindowShell(Frame*);
+    JSDOMWindowShell* toJSDOMWindowShell(Frame*, DOMWrapperWorld*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
index 493d7bd..7485c1f 100644
--- a/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
+++ b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -63,29 +63,21 @@ JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList&
 
 JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index c64ddc9..28e38ac 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Clipboard.h"
 #include "Event.h"
+#include "JSBeforeLoadEvent.h"
 #include "JSClipboard.h"
 #include "JSErrorEvent.h"
 #include "JSKeyboardEvent.h"
@@ -46,6 +47,7 @@
 #include "JSWebKitTransitionEvent.h"
 #include "JSWheelEvent.h"
 #include "JSXMLHttpRequestProgressEvent.h"
+#include "BeforeLoadEvent.h"
 #include "ErrorEvent.h"
 #include "KeyboardEvent.h"
 #include "MessageEvent.h"
@@ -129,7 +131,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
         else
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ProgressEvent, event);
-    }
+    } else if (event->isBeforeLoadEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, BeforeLoadEvent, event);
 #if ENABLE(DOM_STORAGE)
     else if (event->isStorageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, StorageEvent, event);
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 4f273fe..1a999a8 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -31,10 +31,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, bool isAttribute)
+JSEventListener::JSEventListener(JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld)
     : EventListener(JSEventListenerType)
     , m_jsFunction(function)
     , m_isAttribute(isAttribute)
+    , m_isolatedWorld(isolatedWorld)
 {
 }
 
@@ -65,7 +66,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
     if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext, m_isolatedWorld.get());
     if (!globalObject)
         return;
 
@@ -86,7 +87,12 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
     ExecState* exec = globalObject->globalExec();
 
-    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction;
+    {
+        // Switch worlds, just in case handleEvent is a getter and causes JS execution!
+        EnterDOMWrapperWorld worldEntry(exec, m_isolatedWorld.get());
+        handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
+    }
     CallData callData;
     CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
@@ -108,8 +114,8 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
 
         globalData->timeoutChecker.start();
         JSValue retval = handleEventFunction
-            ? call(exec, handleEventFunction, callType, callData, jsFunction, args)
-            : call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
+            ? callInWorld(exec, handleEventFunction, callType, callData, jsFunction, args, m_isolatedWorld.get())
+            : callInWorld(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args, m_isolatedWorld.get());
         globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
@@ -140,7 +146,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     if (!jsFunction)
         return false;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context, m_isolatedWorld.get());
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -160,7 +166,7 @@ bool JSEventListener::reportError(ScriptExecutionContext* context, const String&
     JSValue thisValue = globalObject->toThisObject(exec);
 
     globalData->timeoutChecker.start();
-    JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
+    JSValue returnValue = callInWorld(exec, jsFunction, callType, callData, thisValue, args, m_isolatedWorld.get());
     globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
diff --git a/WebCore/bindings/js/JSEventListener.h b/WebCore/bindings/js/JSEventListener.h
index 285a9c4..bf3af48 100644
--- a/WebCore/bindings/js/JSEventListener.h
+++ b/WebCore/bindings/js/JSEventListener.h
@@ -30,9 +30,9 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSEventListener(listener, isAttribute));
+            return adoptRef(new JSEventListener(listener, isAttribute, isolatedWorld));
         }
 
         static const JSEventListener* cast(const EventListener* listener)
@@ -59,10 +59,11 @@ namespace WebCore {
         void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, bool isAttribute);
+        JSEventListener(JSC::JSObject* function, bool isAttribute, DOMWrapperWorld* isolatedWorld);
 
         mutable JSC::JSObject* m_jsFunction;
         bool m_isAttribute;
+        RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventSourceCustom.cpp b/WebCore/bindings/js/JSEventSourceCustom.cpp
index 404bf11..8f0dfb1 100644
--- a/WebCore/bindings/js/JSEventSourceCustom.cpp
+++ b/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -45,29 +45,21 @@ namespace WebCore {
 
 JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSEventTarget.cpp b/WebCore/bindings/js/JSEventTarget.cpp
index 0421d10..6ea1135 100644
--- a/WebCore/bindings/js/JSEventTarget.cpp
+++ b/WebCore/bindings/js/JSEventTarget.cpp
@@ -128,7 +128,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJS(exec, globalObject, worker);
 
     if (DedicatedWorkerContext* workerContext = target->toDedicatedWorkerContext())
-        return toJSDOMGlobalObject(workerContext);
+        return toJSDOMGlobalObject(workerContext, exec);
 #endif
 
 #if ENABLE(SHARED_WORKERS)
@@ -136,7 +136,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJS(exec, globalObject, sharedWorker);
 
     if (SharedWorkerContext* workerContext = target->toSharedWorkerContext())
-        return toJSDOMGlobalObject(workerContext);
+        return toJSDOMGlobalObject(workerContext, exec);
 #endif
 
 #if ENABLE(NOTIFICATIONS)
diff --git a/WebCore/bindings/js/JSExceptionBase.cpp b/WebCore/bindings/js/JSExceptionBase.cpp
new file mode 100644
index 0000000..3749eed
--- /dev/null
+++ b/WebCore/bindings/js/JSExceptionBase.cpp
@@ -0,0 +1,64 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#include "config.h"

+#include "JSExceptionBase.h"

+

+#include "JSDOMCoreException.h"

+#include "JSEventException.h"

+#include "JSRangeException.h"

+#include "JSXMLHttpRequestException.h"

+#if ENABLE(SVG)

+#include "JSSVGException.h"

+#endif

+#if ENABLE(XPATH)

+#include "JSXPathException.h"

+#endif

+ 

+namespace WebCore {

+ 

+ExceptionBase* toExceptionBase(JSC::JSValue value)

+{

+    if (DOMCoreException* domException = toDOMCoreException(value))

+        return reinterpret_cast<ExceptionBase*>(domException);

+    if (RangeException* rangeException = toRangeException(value))

+        return reinterpret_cast<ExceptionBase*>(rangeException);

+    if (EventException* eventException = toEventException(value))

+        return reinterpret_cast<ExceptionBase*>(eventException);

+    if (XMLHttpRequestException* xmlHttpException = toXMLHttpRequestException(value))

+        return reinterpret_cast<ExceptionBase*>(xmlHttpException);

+#if ENABLE(SVG)

+    if (SVGException* svgException = toSVGException(value))

+        return reinterpret_cast<ExceptionBase*>(svgException);

+#endif

+#if ENABLE(XPATH)

+    if (XPathException* pathException = toXPathException(value))

+        return reinterpret_cast<ExceptionBase*>(pathException);

+#endif

+    

+    return 0;

+}

+

+} // namespace WebCore

diff --git a/WebCore/bindings/js/JSExceptionBase.h b/WebCore/bindings/js/JSExceptionBase.h
new file mode 100644
index 0000000..01c6ac2
--- /dev/null
+++ b/WebCore/bindings/js/JSExceptionBase.h
@@ -0,0 +1,43 @@
+/*

+ * Copyright (C) 2009 Apple Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef JSExceptionBase_h

+#define JSExceptionBase_h

+

+namespace JSC {

+    

+class JSValue;

+

+}   // namespace JSC

+

+namespace WebCore {

+

+class ExceptionBase;

+

+ExceptionBase* toExceptionBase(JSC::JSValue);

+

+} // namespace WebCore

+

+#endif // JSExceptionBase_h

diff --git a/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
new file mode 100644
index 0000000..fd1dd11
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLAllCollection.h"
+
+#include "AtomicString.h"
+#include "HTMLAllCollection.h"
+#include "JSDOMBinding.h"
+#include "JSHTMLAllCollection.h"
+#include "JSNode.h"
+#include "JSNodeList.h"
+#include "Node.h"
+#include "StaticNodeList.h"
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static JSValue getNamedItems(ExecState* exec, JSHTMLAllCollection* collection, const Identifier& propertyName)
+{
+    Vector<RefPtr<Node> > namedItems;
+    collection->impl()->namedItems(propertyName, namedItems);
+
+    if (namedItems.isEmpty())
+        return jsUndefined();
+    if (namedItems.size() == 1)
+        return toJS(exec, collection->globalObject(), namedItems[0].get());
+
+    // FIXME: HTML5 specifies that this should be a DynamicNodeList.
+    // FIXME: HTML5 specifies that non-HTMLOptionsCollection collections should return
+    // the first matching item instead of a NodeList.
+    return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
+}
+
+// HTMLCollections are strange objects, they support both get and call,
+// so that document.forms.item(0) and document.forms(0) both work.
+static JSValue JSC_HOST_CALL callHTMLAllCollection(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    // Do not use thisObj here. It can be the JSHTMLDocument, in the document.forms(i) case.
+    JSHTMLAllCollection* jsCollection = static_cast<JSHTMLAllCollection*>(function);
+    HTMLAllCollection* collection = static_cast<HTMLAllCollection*>(jsCollection->impl());
+
+    // Also, do we need the TypeError test here ?
+
+    if (args.size() == 1) {
+        // Support for document.all(<index>) etc.
+        bool ok;
+        UString string = args.at(0).toString(exec);
+        unsigned index = string.toUInt32(&ok, false);
+        if (ok)
+            return toJS(exec, jsCollection->globalObject(), collection->item(index));
+
+        // Support for document.images('<name>') etc.
+        return getNamedItems(exec, jsCollection, Identifier(exec, string));
+    }
+
+    // The second arg, if set, is the index of the item we want
+    bool ok;
+    UString string = args.at(0).toString(exec);
+    unsigned index = args.at(1).toString(exec).toUInt32(&ok, false);
+    if (ok) {
+        String pstr = string;
+        Node* node = collection->namedItem(pstr);
+        while (node) {
+            if (!index)
+                return toJS(exec, jsCollection->globalObject(), node);
+            node = collection->nextNamedItem(pstr);
+            --index;
+        }
+    }
+
+    return jsUndefined();
+}
+
+CallType JSHTMLAllCollection::getCallData(CallData& callData)
+{
+    callData.native.function = callHTMLAllCollection;
+    return CallTypeHost;
+}
+
+bool JSHTMLAllCollection::canGetItemsForName(ExecState*, HTMLAllCollection* collection, const Identifier& propertyName)
+{
+    Vector<RefPtr<Node> > namedItems;
+    collection->namedItems(propertyName, namedItems);
+    return !namedItems.isEmpty();
+}
+
+JSValue JSHTMLAllCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLAllCollection* thisObj = static_cast<JSHTMLAllCollection*>(asObject(slot.slotBase()));
+    return getNamedItems(exec, thisObj, propertyName);
+}
+
+JSValue JSHTMLAllCollection::item(ExecState* exec, const ArgList& args)
+{
+    bool ok;
+    uint32_t index = args.at(0).toString(exec).toUInt32(&ok, false);
+    if (ok)
+        return toJS(exec, globalObject(), impl()->item(index));
+    return getNamedItems(exec, this, Identifier(exec, args.at(0).toString(exec)));
+}
+
+JSValue JSHTMLAllCollection::namedItem(ExecState* exec, const ArgList& args)
+{
+    return getNamedItems(exec, this, Identifier(exec, args.at(0).toString(exec)));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index 8ffddf7..dd4ceaa 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -23,6 +23,7 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "HTMLAllCollection.h"
 #include "JSDOMBinding.h"
 #include "JSHTMLAllCollection.h"
 #include "JSHTMLOptionsCollection.h"
@@ -143,7 +144,6 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, HTMLCollection* c
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLOptionsCollection, collection);
             break;
         case DocAll:
-            typedef HTMLCollection HTMLAllCollection;
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, HTMLAllCollection, collection);
             break;
         default:
diff --git a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index c113ec7..a65ca7c 100644
--- a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -28,6 +28,7 @@
 
 #include "CharacterNames.h"
 #include "Frame.h"
+#include "HTMLAllCollection.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCollection.h"
 #include "HTMLDocument.h"
@@ -105,14 +106,14 @@ JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
     if (args.size() > 2) {
         Frame* frame = static_cast<HTMLDocument*>(impl())->frame();
         if (frame) {
-            JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
+            JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame, currentWorld(exec));
             if (wrapper) {
                 JSValue function = wrapper->get(exec, Identifier(exec, "open"));
                 CallData callData;
                 CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
-                return call(exec, function, callType, callData, wrapper, args);
+                return callInWorld(exec, function, callType, callData, wrapper, args, currentWorld(exec));
             }
         }
         return jsUndefined();
diff --git a/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index 05972e6..68769d6 100644
--- a/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -47,14 +47,14 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValue JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
 
     Node* frame = element->children()->namedItem(propertyName);
     if (Document* doc = static_cast<HTMLFrameElement*>(frame)->contentDocument()) {
-        if (JSDOMWindowShell* window = toJSDOMWindowShell(doc->frame()))
+        if (JSDOMWindowShell* window = toJSDOMWindowShell(doc->frame(), currentWorld(exec)))
             return window;
     }
 
diff --git a/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index 73fa268..439f532 100644
--- a/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -66,10 +66,7 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
-#include "JavaScriptProfile.h"
 #include "JSJavaScriptCallFrame.h"
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
 #endif
 
 using namespace JSC;
@@ -134,7 +131,8 @@ JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
     Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    // Could use currentWorld(exec) ... but which exec!  The following mixed use of exec & inspectedWindow->globalExec() scares me!
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
@@ -144,7 +142,7 @@ JSValue JSInspectorBackend::inspectedWindow(ExecState*, const ArgList&)
     InspectorController* ic = impl()->inspectorController();
     if (!ic)
         return jsUndefined();
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
 }
 
@@ -253,21 +251,6 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
 }
 
-JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    MarkedArgumentBuffer result;
-    InspectorController* ic = impl()->inspectorController();
-    if (!ic)
-        return jsUndefined();
-    const Vector<RefPtr<Profile> >& profiles = ic->profiles();
-
-    for (size_t i = 0; i < profiles.size(); ++i)
-        result.append(toJS(exec, profiles[i].get()));
-
-    return constructArray(exec, result);
-}
-
 #endif
 
 JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
@@ -284,7 +267,7 @@ JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
         return jsUndefined();
 
     JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame(), debuggerWorld());
     return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
 }
 
diff --git a/WebCore/bindings/js/JSLazyEventListener.cpp b/WebCore/bindings/js/JSLazyEventListener.cpp
index 0d6cb57..6d75f4f 100644
--- a/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -35,8 +35,8 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
-    : JSEventListener(0, true)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
+    : JSEventListener(0, true, isolatedWorld)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
@@ -92,7 +92,7 @@ void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) co
     if (!scriptController->isEnabled())
         return;
 
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, m_isolatedWorld.get());
     if (!globalObject)
         return;
 
diff --git a/WebCore/bindings/js/JSLazyEventListener.h b/WebCore/bindings/js/JSLazyEventListener.h
index e3137b8..ba26ef6 100644
--- a/WebCore/bindings/js/JSLazyEventListener.h
+++ b/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,14 +29,14 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber, isolatedWorld));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber, DOMWrapperWorld* isolatedWorld);
 
         virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
diff --git a/WebCore/bindings/js/JSMessageChannelCustom.cpp b/WebCore/bindings/js/JSMessageChannelCustom.cpp
index 574e28a..d28d494 100644
--- a/WebCore/bindings/js/JSMessageChannelCustom.cpp
+++ b/WebCore/bindings/js/JSMessageChannelCustom.cpp
@@ -36,17 +36,11 @@ void JSMessageChannel::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (MessagePort* port = m_impl->port1()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* port = m_impl->port1())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), port);
 
-    if (MessagePort* port = m_impl->port2()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* port = m_impl->port2())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), port);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.cpp
index 210c93e..2c09620 100644
--- a/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -46,40 +46,29 @@ void JSMessagePort::markChildren(MarkStack& markStack)
     Base::markChildren(markStack);
 
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
-    if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* entangledPort = m_impl->locallyEntangledPort())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), entangledPort);
 
     m_impl->markEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index 52f21e7..2a4aa80 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -110,37 +110,21 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    Document* document = impl()->document();
-    if (!document)
-        return jsUndefined();
-        
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    Document* document = impl()->document();
-    if (!document)
-        return jsUndefined();
-
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -159,10 +143,8 @@ void JSNode::markChildren(MarkStack& markStack)
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
-        if (Document* doc = node->ownerDocument()) {
-            if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
-                markStack.append(docWrapper);
-        }
+        if (Document* doc = node->ownerDocument())
+            markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), doc);
         return;
     }
 
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.cpp b/WebCore/bindings/js/JSNodeFilterCondition.cpp
index a199417..54dc020 100644
--- a/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -66,7 +66,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValue result = call(exec, m_filter, callType, callData, m_filter, args);
+    JSValue result = callInWorld(exec, m_filter, callType, callData, m_filter, args, currentWorld(exec));
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index a0551a1..2ab2c00 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSQuarantinedObjectWrapper.h"
 
+#include "JSDOMBinding.h"
+
 #include <runtime/JSGlobalObject.h>
 
 using namespace JSC;
@@ -243,7 +245,8 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
+    JSValue unwrappedResult = constructInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs, debuggerWorld());
 
     JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
     ASSERT(resultValue.isObject());
@@ -293,7 +296,8 @@ JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JS
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+    // FIXME: Quarantined objects are all in the debuggerWorld(), for now. Instead, we should remove the quarantined objects, & replace them with an isolated world?
+    JSValue unwrappedResult = callInWorld(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs, debuggerWorld());
 
     JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 94a92bd..9f62495 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -47,10 +47,12 @@ namespace WebCore {
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
+            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, StructureFlags)); 
         }
 
     protected:
+        static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | JSC::OverridesHasInstance | JSC::OverridesMarkChildren | JSC::OverridesGetPropertyNames | JSC::JSObject::StructureFlags;
+
         JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual void markChildren(JSC::MarkStack&);
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 571e302..ba1cf22 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -50,29 +50,21 @@ void JSSVGElementInstance::markChildren(MarkStack& markStack)
 
 JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSSharedWorkerCustom.cpp b/WebCore/bindings/js/JSSharedWorkerCustom.cpp
index f21f50c..4617087 100644
--- a/WebCore/bindings/js/JSSharedWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSSharedWorkerCustom.cpp
@@ -45,11 +45,8 @@ void JSSharedWorker::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (MessagePort* port = impl()->port()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (MessagePort* port = impl()->port())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), port);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index d305502..33c3fcd 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -36,6 +36,7 @@
 #include "JSWebSocket.h"
 
 #include "KURL.h"
+#include "JSEventListener.h"
 #include "WebSocket.h"
 #include "NotImplemented.h"
 #include <runtime/Error.h>
@@ -59,7 +60,25 @@ JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
     return ret;
 }
 
-// FIXME: implement addEventListener/removeEventListener.
+JSValue JSWebSocket::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSWebSocket::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
 
 }  // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSWorkerContextCustom.cpp b/WebCore/bindings/js/JSWorkerContextCustom.cpp
index e1c8a8c..490d9b1 100644
--- a/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -122,7 +122,7 @@ JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -132,13 +132,13 @@ JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& arg
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
@@ -147,7 +147,7 @@ JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
 {
-    ScheduledAction* action = ScheduledAction::create(exec, args);
+    ScheduledAction* action = ScheduledAction::create(exec, args, currentWorld(exec));
     if (exec->hadException())
         return jsUndefined();
     int delay = args.at(1).toInt32(exec);
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 4b44db2..7ee2720 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -53,11 +53,8 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (XMLHttpRequestUpload* upload = m_impl->optionalUpload()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), upload);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (XMLHttpRequestUpload* upload = m_impl->optionalUpload())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), upload);
 
     m_impl->markEventListeners(markStack);
 }
@@ -152,29 +149,21 @@ JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 
 JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index dab0a3e..fa7cfec 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -45,40 +45,29 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest()) {
-        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), xmlHttpRequest);
-        if (wrapper)
-            markStack.append(wrapper);
-    }
+    if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest())
+        markDOMObjectWrapper(markStack, *Heap::heap(this)->globalData(), xmlHttpRequest);
 
     m_impl->markEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
     JSValue listener = args.at(1);
     if (!listener.isObject())
         return jsUndefined();
 
-    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false, currentWorld(exec)).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/ScheduledAction.cpp b/WebCore/bindings/js/ScheduledAction.cpp
index 9e64bce..9a21b6b 100644
--- a/WebCore/bindings/js/ScheduledAction.cpp
+++ b/WebCore/bindings/js/ScheduledAction.cpp
@@ -47,7 +47,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
+ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args, DOMWrapperWorld* isolatedWorld)
 {
     JSValue v = args.at(0);
     CallData callData;
@@ -55,15 +55,16 @@ ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
         UString string = v.toString(exec);
         if (exec->hadException())
             return 0;
-        return new ScheduledAction(string);
+        return new ScheduledAction(string, isolatedWorld);
     }
     ArgList argsTail;
     args.getSlice(2, argsTail);
-    return new ScheduledAction(v, argsTail);
+    return new ScheduledAction(v, argsTail, isolatedWorld);
 }
 
-ScheduledAction::ScheduledAction(JSValue function, const ArgList& args)
+ScheduledAction::ScheduledAction(JSValue function, const ArgList& args, DOMWrapperWorld* isolatedWorld)
     : m_function(function)
+    , m_isolatedWorld(isolatedWorld)
 {
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
@@ -102,7 +103,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
         args.append(m_args[i]);
 
     globalObject->globalData()->timeoutChecker.start();
-    call(exec, m_function, callType, callData, thisValue, args);
+    callInWorld(exec, m_function, callType, callData, thisValue, args, m_isolatedWorld.get());
     globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException())
@@ -111,7 +112,7 @@ void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSV
 
 void ScheduledAction::execute(Document* document)
 {
-    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    JSDOMWindow* window = toJSDOMWindow(document->frame(), m_isolatedWorld.get());
     if (!window)
         return;
 
@@ -125,7 +126,7 @@ void ScheduledAction::execute(Document* document)
         executeFunctionInContext(window, window->shell());
         Document::updateStyleForAllDocuments();
     } else
-        frame->loader()->executeScript(m_code);
+        frame->script()->executeScriptInIsolatedWorld(m_isolatedWorld.get(), m_code);
 
     frame->script()->setProcessingTimerCallback(false);
 }
diff --git a/WebCore/bindings/js/ScheduledAction.h b/WebCore/bindings/js/ScheduledAction.h
index e7d0b75..4ea727d 100644
--- a/WebCore/bindings/js/ScheduledAction.h
+++ b/WebCore/bindings/js/ScheduledAction.h
@@ -21,6 +21,8 @@
 #define ScheduledAction_h
 
 #include "PlatformString.h"
+#include <JSDOMBinding.h>
+#include <runtime/JSCell.h>
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
@@ -40,14 +42,15 @@ namespace WebCore {
     */
     class ScheduledAction {
     public:
-        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&);
+        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
 
         void execute(ScriptExecutionContext*);
 
     private:
-        ScheduledAction(JSC::JSValue function, const JSC::ArgList&);
-        ScheduledAction(const String& code)
+        ScheduledAction(JSC::JSValue function, const JSC::ArgList&, DOMWrapperWorld* isolatedWorld);
+        ScheduledAction(const String& code, DOMWrapperWorld* isolatedWorld)
             : m_code(code)
+            , m_isolatedWorld(isolatedWorld)
         {
         }
 
@@ -60,6 +63,7 @@ namespace WebCore {
         JSC::ProtectedJSValue m_function;
         Vector<JSC::ProtectedJSValue> m_args;
         String m_code;
+        RefPtr<DOMWrapperWorld> m_isolatedWorld;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 77b8ca4..e01324e 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -48,8 +48,9 @@ ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    if (scriptController->haveWindowShell()) {
-        m_window = scriptController->windowShell()->window();
+    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
+    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
+        m_window = windowShell->window();
         scriptController->attachDebugger(0);
     }
 }
@@ -70,11 +71,11 @@ void ScriptCachedFrameData::restore(Frame* frame)
     JSLock lock(SilenceAssertionsOnly);
 
     ScriptController* scriptController = frame->script();
-    if (scriptController->haveWindowShell()) {
-        JSDOMWindowShell* windowShell = scriptController->windowShell();
-        if (m_window) {
+    // FIXME: explicitly save and restore isolated worlds' global objects when using the back/forward cache. <rdar://problem/7328111>
+    if (JSDOMWindowShell* windowShell = scriptController->existingWindowShell(mainThreadNormalWorld())) {
+        if (m_window)
             windowShell->setWindow(m_window.get());
-        } else {
+        else {
             windowShell->setWindow(frame->domWindow());
             scriptController->attachDebugger(page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index 45f8c75..b0696ba 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "CString.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
@@ -54,6 +55,7 @@ ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
     , m_handlerLineNumber(0)
     , m_sourceURL(0)
+    , m_inExecuteScript(false)
     , m_processingTimerCallback(false)
     , m_paused(false)
     , m_allowPopupsFromPlugin(false)
@@ -76,8 +78,11 @@ ScriptController::ScriptController(Frame* frame)
 
 ScriptController::~ScriptController()
 {
-    if (m_windowShell) {
-        m_windowShell = 0;
+    if (!m_windowShells.isEmpty()) {
+        for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+            iter->first->forgetScriptController(this);
+
+        m_windowShells.clear();
     
         // It's likely that releasing the global object has created a lot of garbage.
         gcController().garbageCollectSoon();
@@ -86,11 +91,11 @@ ScriptController::~ScriptController()
     disconnectPlatformScriptObjects();
 }
 
-ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
+ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode, DOMWrapperWorld* world)
 {
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
-    
+
     if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
@@ -99,12 +104,12 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     // evaluate code. Returns the JS return value or 0
     // if there was none, an error occured or the type couldn't be converted.
 
-    initScriptIfNeeded();
     // inlineCode is true for <a href="javascript:doSomething()">
     // and false for <script>doSomething()</script>. Check if it has the
     // expected value in all cases.
     // See smart window.open policy for where this is used.
-    ExecState* exec = m_windowShell->window()->globalExec();
+    JSDOMWindowShell* shell = windowShell(world);
+    ExecState* exec = shell->window()->globalExec();
     const String* savedSourceURL = m_sourceURL;
     m_sourceURL = &sourceURL;
 
@@ -112,9 +117,9 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     RefPtr<Frame> protect = m_frame;
 
-    m_windowShell->window()->globalData()->timeoutChecker.start();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->globalData()->timeoutChecker.stop();
+    exec->globalData().timeoutChecker.start();
+    Completion comp = WebCore::evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell, world);
+    exec->globalData().timeoutChecker.stop();
 
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
@@ -132,52 +137,114 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
-void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
+{
+    return evaluateInWorld(sourceCode, mainThreadNormalWorld());
+}
+
+// An DOMWrapperWorld other than the thread's normal world.
+class IsolatedWorld : public DOMWrapperWorld {
+public:
+    IsolatedWorld(JSGlobalData* globalData)
+        : DOMWrapperWorld(globalData)
+    {
+        JSGlobalData::ClientData* clientData = globalData->clientData;
+        ASSERT(clientData);
+        static_cast<WebCoreJSClientData*>(clientData)->rememberWorld(this);
+    }
+
+    static PassRefPtr<IsolatedWorld> create(JSGlobalData* globalData) { return adoptRef(new IsolatedWorld(globalData)); }
+};
+
+static PassRefPtr<IsolatedWorld> findWorld(unsigned worldID)
+{
+    if (!worldID)
+        return IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
+
+    typedef HashMap<unsigned, RefPtr<IsolatedWorld> > WorldMap;
+    DEFINE_STATIC_LOCAL(WorldMap, isolatedWorlds, ());
+
+    WorldMap::iterator iter = isolatedWorlds.find(worldID);
+    if (iter != isolatedWorlds.end())
+        return iter->second;
+
+    RefPtr<IsolatedWorld> newWorld = IsolatedWorld::create(JSDOMWindow::commonJSGlobalData());
+    isolatedWorlds.add(worldID, newWorld);
+    return newWorld;
+}
+
+JSDOMWindow* ScriptController::globalObject(unsigned worldID)
+{
+    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
+    return windowShell(world.get())->window();
+}
+
+ScriptValue ScriptController::evaluateInIsolatedWorld(unsigned worldID, const ScriptSourceCode& sourceCode) 
+{
+    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
+    return evaluateInWorld(sourceCode, world.get());
+}
+
+void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sourceCode) 
 {
-    // FIXME: Actually support isolated worlds!
+    RefPtr<DOMWrapperWorld> world = findWorld(worldID);
+
     unsigned size = sourceCode.size();
     for (unsigned i = 0; i < size; ++i)
-        evaluate(sourceCode[i]);
+        evaluateInWorld(sourceCode[i], world.get());
 }
 
 void ScriptController::clearWindowShell()
 {
-    if (!m_windowShell)
+    if (m_windowShells.isEmpty())
         return;
 
     JSLock lock(SilenceAssertionsOnly);
 
     // Clear the debugger from the current window before setting the new window.
+    DOMWrapperWorld* debugWorld = debuggerWorld();
     attachDebugger(0);
 
-    m_windowShell->window()->willRemoveFromWindowShell();
-    m_windowShell->setWindow(m_frame->domWindow());
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
+        DOMWrapperWorld* world = iter->first;
+        JSDOMWindowShell* windowShell = iter->second;
+        windowShell->window()->willRemoveFromWindowShell();
+        windowShell->setWindow(m_frame->domWindow());
 
-    if (Page* page = m_frame->page()) {
-        attachDebugger(page->debugger());
-        m_windowShell->window()->setProfileGroup(page->group().identifier());
+        if (Page* page = m_frame->page()) {
+            if (world == debugWorld)
+                attachDebugger(page->debugger());
+            windowShell->window()->setProfileGroup(page->group().identifier());
+        }
     }
 
     // There is likely to be a lot of garbage now.
     gcController().garbageCollectSoon();
 }
 
-void ScriptController::initScript()
+JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 {
-    if (m_windowShell)
-        return;
+    ASSERT(!m_windowShells.contains(world));
 
     JSLock lock(SilenceAssertionsOnly);
 
-    m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    m_windowShell->window()->updateDocument();
+    JSDOMWindowShell* windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    m_windowShells.add(world, windowShell);
+    world->rememberScriptController(this);
+    windowShell->window()->updateDocument(world);
 
     if (Page* page = m_frame->page()) {
-        attachDebugger(page->debugger());
-        m_windowShell->window()->setProfileGroup(page->group().identifier());
+        if (world == debuggerWorld())
+            attachDebugger(page->debugger());
+        windowShell->window()->setProfileGroup(page->group().identifier());
     }
 
-    m_frame->loader()->dispatchWindowObjectAvailable();
+    {
+        EnterDOMWrapperWorld worldEntry(*JSDOMWindow::commonJSGlobalData(), world);
+        m_frame->loader()->dispatchWindowObjectAvailable();
+    }
+
+    return windowShell;
 }
 
 bool ScriptController::processingUserGesture() const
@@ -187,10 +254,14 @@ bool ScriptController::processingUserGesture() const
 
 bool ScriptController::processingUserGestureEvent() const
 {
-    if (!m_windowShell)
+    JSDOMWindowShell* shell = existingWindowShell(mainThreadNormalWorld());
+    if (!shell)
         return false;
 
-    if (Event* event = m_windowShell->window()->currentEvent()) {
+    if (Event* event = shell->window()->currentEvent()) {
+        if (event->createdByDOM())
+            return false;
+
         const AtomicString& type = event->type();
         if ( // mouse events
             type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
@@ -250,13 +321,16 @@ bool ScriptController::isEnabled()
 
 void ScriptController::attachDebugger(JSC::Debugger* debugger)
 {
-    if (!m_windowShell)
+    // FIXME: Should be able to debug isolated worlds.
+    JSDOMWindowShell* shell = existingWindowShell(debuggerWorld());
+    if (!shell)
         return;
 
+    JSDOMWindow* globalObject = shell->window();
     if (debugger)
-        debugger->attach(m_windowShell->window());
-    else if (JSC::Debugger* currentDebugger = m_windowShell->window()->debugger())
-        currentDebugger->detach(m_windowShell->window());
+        debugger->attach(globalObject);
+    else if (JSC::Debugger* currentDebugger = globalObject->debugger())
+        currentDebugger->detach(globalObject);
 }
 
 void ScriptController::updateDocument()
@@ -265,8 +339,8 @@ void ScriptController::updateDocument()
         return;
 
     JSLock lock(SilenceAssertionsOnly);
-    if (m_windowShell)
-        m_windowShell->window()->updateDocument();
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+        iter->second->window()->updateDocument(iter->first);
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -281,7 +355,7 @@ Bindings::RootObject* ScriptController::bindingRootObject()
 
     if (!m_bindingRootObject) {
         JSLock lock(SilenceAssertionsOnly);
-        m_bindingRootObject = Bindings::RootObject::create(0, globalObject());
+        m_bindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));
     }
     return m_bindingRootObject.get();
 }
@@ -292,7 +366,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
     if (it != m_rootObjects.end())
         return it->second;
 
-    RefPtr<Bindings::RootObject> rootObject = Bindings::RootObject::create(nativeHandle, globalObject());
+    RefPtr<Bindings::RootObject> rootObject = Bindings::RootObject::create(nativeHandle, globalObject(pluginWorld()));
 
     m_rootObjects.set(nativeHandle, rootObject);
     return rootObject.release();
@@ -307,7 +381,7 @@ NPObject* ScriptController::windowScriptNPObject()
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
             JSC::JSLock lock(SilenceAssertionsOnly);
-            JSObject* win = windowShell()->window();
+            JSObject* win = windowShell(pluginWorld())->window();
             ASSERT(win);
             Bindings::RootObject* root = bindingRootObject();
             m_windowScriptNPObject = _NPN_CreateScriptObject(0, win, root);
@@ -341,8 +415,9 @@ JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
 
     // Create a JSObject bound to this element
     JSLock lock(SilenceAssertionsOnly);
-    ExecState* exec = globalObject()->globalExec();
-    JSValue jsElementValue = toJS(exec, globalObject(), plugin);
+    JSDOMWindow* globalObj = globalObject(pluginWorld());
+    // FIXME: is normal okay? - used for NP plugins?
+    JSValue jsElementValue = toJS(globalObj->globalExec(), globalObj, plugin);
     if (!jsElementValue || !jsElementValue.isObject())
         return 0;
     
@@ -398,4 +473,44 @@ void ScriptController::clearScriptObjects()
 #endif
 }
 
+ScriptValue ScriptController::executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture)
+{
+    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
+
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluateInIsolatedWorld(worldID, sourceCode);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
+ScriptValue ScriptController::executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture)
+{
+    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
+
+    if (!isEnabled() || isPaused())
+        return ScriptValue();
+
+    bool wasInExecuteScript = m_inExecuteScript;
+    m_inExecuteScript = true;
+
+    ScriptValue result = evaluateInWorld(sourceCode, world);
+
+    if (!wasInExecuteScript) {
+        m_inExecuteScript = false;
+        Document::updateStyleForAllDocuments();
+    }
+
+    return result;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 9ae10fb..60b18d9 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -63,29 +63,52 @@ class XSSAuditor;
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
 class ScriptController {
+    typedef WTF::HashMap<DOMWrapperWorld*, JSC::ProtectedPtr<JSDOMWindowShell> > ShellMap;
+
 public:
     ScriptController(Frame*);
     ~ScriptController();
 
-    bool haveWindowShell() const { return m_windowShell; }
-    JSDOMWindowShell* windowShell()
+    JSDOMWindowShell* windowShell(DOMWrapperWorld* world)
+    {
+        ShellMap::iterator iter = m_windowShells.find(world);
+        return (iter != m_windowShells.end()) ? iter->second.get() : initScript(world);
+    }
+    JSDOMWindowShell* existingWindowShell(DOMWrapperWorld* world) const
+    {
+        ShellMap::const_iterator iter = m_windowShells.find(world);
+        return (iter != m_windowShells.end()) ? iter->second.get() : 0;
+    }
+    JSDOMWindow* globalObject(DOMWrapperWorld* world)
     {
-        initScriptIfNeeded();
-        return m_windowShell;
+        return windowShell(world)->window();
     }
+    JSDOMWindow* globalObject(unsigned worldID);
 
-    JSDOMWindow* globalObject()
+    void forgetWorld(DOMWrapperWorld* world)
     {
-        initScriptIfNeeded();
-        return m_windowShell->window();
+        m_windowShells.remove(world);
     }
 
+<<<<<<< HEAD:WebCore/bindings/js/ScriptController.h
+=======
+    ScriptValue executeScript(const ScriptSourceCode&);
+    ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInIsolatedWorld(unsigned worldID, const String& script, bool forceUserGesture = false);
+    ScriptValue executeScriptInIsolatedWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false);
+
+    // Returns true if argument is a JavaScript URL.
+    bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
+>>>>>>> webkit.org at r50258.:WebCore/bindings/js/ScriptController.h
     // This function must be called from the main thread. It is safe to call it repeatedly.
     // Darwin is an exception to this rule: it is OK to call this function from any thread, even reentrantly.
     static void initializeThreading();
 
     ScriptValue evaluate(const ScriptSourceCode&);
-    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
+    ScriptValue evaluateInWorld(const ScriptSourceCode&, DOMWrapperWorld*);
+    ScriptValue evaluateInIsolatedWorld(unsigned /*worldID*/, const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned /*worldID*/, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
@@ -142,23 +165,20 @@ public:
     XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
 private:
-    void initScriptIfNeeded()
-    {
-        if (!m_windowShell)
-            initScript();
-    }
-    void initScript();
+    JSDOMWindowShell* initScript(DOMWrapperWorld* world);
 
     void disconnectPlatformScriptObjects();
 
     bool processingUserGestureEvent() const;
     bool isJavaScriptAnchorNavigation() const;
 
-    JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
+    ShellMap m_windowShells;
     Frame* m_frame;
     int m_handlerLineNumber;
     const String* m_sourceURL;
 
+    bool m_inExecuteScript;
+
     bool m_processingTimerCallback;
     bool m_paused;
     bool m_allowPopupsFromPlugin;
diff --git a/WebCore/bindings/js/ScriptControllerMac.mm b/WebCore/bindings/js/ScriptControllerMac.mm
index e6a654f..21ec0f2 100644
--- a/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/WebCore/bindings/js/ScriptControllerMac.mm
@@ -114,7 +114,7 @@ WebScriptObject* ScriptController::windowScriptObject()
     if (!m_windowScriptObject) {
         JSC::JSLock lock(JSC::SilenceAssertionsOnly);
         JSC::Bindings::RootObject* root = bindingRootObject();
-        m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell()) originRootObject:root rootObject:root];
+        m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell(pluginWorld())) originRootObject:root rootObject:root];
     }
 
     ASSERT([m_windowScriptObject.get() isKindOfClass:[DOMAbstractView class]]);
diff --git a/WebCore/bindings/js/ScriptEventListener.cpp b/WebCore/bindings/js/ScriptEventListener.cpp
index 0b0047b..8399c7a 100644
--- a/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/WebCore/bindings/js/ScriptEventListener.cpp
@@ -71,7 +71,7 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
         sourceURL = node->document()->url().string();
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber);
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber, mainThreadNormalWorld());
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -93,7 +93,7 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     lineNumber = scriptController->eventHandlerLineNumber();
     sourceURL = frame->document()->url().string();
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber);
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber, mainThreadNormalWorld());
 }
 
 String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
diff --git a/WebCore/bindings/js/ScriptFunctionCall.cpp b/WebCore/bindings/js/ScriptFunctionCall.cpp
index 46e80ac..91b2a57 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -123,7 +123,8 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     if (callType == CallTypeNone)
         return ScriptValue();
 
-    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
+    // FIXME: Should this function take a worldID? - only used by inspector?
+    JSValue result = callInWorld(m_exec, function, callType, callData, thisObject, m_arguments, debuggerWorld());
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
@@ -161,7 +162,8 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     if (constructType == ConstructTypeNone)
         return ScriptObject();
 
-    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
+    // FIXME: Currently this method constructs objects in debuggerWorld().  We could use the current world, or pass a worldID to this function?
+    JSValue result = constructInWorld(m_exec, constructor, constructType, constructData, m_arguments, debuggerWorld());
     if (m_exec->hadException()) {
         if (reportExceptions)
             reportException(m_exec, m_exec->exception());
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index b48556e..313530f 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -72,7 +72,7 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
     if (!frame)
         return false;
 
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
+    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
@@ -89,7 +89,7 @@ bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObjec
     Frame* frame = storage->frame();
     ASSERT(frame);
 
-    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
+    JSDOMGlobalObject* globalObject = toJSDOMWindow(frame, debuggerWorld());
     ExecState* exec = globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
@@ -116,7 +116,7 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
 {
     ASSERT(domWindow);
 
-    JSDOMWindow* window = toJSDOMWindow(domWindow->frame());
+    JSDOMWindow* window = toJSDOMWindow(domWindow->frame(), debuggerWorld());
     ExecState* exec = window->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
diff --git a/WebCore/bindings/js/ScriptSourceCode.h b/WebCore/bindings/js/ScriptSourceCode.h
index 1b05ded..32d6298 100644
--- a/WebCore/bindings/js/ScriptSourceCode.h
+++ b/WebCore/bindings/js/ScriptSourceCode.h
@@ -44,6 +44,7 @@ public:
     ScriptSourceCode(const String& source, const KURL& url = KURL(), int startLine = 1)
         : m_provider(StringSourceProvider::create(source, url.isNull() ? String() : url.string()))
         , m_code(m_provider, startLine)
+        , m_url(url)
     {
     }
 
@@ -59,10 +60,17 @@ public:
 
     const String& source() const { return m_provider->source(); }
 
+    int startLine() const { return m_code.firstLine(); }
+
+    const KURL& url() const { return m_url; }
+    
 private:
     RefPtr<ScriptSourceProvider> m_provider;
     
     JSC::SourceCode m_code;
+    
+    KURL m_url;
+
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptState.cpp b/WebCore/bindings/js/ScriptState.cpp
index 8bfa33d..60ba2a0 100644
--- a/WebCore/bindings/js/ScriptState.cpp
+++ b/WebCore/bindings/js/ScriptState.cpp
@@ -32,6 +32,7 @@
 #include "ScriptState.h"
 
 #include "Frame.h"
+#include "JSDOMWindowBase.h"
 #include "Node.h"
 #include "Page.h"
 
@@ -49,12 +50,12 @@ ScriptState* scriptStateFromNode(Node* node)
         return 0;
     if (!frame->script()->isEnabled())
         return 0;
-    return frame->script()->globalObject()->globalExec();
+    return frame->script()->globalObject(mainThreadCurrentWorld())->globalExec();
 }
 
 ScriptState* scriptStateFromPage(Page* page)
 {
-    return page->mainFrame()->script()->globalObject()->globalExec();
+    return page->mainFrame()->script()->globalObject(mainThreadCurrentWorld())->globalExec();
 }
 
 }
diff --git a/WebCore/bindings/js/ScriptState.h b/WebCore/bindings/js/ScriptState.h
index fa5c4a8..279234e 100644
--- a/WebCore/bindings/js/ScriptState.h
+++ b/WebCore/bindings/js/ScriptState.h
@@ -35,6 +35,7 @@
 #include "JSDOMBinding.h"
 
 namespace WebCore {
+    class DOMWrapperWorld;
     class Node;
     class Page;
 
diff --git a/WebCore/bindings/js/WorkerScriptController.cpp b/WebCore/bindings/js/WorkerScriptController.cpp
index 3590dad..b66b0e8 100644
--- a/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/WebCore/bindings/js/WorkerScriptController.cpp
@@ -52,6 +52,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
     , m_workerContext(workerContext)
     , m_executionForbidden(false)
 {
+    m_globalData->clientData = new WebCoreJSClientData(m_globalData.get());
 }
 
 WorkerScriptController::~WorkerScriptController()
@@ -122,7 +123,7 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode,
 
     ExecState* exec = m_workerContextWrapper->globalExec();
     m_workerContextWrapper->globalData()->timeoutChecker.start();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
+    Completion comp = evaluateInWorld(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper, currentWorld(exec));
     m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
diff --git a/WebCore/bindings/js/WorkerScriptController.h b/WebCore/bindings/js/WorkerScriptController.h
index bb33f60..c820cd9 100644
--- a/WebCore/bindings/js/WorkerScriptController.h
+++ b/WebCore/bindings/js/WorkerScriptController.h
@@ -62,6 +62,9 @@ namespace WebCore {
         void setException(ScriptValue);
 
         void forbidExecution();
+
+        JSC::JSGlobalData* globalData() { return m_globalData.get(); }
+
     private:
         void initScriptIfNeeded()
         {
diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index 63a3b2a..907961f 100644
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -176,6 +176,7 @@ static void createElementClassMap()
     addElementClass(SVGNames::feImageTag, [DOMSVGFEImageElement class]);
     addElementClass(SVGNames::feMergeTag, [DOMSVGFEMergeElement class]);
     addElementClass(SVGNames::feMergeNodeTag, [DOMSVGFEMergeNodeElement class]);
+    addElementClass(SVGNames::feMorphologyTag, [DOMSVGFEMorphologyElement class]);
     addElementClass(SVGNames::feOffsetTag, [DOMSVGFEOffsetElement class]);
     addElementClass(SVGNames::fePointLightTag, [DOMSVGFEPointLightElement class]);
     addElementClass(SVGNames::feSpecularLightingTag, [DOMSVGFESpecularLightingElement class]);
diff --git a/WebCore/bindings/objc/DOMEvents.mm b/WebCore/bindings/objc/DOMEvents.mm
index c901e12..26dfe7b 100644
--- a/WebCore/bindings/objc/DOMEvents.mm
+++ b/WebCore/bindings/objc/DOMEvents.mm
@@ -28,6 +28,7 @@
 #import "config.h"
 #import "DOMEventInternal.h"
 
+#import "DOMBeforeLoadEvent.h"
 #import "DOMKeyboardEvent.h"
 #import "DOMMessageEvent.h"
 #import "DOMMouseEvent.h"
@@ -67,5 +68,7 @@ Class kitClass(WebCore::Event* impl)
         return [DOMMessageEvent class];
     if (impl->isProgressEvent())
         return [DOMProgressEvent class];
+    if (impl->isBeforeLoadEvent())
+        return [DOMBeforeLoadEvent class];
     return [DOMEvent class];
 }
diff --git a/WebCore/bindings/objc/DOMInternal.mm b/WebCore/bindings/objc/DOMInternal.mm
index 993a3ad..590d653 100644
--- a/WebCore/bindings/objc/DOMInternal.mm
+++ b/WebCore/bindings/objc/DOMInternal.mm
@@ -112,8 +112,8 @@ void removeDOMWrapper(DOMObjectInternal* impl)
     if (!frame)
         return;
 
-    // The global object which should own this node.
-    WebCore::JSDOMGlobalObject* globalObject = frame->script()->globalObject();
+    // The global object which should own this node - FIXME: does this need to be isolated-world aware?
+    WebCore::JSDOMGlobalObject* globalObject = frame->script()->globalObject(WebCore::mainThreadNormalWorld());
     JSC::ExecState *exec = globalObject->globalExec();
 
     // Get (or create) a cached JS object for the DOM node.
diff --git a/WebCore/bindings/objc/DOMSVG.h b/WebCore/bindings/objc/DOMSVG.h
index cb74544..c59532f 100644
--- a/WebCore/bindings/objc/DOMSVG.h
+++ b/WebCore/bindings/objc/DOMSVG.h
@@ -75,6 +75,7 @@
 #import <WebCore/DOMSVGFEImageElement.h>
 #import <WebCore/DOMSVGFEMergeElement.h>
 #import <WebCore/DOMSVGFEMergeNodeElement.h>
+#import <WebCore/DOMSVGFEMorphologyElement.h>
 #import <WebCore/DOMSVGFEOffsetElement.h>
 #import <WebCore/DOMSVGFEPointLightElement.h>
 #import <WebCore/DOMSVGFESpecularLightingElement.h>
diff --git a/WebCore/bindings/objc/WebScriptObject.mm b/WebCore/bindings/objc/WebScriptObject.mm
index 1086204..6d86001 100644
--- a/WebCore/bindings/objc/WebScriptObject.mm
+++ b/WebCore/bindings/objc/WebScriptObject.mm
@@ -299,7 +299,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         return nil;
 
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = call(exec, function, callType, callData, [self _imp], argList);
+    JSValue result = callInWorld(exec, function, callType, callData, [self _imp], argList, pluginWorld());
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
@@ -328,7 +328,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     JSLock lock(SilenceAssertionsOnly);
     
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = JSC::evaluate([self _rootObject]->globalObject()->globalExec(), [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)));
+    Completion completion = evaluateInWorld([self _rootObject]->globalObject()->globalExec(), [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue(), pluginWorld());
     [self _rootObject]->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
diff --git a/WebCore/bindings/scripts/CodeGenerator.pm b/WebCore/bindings/scripts/CodeGenerator.pm
index 92bd390..c1cb0a0 100644
--- a/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/WebCore/bindings/scripts/CodeGenerator.pm
@@ -59,6 +59,12 @@ my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                            "SVGAnimatedTransformList" => 1);
 
+my %svgAttributesInHTMLHash = ("class" => 1, "id" => 1, "onabort" => 1, "onclick" => 1,
+                               "onerror" => 1, "onload" => 1, "onmousedown" => 1,
+                               "onmousemove" => 1, "onmouseout" => 1, "onmouseover" => 1,
+                               "onmouseup" => 1, "onresize" => 1, "onscroll" => 1,
+                               "onunload" => 1);
+
 # Cache of IDL file pathnames.
 my $idlFiles;
 
@@ -347,4 +353,12 @@ sub WK_lcfirst
     return $ret;
 }
 
+# Return the C++ namespace that a given attribute name string is defined in.
+sub NamespaceForAttributeName
+{
+    my ($object, $interfaceName, $attributeName) = @_;
+    return "SVGNames" if $interfaceName =~ /^SVG/ && !$svgAttributesInHTMLHash{$attributeName};
+    return "HTMLNames";
+}
+
 1;
diff --git a/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 4d5cb96..4ca441b 100644
--- a/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -524,7 +524,7 @@ sub GenerateCPPAttributeSignature
 
 sub GenerateCPPAttribute
 {
-    my ($attribute, $className, $implementationClass) = @_;
+    my ($attribute, $className, $implementationClass, $IDLType) = @_;
 
     my $implementationClassWithoutNamespace = StripNamespace($implementationClass);
 
@@ -598,9 +598,10 @@ sub GenerateCPPAttribute
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $CPPImplementationWebCoreIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
+            my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
+            $CPPImplementationWebCoreIncludes{"${namespace}.h"} = 1;
+            push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, " . join(", ", @setterParams) . ");\n");
         } else {
             push(@setterImplementation, "    impl${implementationClassWithoutNamespace}()->${setterName}(" . join(", ", @setterParams) . ");\n");
         }
@@ -620,10 +621,11 @@ sub GenerateCPPAttribute
     my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
     my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
     if ($reflect || $reflectURL) {
-        $implIncludes{"HTMLNames.h"} = 1;
         my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+        my $namespace = $codeGenerator->NamespaceForAttributeName($IDLType, $contentAttributeName);
+        $implIncludes{"${namespace}.h"} = 1;
         my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr)";
+        $implementationGetter = "impl${implementationClassWithoutNamespace}()->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr)";
     } else {
         $implementationGetter = "impl${implementationClassWithoutNamespace}()->" . $codeGenerator->WK_lcfirst($attributeName) . "(" . ($hasGetterException ? "ec" : ""). ")";
     }
@@ -1154,7 +1156,7 @@ sub GenerateCPPImplementation
 
                 AddIncludesForTypeInCPPImplementation($attribute->signature->type);
 
-                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass);
+                my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
                 push(@CPPImplementationContent, values(%attributes));
             }
         }
@@ -1182,7 +1184,7 @@ sub GenerateCPPImplementation
 
             AddIncludesForTypeInCPPImplementation($attribute->signature->type);
 
-            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass);
+            my %attributes = GenerateCPPAttribute($attribute, $className, $implementationClass, $IDLType);
             push(@CPPImplementationContent, values(%attributes));
         }
     }
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 095c75f..d8367ac 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -292,7 +292,7 @@ sub GenerateGetOwnPropertySlotBody
 
     my @getOwnPropertySlotImpl = ();
 
-    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
         push(@getOwnPropertySlotImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertySlotImpl, "        return false;\n\n");
@@ -369,7 +369,7 @@ sub GenerateGetOwnPropertyDescriptorBody
     
     my @getOwnPropertyDescriptorImpl = ();
     
-    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
         push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
         push(@getOwnPropertyDescriptorImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertyDescriptorImpl, "        return false;\n\n");
@@ -463,6 +463,7 @@ sub GenerateHeader
     my $className = "JS$interfaceName";
     my $implClassName = $interfaceName;
     my @ancestorInterfaceNames = ();
+    my %structureFlags = ();
 
     # We only support multiple parents with SVG (for now).
     if (@{$dataNode->parents} > 1) {
@@ -574,6 +575,7 @@ sub GenerateHeader
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
         push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
+        $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
     }
 
     # Check if we have any writable properties
@@ -602,21 +604,20 @@ sub GenerateHeader
 
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));\n" .
-            "    }\n\n");
-    } elsif ($hasGetter) {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
-            "    }\n\n");
+        $structureFlags{"JSC::ImplementsHasInstance"} = 1;
+        $structureFlags{"JSC::NeedsThisConversion"} = 1;
     }
+    push(@headerContent,
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    {\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "    }\n\n");
 
     # markChildren function
-    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $needsMarkChildren;
+    if ($needsMarkChildren) {
+        push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n");
+        $structureFlags{"JSC::OverridesMarkChildren"} = 1;
+    }
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -628,13 +629,19 @@ sub GenerateHeader
     push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
     # Custom getPropertyNames function exists on DOMWindow
-    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+    if ($interfaceName eq "DOMWindow") {
+        push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;
+    }
 
     # Custom defineProperty function exists on DOMWindow
     push(@headerContent, "    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $interfaceName eq "DOMWindow";
 
     # Custom getOwnPropertyNames function
-    push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
+    if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n");
+        $structureFlags{"JSC::OverridesGetPropertyNames"} = 1;       
+    }
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
@@ -651,6 +658,12 @@ sub GenerateHeader
     # Custom lookupSetter function
     push(@headerContent, "    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
 
+    # Override toBoolean to return false for objects that want to 'MasqueradesAsUndefined'.
+    if ($dataNode->extendedAttributes->{"MasqueradesAsUndefined"}) {
+        push(@headerContent, "    virtual bool toBoolean(JSC::ExecState*) const { return false; };\n");
+        $structureFlags{"JSC::MasqueradesAsUndefined"} = 1;
+    }
+
     # Constructor object getter
     push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
 
@@ -712,6 +725,14 @@ sub GenerateHeader
         push(@headerContent, "        return static_cast<$implClassName*>(Base::impl());\n");
         push(@headerContent, "    }\n");
     }
+    
+    # structure flags
+    push(@headerContent, "protected:\n");
+    push(@headerContent, "    static const unsigned StructureFlags = ");
+    foreach my $structureFlag (keys %structureFlags) {
+        push(@headerContent, $structureFlag . " | ");
+    }
+    push(@headerContent, "Base::StructureFlags;\n");
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
@@ -719,6 +740,7 @@ sub GenerateHeader
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
+        
     }
     
     # Index setter
@@ -770,6 +792,7 @@ sub GenerateHeader
     push(@headerContent, "\n");
 
     # Add prototype declaration.
+    %structureFlags = ();
     push(@headerContent, "class ${className}Prototype : public JSC::JSObject {\n");
     push(@headerContent, "    typedef JSC::JSObject Base;\n");
     push(@headerContent, "public:\n");
@@ -787,19 +810,16 @@ sub GenerateHeader
         push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
         push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
-
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($needsMarkChildren ? "" : ", JSC::HasDefaultMark") . "));\n" .
-            "    }\n");
-    } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
-        push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
-            "    {\n" .
-            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
-            "    }\n");
+        $structureFlags{"JSC::OverridesGetOwnPropertySlot"} = 1;
+    }
+    if ($dataNode->extendedAttributes->{"CustomMarkFunction"} or $needsMarkChildren) {
+        $structureFlags{"JSC::OverridesMarkChildren"} = 1;
     }
+    push(@headerContent,
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    {\n" .
+        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags));\n" .
+        "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -810,6 +830,14 @@ sub GenerateHeader
 
     push(@headerContent, "    ${className}Prototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
+    # structure flags
+    push(@headerContent, "protected:\n");
+    push(@headerContent, "    static const unsigned StructureFlags = ");
+    foreach my $structureFlag (keys %structureFlags) {
+        push(@headerContent, $structureFlag . " | ");
+    }
+    push(@headerContent, "Base::StructureFlags;\n");
+
     push(@headerContent, "};\n\n");
 
     if ($numFunctions > 0) {
@@ -1166,19 +1194,21 @@ sub GenerateImplementation
             push(@implContent, "    impl()->invalidateEventListeners();\n");
         }
 
-        if ($interfaceName eq "Node") {
-             push(@implContent, "    forgetDOMNode(impl()->document(), impl());\n");
-        } else {
-            if ($podType) {
-                my $animatedType = $implClassName;
-                $animatedType =~ s/SVG/SVGAnimated/;
+        if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
+            if ($interfaceName eq "Node") {
+                 push(@implContent, "    forgetDOMNode(this, impl(), impl()->document());\n");
+            } else {
+                if ($podType) {
+                    my $animatedType = $implClassName;
+                    $animatedType =~ s/SVG/SVGAnimated/;
 
-                # Special case for JSSVGNumber
-                if ($codeGenerator->IsSVGAnimatedType($animatedType) and $podType ne "float") {
-                    push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
+                    # Special case for JSSVGNumber
+                    if ($codeGenerator->IsSVGAnimatedType($animatedType) and $podType ne "float") {
+                        push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
+                    }
                 }
+                push(@implContent, "    forgetDOMObject(this, impl());\n");
             }
-            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), impl());\n");
         }
 
         push(@implContent, "}\n\n");
@@ -1188,7 +1218,7 @@ sub GenerateImplementation
     # its own special handling rather than relying on the caching that Node normally does.
     if ($interfaceName eq "Document") {
         push(@implContent, "${className}::~$className()\n");
-        push(@implContent, "{\n    forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<${implClassName}*>(impl()));\n}\n\n");
+        push(@implContent, "{\n    forgetDOMObject(this, static_cast<${implClassName}*>(impl()));\n}\n\n");
     }
 
     if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
@@ -1323,10 +1353,11 @@ sub GenerateImplementation
                         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
                         if ($reflect || $reflectURL) {
-                            $implIncludes{"HTMLNames.h"} = 1;
                             my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
+                            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                            $implIncludes{"${namespace}.h"} = 1;
                             my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-                            $value = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr)"
+                            $value = "imp->$getAttributeFunctionName(${namespace}::${contentAttributeName}Attr)"
                         } else {
                             $value = "imp->$implGetterFunctionName()";
                         }
@@ -1453,7 +1484,7 @@ sub GenerateImplementation
                             } else {
                                 $implIncludes{"Frame.h"} = 1;
                                 $implIncludes{"JSDOMGlobalObject.h"} = 1;
-                                push(@implContent, "    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());\n");
+                                push(@implContent, "    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext(), exec);\n");
                                 push(@implContent, "    if (!globalObject)\n");
                                 push(@implContent, "        return;\n");
                             }
@@ -1483,9 +1514,10 @@ sub GenerateImplementation
                                 my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                                 my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
                                 if ($reflect || $reflectURL) {
-                                    $implIncludes{"HTMLNames.h"} = 1;
                                     my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
-                                    push(@implContent, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $nativeValue");
+                                    my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                                    $implIncludes{"${namespace}.h"} = 1;
+                                    push(@implContent, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $nativeValue");
                                 } else {
                                     push(@implContent, "    imp->set$implSetterFunctionName($nativeValue");
                                 }
@@ -1676,7 +1708,7 @@ sub GenerateImplementation
             push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->item(slot.index()));\n");
         }
         push(@implContent, "}\n");
-        if ($interfaceName eq "HTMLCollection") {
+        if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
             $implIncludes{"JSNode.h"} = 1;
             $implIncludes{"Node.h"} = 1;
         }
@@ -1687,7 +1719,7 @@ sub GenerateImplementation
         push(@implContent, "{\n");
         push(@implContent, "    return jsNumber(exec, static_cast<$implClassName*>(impl())->item(index));\n");
         push(@implContent, "}\n");
-        if ($interfaceName eq "HTMLCollection") {
+        if ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
             $implIncludes{"JSNode.h"} = 1;
             $implIncludes{"Node.h"} = 1;
         }
@@ -1933,6 +1965,8 @@ sub NativeToJSValue
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
+        # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+        $value =~ s/operator\(\)/_operator\(\)/ if ($value =~ /operator/);
         $value =~ s/\(\)//;
         $value .= "Animated()";
     }
@@ -2249,8 +2283,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+        return Structure::create(proto, TypeInfo(ObjectType, StructureFlags)); 
     }
+    
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | DOMConstructorObject::StructureFlags;
 EOF
 
     if ($canConstruct) {
diff --git a/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 317086b..91248c5 100644
--- a/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -725,6 +725,8 @@ sub GenerateHeader
             my $attributeIsReadonly = ($attribute->type =~ /^readonly/);
 
             my $property = "\@property" . GetPropertyAttributes($attribute->signature->type, $attributeIsReadonly);
+            # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+            $attributeName =~ s/operator/_operator/ if ($attributeName =~ /operator/);
             $property .= " " . $attributeType . ($attributeType =~ /\*$/ ? "" : " ") . $attributeName;
 
             my $publicInterfaceKey = $property . ";";
@@ -1149,15 +1151,21 @@ sub GenerateImplementation
 
             # - GETTER
             my $getterSig = "- ($attributeType)$attributeInterfaceName\n";
+
+            # Some SVGFE*Element.idl use 'operator' as attribute name, rewrite as '_operator' to avoid clashes with C/C++
+            $attributeName =~ s/operatorAnimated/_operatorAnimated/ if ($attributeName =~ /operatorAnimated/);
+            $getterSig =~ s/operator/_operator/ if ($getterSig =~ /operator/);
+
             my $hasGetterException = @{$attribute->getterExceptions};
             my $getterContentHead;
             my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
             my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
             if ($reflect || $reflectURL) {
-                $implIncludes{"HTMLNames.h"} = 1;
                 my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+                my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                $implIncludes{"${namespace}.h"} = 1;
                 my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr";
+                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::${namespace}::${contentAttributeName}Attr";
             } else {
                 $getterContentHead = "IMPL->" . $codeGenerator->WK_lcfirst($attributeName) . "(";
             }
@@ -1291,20 +1299,20 @@ sub GenerateImplementation
                     } else {
                         push(@implContent, "    IMPL->$coreSetterName($arg);\n");
                     }
-                } elsif ($hasSetterException) {
-                    push(@implContent, "    $exceptionInit\n");
-                    push(@implContent, "    IMPL->$coreSetterName($arg, ec);\n");
-                    push(@implContent, "    $exceptionRaiseOnError\n");
                 } else {
                     my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
                     my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+                    push(@implContent, "    $exceptionInit\n") if $hasSetterException;
+                    my $ec = $hasSetterException ? ", ec" : "";
                     if ($reflect || $reflectURL) {
-                        $implIncludes{"HTMLNames.h"} = 1;
                         my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
-                        push(@implContent, "    IMPL->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, $arg);\n");
+                        my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+                        $implIncludes{"${namespace}.h"} = 1;
+                        push(@implContent, "    IMPL->setAttribute(WebCore::${namespace}::${contentAttributeName}Attr, $arg$ec);\n");
                     } else {
-                        push(@implContent, "    IMPL->$coreSetterName($arg);\n");
+                        push(@implContent, "    IMPL->$coreSetterName($arg$ec);\n");
                     }
+                    push(@implContent, "    $exceptionRaiseOnError\n") if $hasSetterException;
                 }
 
                 push(@implContent, "}\n\n");
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index b65da53..2e0f9ee 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -215,7 +215,6 @@ sub AddClassForwardIfNeeded
 sub GetImplementationFileName
 {
     my $iface = shift;
-    return "HTMLCollection.h" if $iface eq "HTMLAllCollection";
     return "Event.h" if $iface eq "DOMTimeStamp";
     return "NamedAttrMap.h" if $iface eq "NamedNodeMap";
     return "NameNodeList.h" if $iface eq "NodeList";
@@ -307,7 +306,7 @@ sub GenerateSetDOMException
     my $indent = shift;
     my $result = "";
 
-    $result .= $indent . "if (ec) {\n";
+    $result .= $indent . "if (UNLIKELY(ec)) {\n";
     $result .= $indent . "    V8Proxy::setDOMException(ec);\n";
     $result .= $indent . "    return v8::Handle<v8::Value>();\n";
     $result .= $indent . "}\n";
@@ -460,6 +459,7 @@ sub GenerateNormalAttrGetter
     my $dataNode = shift;
     my $classIndex = shift;
     my $implClassName = shift;
+    my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -562,10 +562,11 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
             my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
-            $getterString = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr";
+            $getterString = "imp->$getAttributeFunctionName(${namespace}::${contentAttributeName}Attr";
         } else {
             $getterString = "imp->$getterFunc(";
         }
@@ -620,15 +621,17 @@ END
             push(@implContentDecls, "    if (!imp->document())\n");
             push(@implContentDecls, "      return v8::Undefined();\n");
         }
-        push(@implContentDecls, "    $nativeType v = ");
-
-        push(@implContentDecls, "$getterString;\n");
 
         if ($useExceptions) {
+            push(@implContentDecls, "    $nativeType v = ");
+            push(@implContentDecls, "$getterString;\n");
             push(@implContentDecls, GenerateSetDOMException("    "));
+            $result = "v";
+            $result .= ".release()" if (IsRefPtrType($returnType));
+        } else {
+            # Can inline the function call into the return statement to avoid overhead of using a Ref<> temporary
+            $result = $getterString;
         }
-
-        $result = "v";
     }
 
     if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
@@ -644,7 +647,6 @@ END
         my $classIndex = uc($attrType);
         push(@implContentDecls, "    return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n");
     } else {
-        $result .= ".release()" if (IsRefPtrType($attrType));
         push(@implContentDecls, "    " . ReturnNativeToJSValue($attribute->signature, $result, "    ").";\n");
     }
 
@@ -677,6 +679,7 @@ sub GenerateNormalAttrSetter
     my $dataNode = shift;
     my $classIndex = shift;
     my $implClassName = shift;
+    my $interfaceName = shift;
 
     my $attrExt = $attribute->signature->extendedAttributes;
 
@@ -755,9 +758,10 @@ END
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
-            $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
-            push(@implContentDecls, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $result");
+            my $namespace = $codeGenerator->NamespaceForAttributeName($interfaceName, $contentAttributeName);
+            $implIncludes{"${namespace}.h"} = 1;
+            push(@implContentDecls, "    imp->setAttribute(${namespace}::${contentAttributeName}Attr, $result");
         } elsif ($attribute->signature->type eq "EventListener") {
             $implIncludes{"V8AbstractEventListener.h"} = 1;
             $implIncludes{"V8CustomBinding.h"} = 1;
@@ -780,7 +784,8 @@ END
     }
 
     if ($useExceptions) {
-        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+        push(@implContentDecls, "    if (UNLIKELY(ec))\n");
+        push(@implContentDecls, "        V8Proxy::setDOMException(ec);\n");
     }
 
     if ($isPodType) {
@@ -913,7 +918,7 @@ END
         if (TypeCanFailConversion($parameter)) {
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
-"    if (!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ") {\n" .
+"    if (UNLIKELY(!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ")) {\n" .
 "      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
@@ -922,7 +927,7 @@ END
         if ($parameter->extendedAttributes->{"IsIndex"}) {
             $implIncludes{"ExceptionCode.h"} = 1;
             push(@implContentDecls,
-"    if ($parameterName < 0) {\n" .
+"    if (UNLIKELY($parameterName < 0)) {\n" .
 "      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
 "      return v8::Handle<v8::Value>();\n" .
 "    }\n");
@@ -944,126 +949,134 @@ sub GenerateBatchedAttributeData
     my $attributes = shift;
 
     foreach my $attribute (@$attributes) {
-        my $attrName = $attribute->signature->name;
-        my $attrExt = $attribute->signature->extendedAttributes;
-
-        my $accessControl = "v8::DEFAULT";
-        if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
-            $accessControl = "v8::ALL_CAN_READ";
-        } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
-            $accessControl = "v8::ALL_CAN_WRITE";
-        } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
-            $accessControl = "v8::ALL_CAN_READ";
-            if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
-                $accessControl .= "|v8::ALL_CAN_WRITE";
-            }
-        }
-        if ($attrExt->{"V8DisallowShadowing"}) {
-            $accessControl .= "|v8::PROHIBITS_OVERWRITING";
-        }
-        $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
-
-        my $customAccessor =
-            $attrExt->{"Custom"} ||
-            $attrExt->{"CustomSetter"} ||
-            $attrExt->{"CustomGetter"} ||
-            $attrExt->{"V8Custom"} ||
-            $attrExt->{"V8CustomSetter"} ||
-            $attrExt->{"V8CustomGetter"} ||
-            "";
-        if ($customAccessor eq 1) {
-            # use the naming convension, interface + (capitalize) attr name
-            $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
-        }
+        my $conditionalString = GenerateConditionalString($attribute->signature);
+        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+        GenerateSingleBatchedAttribute($interfaceName, $attribute, ",", "");
+        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    }
+}
 
-        my $getter;
-        my $setter;
-        my $propAttr = "v8::None";
-        my $hasCustomSetter = 0;
+sub GenerateSingleBatchedAttribute
+{
+    my $interfaceName = shift;
+    my $attribute = shift;
+    my $delimiter = shift;
+    my $indent = shift;
+    my $attrName = $attribute->signature->name;
+    my $attrExt = $attribute->signature->extendedAttributes;
 
-        # Check attributes.
-        if ($attrExt->{"DontEnum"}) {
-            $propAttr .= "|v8::DontEnum";
-        }
-        if ($attrExt->{"V8DisallowShadowing"}) {
-            $propAttr .= "|v8::DontDelete";
+    my $accessControl = "v8::DEFAULT";
+    if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
+        $accessControl = "v8::ALL_CAN_READ";
+    } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
+        $accessControl = "v8::ALL_CAN_WRITE";
+    } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
+        $accessControl = "v8::ALL_CAN_READ";
+        if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
+            $accessControl .= "|v8::ALL_CAN_WRITE";
         }
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $accessControl .= "|v8::PROHIBITS_OVERWRITING";
+    }
+    $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
 
-        my $on_proto = "0 /* on instance */";
-        my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+    my $customAccessor =
+        $attrExt->{"Custom"} ||
+        $attrExt->{"CustomSetter"} ||
+        $attrExt->{"CustomGetter"} ||
+        $attrExt->{"V8Custom"} ||
+        $attrExt->{"V8CustomSetter"} ||
+        $attrExt->{"V8CustomGetter"} ||
+        "";
+    if ($customAccessor eq 1) {
+        # use the naming convension, interface + (capitalize) attr name
+        $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
+    }
 
-        # Constructor
-        if ($attribute->signature->type =~ /Constructor$/) {
-            my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
-            $constructorType =~ s/Constructor$//;
-            my $constructorIndex = uc($constructorType);
-            if ($customAccessor) {
-                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            } else {
-                $data = "V8ClassIndex::${constructorIndex}";
-                $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
-            }
-            $setter = "0";
-            $propAttr = "v8::ReadOnly";
+    my $getter;
+    my $setter;
+    my $propAttr = "v8::None";
+    my $hasCustomSetter = 0;
 
-        } else {
-            # Default Getter and Setter
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
-
-            # Custom Setter
-            if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-                $hasCustomSetter = 1;
-                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-            }
+    # Check attributes.
+    if ($attrExt->{"DontEnum"}) {
+        $propAttr .= "|v8::DontEnum";
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $propAttr .= "|v8::DontDelete";
+    }
 
-            # Custom Getter
-            if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            }
+    my $on_proto = "0 /* on instance */";
+    my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+
+    # Constructor
+    if ($attribute->signature->type =~ /Constructor$/) {
+        my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
+        $constructorType =~ s/Constructor$//;
+        my $constructorIndex = uc($constructorType);
+        if ($customAccessor) {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        } else {
+            $data = "V8ClassIndex::${constructorIndex}";
+            $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
         }
+        $setter = "0";
+        $propAttr = "v8::ReadOnly";
 
-        # Replaceable
-        if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
-            $setter = "0";
-            # Handle the special case of window.top being marked as Replaceable.
-            # FIXME: Investigate whether we could treat window.top as replaceable 
-            # and allow shadowing without it being a security hole.
-            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) { 
-                $propAttr .= "|v8::ReadOnly";
-            }
+    } else {
+        # Default Getter and Setter
+        $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+        $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+
+        # Custom Setter
+        if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $hasCustomSetter = 1;
+            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
         }
 
-        # Read only attributes
-        if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
-            $setter = "0";
+        # Custom Getter
+        if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
         }
+    }
 
-        # An accessor can be installed on the proto
-        if ($attrExt->{"v8OnProto"}) {
-            $on_proto = "1 /* on proto */";
+    # Replaceable
+    if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
+        $setter = "0";
+        # Handle the special case of window.top being marked as Replaceable.
+        # FIXME: Investigate whether we could treat window.top as replaceable
+        # and allow shadowing without it being a security hole.
+        if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
+            $propAttr .= "|v8::ReadOnly";
         }
+    }
 
-        my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
-                          "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
-        
-        my $conditionalString = GenerateConditionalString($attribute->signature);
-        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+    # Read only attributes
+    if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
+        $setter = "0";
+    }
 
-        push(@implContent, <<END);
-  // $commentInfo
-  { "$attrName",
-    $getter,
-    $setter,
-    $data,
-    $accessControl,
-    static_cast<v8::PropertyAttribute>($propAttr),
-    $on_proto },
-END
-        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    # An accessor can be installed on the proto
+    if ($attrExt->{"v8OnProto"}) {
+        $on_proto = "1 /* on proto */";
     }
-}
 
+    my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
+                      "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
+
+    push(@implContent, $indent . "    {\n");
+    push(@implContent, $indent . "        \/\/ $commentInfo\n");
+    push(@implContent, $indent . "        \"$attrName\",\n");
+    push(@implContent, $indent . "        $getter,\n");
+    push(@implContent, $indent . "        $setter,\n");
+    push(@implContent, $indent . "        $data,\n");
+    push(@implContent, $indent . "        $accessControl,\n");
+    push(@implContent, $indent . "        static_cast<v8::PropertyAttribute>($propAttr),\n");
+    push(@implContent, $indent . "        $on_proto\n");
+    push(@implContent, $indent . "    }" . $delimiter . "\n");
+END
+}
 
 sub GenerateImplementation
 {
@@ -1136,7 +1149,7 @@ sub GenerateImplementation
         if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
             $implIncludes{"V8CustomBinding.h"} = 1;
         } else {
-            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName);
+            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
         }
         if ($attribute->signature->extendedAttributes->{"CustomSetter"} ||
             $attribute->signature->extendedAttributes->{"V8CustomSetter"}) {
@@ -1145,7 +1158,7 @@ sub GenerateImplementation
             $dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"} || die "Replaceable attribute can only be used in interface that defines ExtendsDOMGlobalObject attribute!";
             # GenerateReplaceableAttrSetter($implClassName);
         } elsif ($attribute->type !~ /^readonly/ && !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
-            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName);
+            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName, $interfaceName);
         }
     }
 
@@ -1176,20 +1189,24 @@ sub GenerateImplementation
 
     # For the DOMWindow interface we partition the attributes into the
     # ones that disallows shadowing and the rest.
-    my @disallows_shadowing;
+    my @disallowsShadowing;
+    # Also separate out attributes that are enabled at runtime so we can process them specially.
+    my @enabledAtRuntime;
     my @normal;
-    if ($interfaceName eq "DOMWindow") {
-        foreach my $attribute (@$attributes) {
-            if ($attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
-                push(@disallows_shadowing, $attribute);
-            } else {
-                push(@normal, $attribute);
-            }
+    foreach my $attribute (@$attributes) {
+        if ($interfaceName eq "DOMWindow" && $attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
+            push(@disallowsShadowing, $attribute);
+        } elsif ($attribute->signature->extendedAttributes->{"EnabledAtRuntime"}) {
+            push(@enabledAtRuntime, $attribute);
+        } else {
+            push(@normal, $attribute);
         }
-        # Put the attributes that disallow shadowing on the shadow object.
-        $attributes = \@normal;
+    }
+    $attributes = \@normal;
+    # Put the attributes that disallow shadowing on the shadow object.
+    if (@disallowsShadowing) {
         push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
-        GenerateBatchedAttributeData($dataNode, \@disallows_shadowing);
+        GenerateBatchedAttributeData($dataNode, \@disallowsShadowing);
         push(@implContent, "};\n");
     }
 
@@ -1271,6 +1288,21 @@ END
 END
     }
 
+    # Setup the enable-at-runtime attrs if we have them
+    foreach my $runtime_attr (@enabledAtRuntime) {
+        $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($runtime_attr->signature->name);
+        my $conditionalString = GenerateConditionalString($runtime_attr->signature);
+        push(@implContent, "\n#if ${conditionalString}\n") if $conditionalString;
+        push(@implContent, "    if (V8Custom::v8${enable_function}Enabled()) {\n");
+        push(@implContent, "        static const BatchedAttribute attrData =\\\n");
+        GenerateSingleBatchedAttribute($interfaceName, $runtime_attr, ";", "    ");
+        push(@implContent, <<END);
+        configureAttribute(instance, proto, attrData);
+    }
+END
+        push(@implContent, "\n#endif // ${conditionalString}\n") if $conditionalString;
+    }
+
     # Define our functions with Set() or SetAccessor()
     foreach my $function (@{$dataNode->functions}) {
         my $attrExt = $function->signature->extendedAttributes;
@@ -1291,6 +1323,13 @@ END
             $template = "instance";
         }
 
+        my $conditional = "";
+        if ($attrExt->{"EnabledAtRuntime"}) {
+            # Only call Set()/SetAccessor() if this method should be enabled
+            $enable_function = $interfaceName . $codeGenerator->WK_ucfirst($function->signature->name);
+            $conditional = "if (V8Custom::v8${enable_function}Enabled())\n";
+        }
+
         if ($attrExt->{"DoNotCheckDomainSecurity"} &&
             ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
             # Mark the accessor as ReadOnly and set it on the proto object so
@@ -1311,7 +1350,7 @@ END
             push(@implContent, <<END);
 
   // $commentInfo
-  $template->SetAccessor(
+  $conditional $template->SetAccessor(
       v8::String::New("$name"),
       ${interfaceName}Internal::${name}AttrGetter,
       0,
@@ -1339,7 +1378,7 @@ END
       push(@implContent, <<END);
 
   // $commentInfo
-  ${template}->Set(
+  $conditional ${template}->Set(
       v8::String::New("$name"),
       $templateFunction,
       static_cast<v8::PropertyAttribute>($property_attributes));
@@ -1357,7 +1396,7 @@ END
     }
 
     # Set the class name.  This is used when printing objects.
-    push(@implContent, "  desc->SetClassName(v8::String::New(\"" . GetClassName(${interfaceName}) . "\"));\n");
+    push(@implContent, "  desc->SetClassName(v8::String::New(\"${interfaceName}\"));\n");
 
     if ($has_constants) {
         push(@implContent, <<END);
@@ -1499,6 +1538,9 @@ sub GenerateFunctionCallString()
     }
     $functionString .= ")";
 
+    my $return = "result";
+    my $returnIsRef = IsRefPtrType($returnType);
+
     if ($nodeToReturn) {
         # Special case for insertBefore, replaceChild, removeChild and
         # appendChild functions from Node.
@@ -1519,16 +1561,18 @@ sub GenerateFunctionCallString()
             $indent . "$functionString;\n";
     } elsif ($returnsListItemPodType) {
         $result .= $indent . "RefPtr<SVGPODListItem<$nativeReturnType> > result = $functionString;\n";
-    } else {
+    } elsif (@{$function->raisesExceptions} or $returnsPodType or $isPodType or IsSVGTypeNeedingContextParameter($returnType)) {
         $result .= $indent . $nativeReturnType . " result = $functionString;\n";
+    } else {
+        # Can inline the function call into the return statement to avoid overhead of using a Ref<> temporary
+        $return = $functionString;
+        $returnIsRef = 0;
     }
 
     if (@{$function->raisesExceptions}) {
         $result .= GenerateSetDOMException($indent);
     }
 
-    my $return = "result";
-
     # If the return type is a POD type, separate out the wrapper generation
     if ($returnsListItemPodType) {
         $result .= $indent . "RefPtr<V8SVGPODTypeWrapper<" . $nativeReturnType . "> > wrapper = ";
@@ -1571,7 +1615,7 @@ sub GenerateFunctionCallString()
         my $classIndex = uc($returnType);
         $result .= $indent . "return V8DOMWrapper::convertToV8Object(V8ClassIndex::$classIndex, wrapper.release());\n";
     } else {
-        $return .= ".release()" if (IsRefPtrType($returnType));
+        $return .= ".release()" if ($returnIsRef);
         $result .= $indent . ReturnNativeToJSValue($function->signature, $return, $indent) . ";\n";
     }
 
@@ -1579,15 +1623,6 @@ sub GenerateFunctionCallString()
 }
 
 
-# Get the class name used for printing javascript DOM-object wrappers.
-sub GetClassName
-{
-    my $type = shift;
-    return "HTMLCollection" if $type eq "HTMLAllCollection";
-    return $type;
-}
-
-
 sub GetTypeFromSignature
 {
     my $signature = shift;
@@ -1620,6 +1655,7 @@ sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasActiveInfo";
     return 1 if $type eq "CanvasArray";
     return 1 if $type eq "CanvasArrayBuffer";
     return 1 if $type eq "CanvasBooleanArray";
@@ -1664,6 +1700,7 @@ sub IsRefPtrType
     return 1 if $type eq "EventListener";
     return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
+    return 1 if $type eq "HTMLAllCollection";
     return 1 if $type eq "HTMLDocument";
     return 1 if $type eq "HTMLElement";
     return 1 if $type eq "HTMLOptionsCollection";
@@ -2091,7 +2128,9 @@ sub ReturnNativeToJSValue
 
     # For all the types where we use 'int' as the representation type,
     # we use Integer::New which has a fast Smi conversion check.
-    return "return v8::Integer::New($value)" if GetNativeType($type) eq "int";
+    my $nativeType = GetNativeType($type);
+    return "return v8::Integer::New($value)" if $nativeType eq "int";
+    return "return v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
 
     return "return v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
 
@@ -2114,7 +2153,11 @@ sub ReturnNativeToJSValue
 
     # special case for non-DOM node interfaces
     if (IsDOMNodeType($type)) {
-        return "return V8DOMWrapper::convertNodeToV8Object($value)";
+        if ($signature->extendedAttributes->{"ReturnsNew"}) {
+            return "return V8DOMWrapper::convertNewNodeToV8Object($value)";
+        } else {
+            return "return V8DOMWrapper::convertNodeToV8Object($value)";
+        }
     }
 
     if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
@@ -2126,7 +2169,7 @@ sub ReturnNativeToJSValue
     }
 
     if ($type eq "EventListener") {
-        return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
+        return "return V8DOMWrapper::convertEventListenerToV8Object(imp->scriptExecutionContext(), $value)";
     }
 
     if ($type eq "SerializedScriptValue") {
diff --git a/WebCore/bindings/v8/DOMObjectsInclude.h b/WebCore/bindings/v8/DOMObjectsInclude.h
index fb7ba81..59c6ecb 100644
--- a/WebCore/bindings/v8/DOMObjectsInclude.h
+++ b/WebCore/bindings/v8/DOMObjectsInclude.h
@@ -33,6 +33,7 @@
 
 #include "BarInfo.h"
 #include "BeforeLoadEvent.h"
+#include "CanvasActiveInfo.h"
 #include "CanvasArray.h"
 #include "CanvasArrayBuffer.h"
 #include "CanvasBuffer.h"
diff --git a/WebCore/bindings/v8/DateExtension.cpp b/WebCore/bindings/v8/DateExtension.cpp
index 778a15a..7d8b9be 100644
--- a/WebCore/bindings/v8/DateExtension.cpp
+++ b/WebCore/bindings/v8/DateExtension.cpp
@@ -75,7 +75,7 @@ DateExtension* DateExtension::get()
 
 void DateExtension::setAllowSleep(bool allow)
 {
-    v8::Local<v8::Value> result = V8Proxy::retrieve()->context()->Global()->Get(v8::String::New("Date"));
+    v8::Local<v8::Value> result = V8Proxy::currentContext()->Global()->Get(v8::String::New("Date"));
     if (result.IsEmpty())
         return;
 
diff --git a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
index 98832f3..4aeee0c 100644
--- a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+++ b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
@@ -34,6 +34,7 @@
 #include "bindings/V8Attr.cpp"
 #include "bindings/V8BarInfo.cpp"
 #include "bindings/V8BeforeLoadEvent.cpp"
+#include "bindings/V8CanvasActiveInfo.cpp"
 #include "bindings/V8CanvasArray.cpp"
 #include "bindings/V8CanvasArrayBuffer.cpp"
 #include "bindings/V8CanvasBuffer.cpp"
@@ -253,6 +254,10 @@
 
 #if ENABLE(SHARED_WORKERS)
 #include "bindings/V8SharedWorker.cpp"
+<<<<<<< HEAD:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+=======
+#include "bindings/V8SharedWorkerContext.cpp"
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 #endif
 
 #if ENABLE(SVG)
@@ -361,7 +366,6 @@
 #include "bindings/V8SVGTRefElement.cpp"
 #include "bindings/V8SVGTSpanElement.cpp"
 #include "bindings/V8SVGUnitTypes.cpp"
-#include "bindings/V8SVGURIReference.cpp"
 #include "bindings/V8SVGUseElement.cpp"
 #include "bindings/V8SVGViewElement.cpp"
 #include "bindings/V8SVGZoomEvent.cpp"
@@ -382,6 +386,7 @@
 #if ENABLE(INSPECTOR)
 #include "bindings/V8InspectorBackend.cpp"
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 
 #if PLATFORM(ANDROID)
 // TODO: Upstream NOTIFICATIONS guard.
@@ -390,3 +395,5 @@
 #include "bindings/V8NotificationCenter.cpp"
 #endif
 #endif
+=======
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
diff --git a/WebCore/dom/HTMLAllCollection.idl b/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
index dee365f..21293a5 100644
--- a/WebCore/dom/HTMLAllCollection.idl
+++ b/WebCore/bindings/v8/RuntimeEnabledFeatures.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,13 +28,13 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module html {
+#include "config.h"
+#include "RuntimeEnabledFeatures.h"
 
-    // This interface is used for undetectable HTMLCollections.
-    // An undetectable HTMLCollection behaves like an HTMLCollection
-    // when used, but the 'typeof' operator returns undefined and
-    // ToBoolean returns false.
-    interface HTMLAllCollection : HTMLCollection {
-    };
+namespace WebCore {
 
-}
+bool RuntimeEnabledFeatures::isDatabaseEnabled = false;
+bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
+bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/RuntimeEnabledFeatures.h b/WebCore/bindings/v8/RuntimeEnabledFeatures.h
new file mode 100644
index 0000000..fa42024
--- /dev/null
+++ b/WebCore/bindings/v8/RuntimeEnabledFeatures.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RuntimeEnabledFeatures_h
+#define RuntimeEnabledFeatures_h
+
+namespace WebCore {
+
+// A class that stores static enablers for all experimental features
+class RuntimeEnabledFeatures {
+public:
+    static void setDatabaseEnabled(bool isEnabled) { isDatabaseEnabled = isEnabled; }
+    static bool databaseEnabled() { return isDatabaseEnabled; }
+
+    static void setLocalStorageEnabled(bool isEnabled) { isLocalStorageEnabled = isEnabled; }
+    static bool localStorageEnabled() { return isLocalStorageEnabled; }
+
+    static void setSessionStorageEnabled(bool isEnabled) { isSessionStorageEnabled = isEnabled; }
+    static bool sessionStorageEnabled() { return isSessionStorageEnabled; }
+
+private:
+    // Never instantiate.
+    RuntimeEnabledFeatures() { }
+
+    static bool isDatabaseEnabled;
+    static bool isLocalStorageEnabled;
+    static bool isSessionStorageEnabled;
+};
+
+} // namespace WebCore
+
+#endif // RuntimeEnabledFeatures_h
diff --git a/WebCore/bindings/v8/ScriptCallStack.h b/WebCore/bindings/v8/ScriptCallStack.h
index 9f628c8..3ba01c5 100644
--- a/WebCore/bindings/v8/ScriptCallStack.h
+++ b/WebCore/bindings/v8/ScriptCallStack.h
@@ -55,8 +55,8 @@ namespace WebCore {
         ScriptState* state() const { return m_scriptState.get(); }
 
     private:
-        OwnPtr<ScriptState> m_scriptState;
         ScriptCallFrame m_lastCaller;
+        OwnPtr<ScriptState> m_scriptState;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 85af072..b1614c6 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -102,6 +102,7 @@ void ScriptController::gcUnprotectJSWrapper(void* domObject)
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
     , m_sourceURL(0)
+    , m_inExecuteScript(false)
     , m_processingTimerCallback(false)
     , m_paused(false)
     , m_proxy(new V8Proxy(frame))
@@ -173,6 +174,9 @@ bool ScriptController::processingUserGesture() const
     // Based on code from kjs_bindings.cpp.
     // Note: This is more liberal than Firefox's implementation.
     if (event) {
+        if (event->createdByDOM())
+            return false;
+
         const AtomicString& type = event->type();
         bool eventOk =
             // mouse events
@@ -440,4 +444,10 @@ void ScriptController::updateDocument()
     m_proxy->updateDocument();
 }
 
+// FIXME: Stub method so we compile.  Currently called from FrameLoader.cpp.
+DOMWrapperWorld* mainThreadNormalWorld()
+{
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
index ec15103..c17650a 100644
--- a/WebCore/bindings/v8/ScriptController.h
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -42,6 +42,7 @@
 #include <wtf/Vector.h>
 
 namespace WebCore {
+    class DOMWrapperWorld;
     class Event;
     class Frame;
     class HTMLPlugInElement;
@@ -59,6 +60,15 @@ namespace WebCore {
         // or this accessor should be made JSProxy*
         V8Proxy* proxy() { return m_proxy.get(); }
 
+<<<<<<< HEAD:WebCore/bindings/v8/ScriptController.h
+=======
+        ScriptValue executeScript(const ScriptSourceCode&);
+        ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+
+        // Returns true if argument is a JavaScript URL.
+        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/ScriptController.h
         // This function must be called from the main thread. It is safe to call it repeatedly.
         static void initializeThreading();
 
@@ -87,14 +97,11 @@ namespace WebCore {
         // all DOM nodes and DOM constructors.
         void evaluateInNewContext(const Vector<ScriptSourceCode>&, int extensionGroup);
 
-        // JSC has a WindowShell object, but for V8, the ScriptController
-        // is the WindowShell.
-        bool haveWindowShell() const { return true; }
-
         // Masquerade 'this' as the windowShell.
         // This is a bit of a hack, but provides reasonable compatibility
         // with what JSC does as well.
-        ScriptController* windowShell() { return this; }
+        ScriptController* windowShell(DOMWrapperWorld*) { return this; }
+        ScriptController* existingWindowShell(DOMWrapperWorld*) { return this; }
 
         XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
@@ -165,6 +172,8 @@ namespace WebCore {
         Frame* m_frame;
         const String* m_sourceURL;
 
+        bool m_inExecuteScript;
+
         bool m_processingTimerCallback;
         bool m_paused;
 
@@ -183,6 +192,8 @@ namespace WebCore {
         OwnPtr<XSSAuditor> m_XSSAuditor;
     };
 
+    DOMWrapperWorld* mainThreadNormalWorld();
+
 } // namespace WebCore
 
 #endif // ScriptController_h
diff --git a/WebCore/bindings/v8/ScriptEventListener.cpp b/WebCore/bindings/v8/ScriptEventListener.cpp
index 16ca70f..03713be 100644
--- a/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -36,6 +36,7 @@
 #include "EventListener.h"
 #include "Frame.h"
 #include "ScriptScope.h"
+#include "Tokenizer.h"
 #include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "XSSAuditor.h"
@@ -45,18 +46,29 @@ namespace WebCore {
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
+    int lineNumber = 1;
+    int columnNumber = 0;
+    String sourceURL;
 
-    Frame* frame = node->document()->frame();
+    if (Frame* frame = node->document()->frame()) {
+        ScriptController* scriptController = frame->script();
+        if (!scriptController->isEnabled())
+            return 0;
 
-    if (!frame)
-        return 0;
+        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+            // This script is not safe to execute.
+            return 0;
+        }
 
-    if (!frame->script()->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
+        if (frame->document()->tokenizer()) {
+            // FIXME: Change to use script->eventHandlerLineNumber() when implemented.
+            lineNumber = frame->document()->tokenizer()->lineNumber();
+            columnNumber = frame->document()->tokenizer()->columnNumber();
+        }
+        sourceURL = node->document()->url().string();
     }
 
-    return V8LazyEventListener::create(frame, attr->value(), attr->localName().string(), node->isSVGElement());
+    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, lineNumber, columnNumber);
 }
 
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -64,22 +76,36 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
-    if (!frame->script()->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+    int lineNumber = 1;
+    int columnNumber = 0;
+    String sourceURL;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
         // This script is not safe to execute.
         return 0;
     }
 
-    return V8LazyEventListener::create(frame, attr->value(), attr->localName().string(), frame->document()->isSVGDocument());
+    if (frame->document()->tokenizer()) {
+        // FIXME: Change to use script->eventHandlerLineNumber() when implemented.
+        lineNumber = frame->document()->tokenizer()->lineNumber();
+        columnNumber = frame->document()->tokenizer()->columnNumber();
+    }
+    sourceURL = frame->document()->url().string();
+    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, lineNumber, columnNumber);
 }
 
-String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState* scriptState, EventListener* listener)
+String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* listener)
 {
     if (listener->type() != EventListener::JSEventListenerType)
         return "";
 
     ScriptScope scope(scriptState);
     V8AbstractEventListener* v8Listener = static_cast<V8AbstractEventListener*>(listener);
-    v8::Handle<v8::Object> function = v8Listener->getListenerObject();
+    v8::Handle<v8::Object> function = v8Listener->getListenerObject(context);
     if (function.IsEmpty())
         return "";
 
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
index 5dd0dc5..6528c9d 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
@@ -57,10 +57,25 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
 {
     ASSERT(database);
 
-    // FIXME: Implement when Database V8 bindings are enabled
+#if ENABLE(DATABASE)
+    v8::HandleScope handleScope;
+    Frame* frame = database->document()->frame();
+    if (!frame)
+        return false;
+
+    v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return false;
+
+    v8::Context::Scope scope(context);
+    v8::Handle<v8::Value> v8Database = V8DOMWrapper::convertToV8Object(V8ClassIndex::DATABASE, database);
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Database)));
+#else
     ASSERT_NOT_REACHED();
     quarantinedObject = ScriptObject();
-    return false;
+#endif
+    return true;
 }
 
 bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
@@ -72,7 +87,9 @@ bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObjec
 #if ENABLE(DOM_STORAGE)
     v8::HandleScope handleScope;
     v8::Local<v8::Context> context = V8Proxy::context(frame);
-    // FIXME: What if context.IsEmpty()?
+    if (context.IsEmpty())
+        return false;
+
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8Storage = V8DOMWrapper::convertToV8Object(V8ClassIndex::STORAGE, storage);
diff --git a/WebCore/bindings/v8/ScriptString.h b/WebCore/bindings/v8/ScriptString.h
index fe254a5..414818a 100644
--- a/WebCore/bindings/v8/ScriptString.h
+++ b/WebCore/bindings/v8/ScriptString.h
@@ -32,34 +32,41 @@
 #define ScriptString_h
 
 #include "PlatformString.h"
+#include "ScriptStringImpl.h"
+#include "V8Binding.h"
 
 namespace WebCore {
 
 class ScriptString {
 public:
-    ScriptString() {}
-    ScriptString(const String& s) : m_str(s) {}
-    ScriptString(const char* s) : m_str(s) {}
+    ScriptString() : m_impl(0) {}
+    ScriptString(const String& s) : m_impl(ScriptStringImpl::create(s)) {}
+    ScriptString(const char* s) : m_impl(ScriptStringImpl::create(s)) {}
 
-    operator String() const { return m_str; }
+    operator String() const { return m_impl->toString(); }
 
-    bool isNull() const { return m_str.isNull(); }
-    size_t size() const { return m_str.length(); }
+    bool isNull() const { return !m_impl.get() || m_impl->isNull(); }
+    size_t size() const { return m_impl->size(); }
 
     ScriptString& operator=(const char* s)
     {
-        m_str = s;
+        m_impl = ScriptStringImpl::create(s);
         return *this;
     }
 
     ScriptString& operator+=(const String& s)
     {
-        m_str += s;
+        m_impl->append(s);
         return *this;
     }
 
+    v8::Handle<v8::Value> v8StringOrNull() const
+    {
+        return isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(m_impl->v8StringHandle());
+    }
+
 private:
-    String m_str;
+    RefPtr<ScriptStringImpl> m_impl;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptStringImpl.cpp b/WebCore/bindings/v8/ScriptStringImpl.cpp
new file mode 100644
index 0000000..afe74b1
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptStringImpl.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptStringImpl.h"
+
+#include "V8Binding.h"
+
+namespace WebCore {
+
+ScriptStringImpl::ScriptStringImpl(const String& s)
+{
+    v8::HandleScope scope;
+    m_handle.set(v8String(s));
+}
+
+ScriptStringImpl::ScriptStringImpl(const char* s)
+{
+    v8::HandleScope scope;
+    m_handle.set(v8::String::New(s));
+}
+
+String ScriptStringImpl::toString() const
+{
+    return v8StringToWebCoreString(m_handle.get());
+}
+
+bool ScriptStringImpl::isNull() const
+{
+    return m_handle.get().IsEmpty();
+}
+
+size_t ScriptStringImpl::size() const
+{
+    return m_handle.get()->Length();
+}
+
+void ScriptStringImpl::append(const String& s)
+{
+    v8::HandleScope scope;
+    if (m_handle.get().IsEmpty())
+        m_handle.set(v8String(s));
+    else
+        m_handle.set(v8::String::Concat(m_handle.get(), v8String(s)));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptStringImpl.h b/WebCore/bindings/v8/ScriptStringImpl.h
new file mode 100644
index 0000000..8a47b4f
--- /dev/null
+++ b/WebCore/bindings/v8/ScriptStringImpl.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptStringImpl_h
+#define ScriptStringImpl_h
+
+#include "OwnHandle.h"
+#include "PlatformString.h"
+
+#include <v8.h>
+
+namespace WebCore {
+
+// This class is used for strings that tend to be shared with JavaScript frequently.  The JSC implementation uses wtf::UString - see bindings/js/ScriptString.h
+// Currently XMLHttpRequest uses a ScriptString to build up the responseText attribute.  As data arrives from the network, it is appended to the ScriptString
+// via operator+= and a JavaScript readystatechange event is fired.  JavaScript can access the responseText attribute of the XMLHttpRequest object.  JavaScript
+// may also query the responseXML attribute of the XMLHttpRequest object which results in the responseText attribute being coerced into a WebCore::String and
+// then parsed as an XML document.
+// This implementation optimizes for the common case where the responseText is built up with many calls to operator+= before the actual text is queried.
+class ScriptStringImpl : public RefCounted<ScriptStringImpl> {
+public:
+    static PassRefPtr<ScriptStringImpl> create(const String& s)
+    {
+        return adoptRef(new ScriptStringImpl(s));
+    }
+
+    static PassRefPtr<ScriptStringImpl> create(const char* s)
+    {
+        return adoptRef(new ScriptStringImpl(s));
+    }
+
+    String toString() const;
+
+    bool isNull() const;
+    size_t size() const;
+
+    void append(const String& s);
+
+    v8::Handle<v8::String> v8StringHandle() { return m_handle.get(); }
+
+private:
+    ScriptStringImpl(const String& s);
+    ScriptStringImpl(const char* s);
+
+    OwnHandle<v8::String> m_handle;
+};
+
+} // namespace WebCore
+
+#endif // ScriptStringImpl_h
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 032b6b9..675e466 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -35,11 +35,12 @@
 #include "Document.h"
 #include "Event.h"
 #include "Frame.h"
-#include "Tokenizer.h"
 #include "V8Binding.h"
 #include "V8EventListenerList.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
@@ -49,28 +50,12 @@ static void weakEventListenerCallback(v8::Persistent<v8::Value>, void* parameter
     listener->disposeListenerObject();
 }
 
-V8AbstractEventListener::V8AbstractEventListener(Frame* frame, PassRefPtr<V8ListenerGuard> guard, bool isAttribute)
+V8AbstractEventListener::V8AbstractEventListener(PassRefPtr<V8ListenerGuard> guard, bool isAttribute)
     : EventListener(JSEventListenerType)
     , m_isWeak(true)
     , m_isAttribute(isAttribute)
-    , m_frame(frame)
     , m_guard(guard)
-    , m_lineNumber(0)
-    , m_columnNumber(0)
 {
-    if (!m_frame)
-        return;
-
-    // We might be called directly from the parser.
-    v8::HandleScope handleScope;
-
-    m_context = V8Proxy::shared_context(m_frame);
-
-    // Get the position in the source if any.
-    if (m_isAttribute && m_frame->document()->tokenizer()) {
-        m_lineNumber = m_frame->document()->tokenizer()->lineNumber();
-        m_columnNumber = m_frame->document()->tokenizer()->columnNumber();
-    }
 }
 
 V8AbstractEventListener::~V8AbstractEventListener()
@@ -83,7 +68,7 @@ V8AbstractEventListener::~V8AbstractEventListener()
     disposeListenerObject();
 }
 
-void V8AbstractEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
+void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
     // EventListener could be disconnected from the frame.
     if (disconnected())
@@ -96,25 +81,17 @@ void V8AbstractEventListener::handleEvent(ScriptExecutionContext* scriptExecutio
     LOCK_V8;
     v8::HandleScope handleScope;
 
-    if (!m_context)
-        return;
-
-    // Create a new local handle since the persistent handle stored in
-    // m_context may be disposed before we're done.
-    v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context->get());
+    v8::Local<v8::Context> v8Context = toV8Context(context);
     if (v8Context.IsEmpty())
         return;
 
-    // m_frame can removed by the callback function, protect it until the callback function returns.
-    RefPtr<Frame> protectFrame(m_frame);
-
     // Enter the V8 context in which to perform the event handling.
     v8::Context::Scope scope(v8Context);
 
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = V8DOMWrapper::convertEventToV8Object(event);
 
-    invokeEventHandler(v8Context, event, jsEvent);
+    invokeEventHandler(context, event, jsEvent);
 
     Document::updateStyleForAllDocuments();
 }
@@ -141,8 +118,13 @@ void V8AbstractEventListener::setListenerObject(v8::Handle<v8::Object> listener)
         m_listener.MakeWeak(this, &weakEventListenerCallback);
 }
 
-void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> v8Context, Event* event, v8::Handle<v8::Value> jsEvent)
+void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context, Event* event, v8::Handle<v8::Value> jsEvent)
 {
+
+    v8::Local<v8::Context> v8Context = toV8Context(context);
+    if (v8Context.IsEmpty())
+        return;
+
     // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     v8::Local<v8::Value> returnValue;
@@ -166,7 +148,7 @@ void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> v8Conte
 
         // Call the event handler.
         tryCatch.SetVerbose(false); // We do not want to report the exception to the inspector console.
-        returnValue = callListenerFunction(jsEvent, event);
+        returnValue = callListenerFunction(context, jsEvent, event);
         if (!tryCatch.CanContinue())
             return;
 
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.h b/WebCore/bindings/v8/V8AbstractEventListener.h
index c7736be..ceff001 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.h
+++ b/WebCore/bindings/v8/V8AbstractEventListener.h
@@ -97,15 +97,12 @@ namespace WebCore {
 
         virtual void handleEvent(ScriptExecutionContext*, Event*);
 
-        // Returns the owner frame of the listener.
-        Frame* frame() { return m_frame; }
-
         virtual bool isLazy() const { return false; }
 
         // Returns the listener object, either a function or an object.
-        v8::Local<v8::Object> getListenerObject()
+        v8::Local<v8::Object> getListenerObject(ScriptExecutionContext* context)
         {
-            prepareListenerObject();
+            prepareListenerObject(context);
             return v8::Local<v8::Object>::New(m_listener);
         }
 
@@ -122,30 +119,24 @@ namespace WebCore {
         // Dispose listener object and clear the handle.
         void disposeListenerObject();
 
-        // Detach the listener from its owner frame.
-        void disconnectFrame() { m_frame = 0; }
-
         virtual bool disconnected() const { return m_guard && m_guard->isDisconnected(); }
 
     protected:
-        V8AbstractEventListener(Frame*, PassRefPtr<V8ListenerGuard>, bool isAttribute);
+        V8AbstractEventListener(PassRefPtr<V8ListenerGuard>, bool isAttribute);
 
-        virtual void prepareListenerObject() { }
+        virtual void prepareListenerObject(ScriptExecutionContext*) { }
 
         void setListenerObject(v8::Handle<v8::Object> listener);
 
-        void invokeEventHandler(v8::Handle<v8::Context>, Event*, v8::Handle<v8::Value> jsEvent);
+        void invokeEventHandler(ScriptExecutionContext*, Event*, v8::Handle<v8::Value> jsEvent);
 
         // Get the receiver object to use for event listener call.
         v8::Local<v8::Object> getReceiverObject(Event*);
-
-        int lineNumber() const { return m_lineNumber; }
-
     private:
         // Implementation of EventListener function.
         virtual bool virtualisAttribute() const { return m_isAttribute; }
 
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*) = 0;
+        virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsevent, Event*) = 0;
 
         v8::Persistent<v8::Object> m_listener;
 
@@ -155,16 +146,7 @@ namespace WebCore {
         // Indicates if this is an HTML type listener.
         bool m_isAttribute;
 
-        // Frame to which the event listener is attached to. An event listener must be destroyed before its owner frame is
-        // deleted. See fast/dom/replaceChild.html
-        // FIXME: this could hold m_frame live until the event listener is deleted.
-        Frame* m_frame;
-        RefPtr<SharedPersistent<v8::Context> > m_context;
         RefPtr<V8ListenerGuard> m_guard;
-
-        // Position in the HTML source for HTML event listeners.
-        int m_lineNumber;
-        int m_columnNumber;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.h b/WebCore/bindings/v8/V8Binding.h
index a09102d..237bc4d 100644
--- a/WebCore/bindings/v8/V8Binding.h
+++ b/WebCore/bindings/v8/V8Binding.h
@@ -61,7 +61,7 @@ namespace WebCore {
         return v8NonStringValueToAtomicWebCoreString(value);
     }
 
-    inline String toString(const String& string)
+    inline const String& toString(const String& string)
     {
         return string;
     }
diff --git a/WebCore/bindings/v8/V8Collection.h b/WebCore/bindings/v8/V8Collection.h
index cbfe921..e72dc07 100644
--- a/WebCore/bindings/v8/V8Collection.h
+++ b/WebCore/bindings/v8/V8Collection.h
@@ -41,7 +41,7 @@ namespace WebCore {
     // FIXME: These functions should be named using to* since they return the item (get* is used for method that take a ref param).
     // See https://bugs.webkit.org/show_bug.cgi?id=24664.
 
-    static v8::Handle<v8::Value> getV8Object(void* implementation, v8::Local<v8::Value> implementationType)
+    inline v8::Handle<v8::Value> getV8Object(void* implementation, v8::Local<v8::Value> implementationType)
     {
         if (!implementation)
             return v8::Handle<v8::Value>();
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index 5a6b901..4e41a8c 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -445,6 +445,24 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
 
 #endif // WORKERS
 
+#if ENABLE(SHARED_WORKERS)
+    case V8ClassIndex::SHAREDWORKER: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kSharedWorkerInternalFieldCount);
+        descriptor->SetCallHandler(USE_CALLBACK(SharedWorkerConstructor));
+        break;
+    }
+
+    case V8ClassIndex::SHAREDWORKERCONTEXT: {
+        // Reserve internal fields for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        ASSERT(instanceTemplate->InternalFieldCount() == V8Custom::kDefaultWrapperInternalFieldCount);
+        instanceTemplate->SetInternalFieldCount(V8Custom::kSharedWorkerContextInternalFieldCount);
+        break;
+    }
+#endif // SHARED_WORKERS
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     case V8ClassIndex::DOMAPPLICATIONCACHE: {
         // Reserve one more internal field for keeping event listeners.
@@ -598,16 +616,6 @@ v8::Local<v8::Function> V8DOMWrapper::getConstructor(V8ClassIndex::V8WrapperType
     if (!frame)
         return v8::Local<v8::Function>();
 
-#if ENABLE(WEB_SOCKETS)
-    // Make typeof(window.WebSocket) == 'undefined' when
-    // experimentalWebSocketEnabled is false.
-    if (type == V8ClassIndex::WEBSOCKET) {
-        Settings* settings = frame->settings();
-        if (!settings || !settings->experimentalWebSocketsEnabled())
-            return v8::Local<v8::Function>();
-    }
-#endif
-
     v8::Handle<v8::Context> context = V8Proxy::context(frame);
     if (context.IsEmpty())
         return v8::Local<v8::Function>();
@@ -1198,6 +1206,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventToV8Object(Event* event)
     else if (event->isStorageEvent())
         type = V8ClassIndex::STORAGEEVENT;
 #endif
+    else if (event->isBeforeLoadEvent())
+        type = V8ClassIndex::BEFORELOADEVENT;
 
 
     v8::Handle<v8::Object> result = instantiateV8Object(type, V8ClassIndex::EVENT, event);
@@ -1281,14 +1291,14 @@ v8::Handle<v8::Value> V8DOMWrapper::convertNewNodeToV8Object(Node* node, V8Proxy
         else
             type = V8ClassIndex::DOCUMENT;
     } else {
-        ASSERT(nodeType < sizeof(mapping)/sizeof(mapping[0]));
+        ASSERT(nodeType < static_cast<int>(sizeof(mapping)/sizeof(mapping[0])));
         type = mapping[nodeType];
         ASSERT(type != V8ClassIndex::INVALID_CLASS_INDEX);
     }
 
     v8::Handle<v8::Context> context;
     if (proxy)
-        context = V8Proxy::context(proxy->frame());
+        context = proxy->context();
 
     // Enter the node's context and create the wrapper in that context.
     if (!context.IsEmpty())
@@ -1400,14 +1410,14 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
     return notHandledByInterceptor();
 }
 
-v8::Handle<v8::Value> V8DOMWrapper::convertEventListenerToV8Object(EventListener* listener)
+v8::Handle<v8::Value> V8DOMWrapper::convertEventListenerToV8Object(ScriptExecutionContext* context, EventListener* listener)
 {
     if (!listener)
         return v8::Null();
 
     // FIXME: can a user take a lazy event listener and set to other places?
     V8AbstractEventListener* v8listener = static_cast<V8AbstractEventListener*>(listener);
-    return v8listener->getListenerObject();
+    return v8listener->getListenerObject(context);
 }
 
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
@@ -1423,7 +1433,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Node* node, v8::Local<v
         proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
 
     if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
 
     return 0;
 }
@@ -1447,7 +1457,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker,
 
     V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
     if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
 
     return 0;
 }
@@ -1463,7 +1473,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Notification* notificat
 
     V8Proxy* proxy = V8Proxy::retrieve(notification->scriptExecutionContext());
     if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
 
     return 0;
 }
@@ -1487,7 +1497,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarge
 {
     V8Proxy* proxy = V8Proxy::retrieve(eventTarget->scriptExecutionContext());
     if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
 
 #if ENABLE(WORKERS)
     WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
@@ -1501,7 +1511,7 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarge
 PassRefPtr<EventListener> V8DOMWrapper::getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
 {
     if (proxy)
-        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->listenerGuard(), value, isAttribute);
 
     return 0;
 }
diff --git a/WebCore/bindings/v8/V8DOMWrapper.h b/WebCore/bindings/v8/V8DOMWrapper.h
index b5587d5..3d50af3 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/WebCore/bindings/v8/V8DOMWrapper.h
@@ -166,6 +166,16 @@ namespace WebCore {
 
         static v8::Handle<v8::Value> convertDocumentToV8Object(Document*);
 
+        static v8::Handle<v8::Value> convertNewNodeToV8Object(PassRefPtr<Node> node)
+        {
+            return convertNewNodeToV8Object(node.get());
+        }
+
+        static v8::Handle<v8::Value> convertNewNodeToV8Object(Node* node)
+        {
+            return convertNewNodeToV8Object(node, 0, getDOMNodeMap());
+        }
+
         static v8::Handle<v8::Value> convertNewNodeToV8Object(Node*, V8Proxy*, DOMWrapperMap<Node>&);
 
         template <class C>
@@ -216,12 +226,12 @@ namespace WebCore {
         static v8::Handle<v8::Value> convertEventTargetToV8Object(EventTarget*);
 
         // Wrap and unwrap JS event listeners.
-        static v8::Handle<v8::Value> convertEventListenerToV8Object(PassRefPtr<EventListener> eventListener)
+        static v8::Handle<v8::Value> convertEventListenerToV8Object(ScriptExecutionContext* context, PassRefPtr<EventListener> eventListener)
         {
-            return convertEventListenerToV8Object(eventListener.get());
+            return convertEventListenerToV8Object(context, eventListener.get());
         }
 
-        static v8::Handle<v8::Value> convertEventListenerToV8Object(EventListener*);
+        static v8::Handle<v8::Value> convertEventListenerToV8Object(ScriptExecutionContext*, EventListener*);
 
         static PassRefPtr<EventListener> getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
 
diff --git a/WebCore/bindings/v8/V8EventListenerList.h b/WebCore/bindings/v8/V8EventListenerList.h
index 506e5dc..29b4874 100644
--- a/WebCore/bindings/v8/V8EventListenerList.h
+++ b/WebCore/bindings/v8/V8EventListenerList.h
@@ -54,8 +54,8 @@ namespace WebCore {
             return doFindWrapper(v8::Local<v8::Object>::Cast(value), wrapperProperty);
         }
 
-        template<typename WrapperType, typename ContextType>
-        static PassRefPtr<V8EventListener> findOrCreateWrapper(ContextType*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Value>, bool isAttribute);
+        template<typename WrapperType>
+        static PassRefPtr<V8EventListener> findOrCreateWrapper(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Value>, bool isAttribute);
 
         static void clearWrapper(v8::Handle<v8::Object> listenerObject, bool isAttribute)
         {
@@ -80,8 +80,8 @@ namespace WebCore {
         }
     };
 
-    template<typename WrapperType, typename ContextType>
-    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(ContextType* context, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Value> value, bool isAttribute)
+    template<typename WrapperType>
+    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Value> value, bool isAttribute)
     {
         ASSERT(v8::Context::InContext());
         if (!value->IsObject())
@@ -94,7 +94,7 @@ namespace WebCore {
         if (wrapper)
             return wrapper;
 
-        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(context, guard, object, isAttribute);
+        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(guard, object, isAttribute);
         if (wrapperPtr)
             object->SetHiddenValue(wrapperProperty, v8::External::Wrap(wrapperPtr.get()));
 
diff --git a/WebCore/bindings/v8/V8GCController.cpp b/WebCore/bindings/v8/V8GCController.cpp
index f3b1376..4ef3bb8 100644
--- a/WebCore/bindings/v8/V8GCController.cpp
+++ b/WebCore/bindings/v8/V8GCController.cpp
@@ -342,7 +342,6 @@ public:
             Vector<v8::Persistent<v8::Value> > group;
             group.reserveCapacity(nextKeyIndex - i);
             for (; i < nextKeyIndex; ++i) {
-                Node* node = m_grouper[i].node();
                 v8::Persistent<v8::Value> wrapper = m_grouper[i].wrapper();
                 if (!wrapper.IsEmpty())
                     group.append(wrapper);
diff --git a/WebCore/bindings/v8/V8Index.cpp b/WebCore/bindings/v8/V8Index.cpp
index 2cbd16d..89a9f71 100644
--- a/WebCore/bindings/v8/V8Index.cpp
+++ b/WebCore/bindings/v8/V8Index.cpp
@@ -34,6 +34,7 @@
 #include "V8Attr.h"
 #include "V8BarInfo.h"
 #include "V8BeforeLoadEvent.h"
+#include "V8CanvasActiveInfo.h"
 #include "V8CanvasRenderingContext.h"
 #include "V8CanvasRenderingContext2D.h"
 #include "V8CanvasGradient.h"
@@ -355,7 +356,6 @@
 #include "V8SVGTransform.h"
 #include "V8SVGTransformList.h"
 #include "V8SVGUnitTypes.h"
-#include "V8SVGURIReference.h"
 #include "V8SVGZoomEvent.h"
 #endif
 
@@ -389,6 +389,7 @@
 
 #if ENABLE(SHARED_WORKERS)
 #include "V8SharedWorker.h"
+#include "V8SharedWorkerContext.h"
 #endif
 
 #if ENABLE(3D_CANVAS)
@@ -434,6 +435,7 @@
 #include "V8InspectorBackend.h"
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.cpp
 #if PLATFORM(ANDROID)
 // TODO: Upstream these guards to webkit.org
 #if ENABLE(GEOLOCATION)
@@ -452,6 +454,8 @@
 #include "V8VoidCallback.h"
 #endif  // PLATFORM(ANDROID)
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8Index.cpp
 namespace WebCore {
 
 FunctionTemplateFactory V8ClassIndex::GetFactory(V8WrapperType type)
diff --git a/WebCore/bindings/v8/V8Index.h b/WebCore/bindings/v8/V8Index.h
index 179b963..ee64125 100644
--- a/WebCore/bindings/v8/V8Index.h
+++ b/WebCore/bindings/v8/V8Index.h
@@ -445,6 +445,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(3D_CANVAS)
 #define DOM_OBJECT_3D_CANVAS_TYPES(V)                                   \
+    V(CANVASACTIVEINFO, CanvasActiveInfo)                               \
     V(CANVASARRAY, CanvasArray)                                         \
     V(CANVASARRAYBUFFER, CanvasArrayBuffer)                             \
     V(CANVASBUFFER, CanvasBuffer)                                       \
@@ -490,6 +491,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define DOM_OBJECT_INSPECTOR_TYPES(V)
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if ENABLE(GEOLOCATION)
 #define DOM_OBJECT_GEOLOCATION_TYPES(V)                                 \
     V(COORDINATES, Coordinates)                                         \
@@ -521,6 +523,8 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if PLATFORM(ANDROID)
 // This block is modified, but is not Android-specific.
+=======
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_TYPES(V)                                             \
     DOM_OBJECT_TYPES_1(V)                                               \
     DOM_OBJECT_TYPES_2(V)                                               \
@@ -530,11 +534,17 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     DOM_OBJECT_3D_CANVAS_TYPES(V)                                       \
     DOM_OBJECT_XPATH_TYPES(V)                                           \
     DOM_OBJECT_XSLT_TYPES(V)                                            \
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
     DOM_OBJECT_GEOLOCATION_TYPES(V)                                     \
     DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                     \
     DOM_OBJECT_VOIDCALLBACK_TYPES(V)                                    \
+=======
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8Index.h
     DOM_OBJECT_INSPECTOR_TYPES(V)
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #endif
+=======
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8Index.h
 
 #if ENABLE(SVG)
 // SVG_OBJECT_TYPES are svg non-node, non-pod types.
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.h b/WebCore/bindings/v8/V8IsolatedWorld.h
index 15d8711..663f4bd 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.h
+++ b/WebCore/bindings/v8/V8IsolatedWorld.h
@@ -88,7 +88,7 @@ namespace WebCore {
         }
 
         v8::Handle<v8::Context> context() { return m_context->get(); }
-        PassRefPtr<SharedPersistent<v8::Context> > shared_context() { return m_context; }
+        PassRefPtr<SharedPersistent<v8::Context> > sharedContext() { return m_context; }
 
         DOMDataStore* getDOMDataStore() const { return m_domDataStore.getStore(); }
 
diff --git a/WebCore/bindings/v8/V8LazyEventListener.cpp b/WebCore/bindings/v8/V8LazyEventListener.cpp
index 9b58571..54740a9 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -40,25 +40,30 @@
 
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(Frame* frame, const String& code, const String& functionName, bool isSVGEvent)
-    : V8AbstractEventListener(frame, 0, true)
-    , m_code(code)
+V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber)
+    : V8AbstractEventListener(0, true)
     , m_functionName(functionName)
     , m_isSVGEvent(isSVGEvent)
+    , m_code(code)
+    , m_sourceURL(sourceURL)
+    , m_lineNumber(lineNumber)
+    , m_columnNumber(columnNumber)
 {
 }
 
-v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
+v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)
 {
-    v8::Local<v8::Function> handlerFunction = v8::Local<v8::Function>::Cast(getListenerObject());
+    v8::Local<v8::Function> handlerFunction = v8::Local<v8::Function>::Cast(getListenerObject(context));
     v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    V8Proxy* proxy = V8Proxy::retrieve(frame());
-    return proxy->callFunction(handlerFunction, receiver, 1, parameters);
+    if (V8Proxy* proxy = V8Proxy::retrieve(context))
+        return proxy->callFunction(handlerFunction, receiver, 1, parameters);
+
+    return v8::Local<v8::Value>();
 }
 
 static v8::Handle<v8::Value> V8LazyEventListenerToString(const v8::Arguments& args)
@@ -66,16 +71,19 @@ static v8::Handle<v8::Value> V8LazyEventListenerToString(const v8::Arguments& ar
     return args.Holder()->GetHiddenValue(V8HiddenPropertyName::toStringString());
 }
 
-void V8LazyEventListener::prepareListenerObject()
+void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
 {
     if (hasExistingListenerObject())
         return;
 
-    // Switch to the context of m_frame.
     v8::HandleScope handleScope;
 
+    V8Proxy* proxy = V8Proxy::retrieve(context);
+    if (!proxy)
+        return;
+
     // Use the outer scope to hold context.
-    v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(frame());
+    v8::Handle<v8::Context> v8Context = proxy->context();
     // Bail out if we cannot get the context.
     if (v8Context.IsEmpty())
         return;
@@ -101,10 +109,8 @@ void V8LazyEventListener::prepareListenerObject()
     // Insert '\n' otherwise //-style comments could break the handler.
     code.append(  "\n}).call(this, evt);}}}})");
     v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
-    v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, frame()->document()->url(), lineNumber());
+    v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_lineNumber);
     if (!script.IsEmpty()) {
-        V8Proxy* proxy = V8Proxy::retrieve(frame());
-        ASSERT(proxy);
         v8::Local<v8::Value> value = proxy->runScript(script, false);
         if (!value.IsEmpty()) {
             ASSERT(value->IsFunction());
diff --git a/WebCore/bindings/v8/V8LazyEventListener.h b/WebCore/bindings/v8/V8LazyEventListener.h
index ba460e6..699460b 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/WebCore/bindings/v8/V8LazyEventListener.h
@@ -45,24 +45,27 @@ namespace WebCore {
     // A V8LazyEventListener is always a HTML event handler.
     class V8LazyEventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8LazyEventListener> create(Frame* frame, const String& code, const String& functionName, bool isSVGEvent)
+        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, int lineNumber, int columnNumber)
         {
-            return adoptRef(new V8LazyEventListener(frame, code, functionName, isSVGEvent));
+            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, lineNumber, columnNumber));
         }
 
         virtual bool isLazy() const { return true; }
 
     protected:
-        virtual void prepareListenerObject();
+        virtual void prepareListenerObject(ScriptExecutionContext*);
 
     private:
-        V8LazyEventListener(Frame*, const String& code, const String& functionName, bool isSVGEvent);
+        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, int lineNumber, int columnNumber);
 
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
+        virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
 
-        String m_code;
         String m_functionName;
         bool m_isSVGEvent;
+        String m_code;
+        String m_sourceURL;
+        int m_lineNumber;
+        int m_columnNumber;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8NPObject.cpp b/WebCore/bindings/v8/V8NPObject.cpp
index b6bf0f7..75163f1 100644
--- a/WebCore/bindings/v8/V8NPObject.cpp
+++ b/WebCore/bindings/v8/V8NPObject.cpp
@@ -93,26 +93,30 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
     NPVariant result;
     VOID_TO_NPVARIANT(result);
 
+    bool retval = true;
     switch (functionId) {
     case InvokeMethod:
         if (npObject->_class->invoke) {
             v8::Handle<v8::String> functionName(v8::String::Cast(*args.Data()));
             NPIdentifier identifier = getStringIdentifier(functionName);
-            npObject->_class->invoke(npObject, identifier, npArgs.get(), numArgs, &result);
+            retval = npObject->_class->invoke(npObject, identifier, npArgs.get(), numArgs, &result);
         }
         break;
     case InvokeConstruct:
         if (npObject->_class->construct)
-            npObject->_class->construct(npObject, npArgs.get(), numArgs, &result);
+            retval = npObject->_class->construct(npObject, npArgs.get(), numArgs, &result);
         break;
     case InvokeDefault:
         if (npObject->_class->invokeDefault)
-            npObject->_class->invokeDefault(npObject, npArgs.get(), numArgs, &result);
+            retval = npObject->_class->invokeDefault(npObject, npArgs.get(), numArgs, &result);
         break;
     default:
         break;
     }
 
+    if (!retval)
+        throwError("Error calling method on NPObject!", V8Proxy::GeneralError);
+
     for (int i=0; i < numArgs; i++)
         _NPN_ReleaseVariantValue(&npArgs[i]);
 
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index dd3c218..c78d009 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -49,6 +49,7 @@
 #include "V8HiddenPropertyName.h"
 #include "V8Index.h"
 #include "V8IsolatedWorld.h"
+#include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
 #include <utility>
@@ -83,15 +84,8 @@ const char* V8Proxy::kContextDebugDataValue = "value";
 
 void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate> instance, v8::Handle<v8::ObjectTemplate> proto, const BatchedAttribute* attributes, size_t attributeCount)
 {
-    for (size_t i = 0; i < attributeCount; ++i) {
-        const BatchedAttribute* attribute = &attributes[i];
-        (attribute->onProto ? proto : instance)->SetAccessor(v8::String::New(attribute->name),
-            attribute->getter,
-            attribute->setter,
-            attribute->data == V8ClassIndex::INVALID_CLASS_INDEX ? v8::Handle<v8::Value>() : v8::Integer::New(V8ClassIndex::ToInt(attribute->data)),
-            attribute->settings,
-            attribute->attribute);
-    }
+    for (size_t i = 0; i < attributeCount; ++i)
+        configureAttribute(instance, proto, attributes[i]);
 }
 
 void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor, v8::Handle<v8::ObjectTemplate> proto, const BatchedConstant* constants, size_t constantCount)
@@ -223,12 +217,13 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 }
 
 V8Proxy::V8Proxy(Frame* frame)
-    : m_frame(frame),
-      m_context(SharedPersistent<v8::Context>::create()),
-      m_listenerGuard(V8ListenerGuard::create()),
-      m_inlineCode(false),
-      m_timerCallback(false),
-      m_recursion(0) { }
+    : m_frame(frame)
+    , m_listenerGuard(V8ListenerGuard::create())
+    , m_inlineCode(false)
+    , m_timerCallback(false)
+    , m_recursion(0)
+{
+}
 
 V8Proxy::~V8Proxy()
 {
@@ -311,6 +306,9 @@ void V8Proxy::evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode
         } else {
             world = new V8IsolatedWorld(this, extensionGroup);
             m_isolatedWorlds.set(worldID, world);
+
+            // Setup context id for JS debugger.
+            setInjectedScriptContextDebugId(world->context());
         }
     } else {
         world = new V8IsolatedWorld(this, extensionGroup);
@@ -332,7 +330,7 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     v8::HandleScope handleScope;
 
     // Set up the DOM window as the prototype of the new global object.
-    v8::Handle<v8::Context> windowContext = context();
+    v8::Handle<v8::Context> windowContext = m_context;
     v8::Handle<v8::Object> windowGlobal = windowContext->Global();
     v8::Handle<v8::Object> windowWrapper = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, windowGlobal);
 
@@ -342,14 +340,7 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     v8::Context::Scope contextScope(context);
 
     // Setup context id for JS debugger.
-    v8::Handle<v8::Object> contextData = v8::Object::New();
-    v8::Handle<v8::Value> windowContextData = windowContext->GetData();
-    if (windowContextData->IsObject()) {
-        v8::Handle<v8::String> propertyName = v8::String::New(kContextDebugDataValue);
-        contextData->Set(propertyName, v8::Object::Cast(*windowContextData)->Get(propertyName));
-    }
-    contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("injected"));
-    context->SetData(contextData);
+    setInjectedScriptContextDebugId(context);
 
     v8::Handle<v8::Object> global = context->Global();
 
@@ -375,6 +366,21 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     context.Dispose();
 }
 
+void V8Proxy::setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext)
+{
+    // Setup context id for JS debugger.
+    v8::Context::Scope contextScope(targetContext);
+    v8::Handle<v8::Object> contextData = v8::Object::New();
+
+    v8::Handle<v8::Value> windowContextData = m_context->GetData();
+    if (windowContextData->IsObject()) {
+        v8::Handle<v8::String> propertyName = v8::String::New(kContextDebugDataValue);
+        contextData->Set(propertyName, v8::Object::Cast(*windowContextData)->Get(propertyName));
+    }
+    contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("injected"));
+    targetContext->SetData(contextData);
+}
+
 v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* node)
 {
     ASSERT(v8::Context::InContext());
@@ -553,8 +559,8 @@ v8::Local<v8::Object> V8Proxy::createWrapperFromCacheSlowCase(V8ClassIndex::V8Wr
     // Not in cache.
     int classIndex = V8ClassIndex::ToInt(type);
     initContextIfNeeded();
-    v8::Context::Scope scope(context());
-    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(context()));
+    v8::Context::Scope scope(m_context);
+    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(m_context));
     v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
     if (!instance.IsEmpty()) {
         m_wrapperBoilerplates->Set(v8::Integer::New(classIndex), instance);
@@ -567,9 +573,9 @@ bool V8Proxy::isContextInitialized()
 {
     // m_context, m_global, and m_wrapperBoilerplates should
     // all be non-empty if if m_context is non-empty.
-    ASSERT(context().IsEmpty() || !m_global.IsEmpty());
-    ASSERT(context().IsEmpty() || !m_wrapperBoilerplates.IsEmpty());
-    return !context().IsEmpty();
+    ASSERT(m_context.IsEmpty() || !m_global.IsEmpty());
+    ASSERT(m_context.IsEmpty() || !m_wrapperBoilerplates.IsEmpty());
+    return !m_context.IsEmpty();
 }
 
 DOMWindow* V8Proxy::retrieveWindow(v8::Handle<v8::Context> context)
@@ -722,7 +728,7 @@ void V8Proxy::updateDocumentWrapperCache()
 {
     LOCK_V8;
     v8::HandleScope handleScope;
-    v8::Context::Scope contextScope(context());
+    v8::Context::Scope contextScope(m_context);
 
     // If the document has no frame, NodeToV8Object might get the
     // document wrapper for a document that is about to be deleted.
@@ -744,20 +750,21 @@ void V8Proxy::updateDocumentWrapperCache()
         clearDocumentWrapperCache();
         return;
     }
-    context()->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
+    m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
 }
 
 void V8Proxy::clearDocumentWrapperCache()
 {
-    ASSERT(!context().IsEmpty());
-    context()->Global()->ForceDelete(v8::String::New("document"));
+    ASSERT(!m_context.IsEmpty());
+    m_context->Global()->ForceDelete(v8::String::New("document"));
 }
 
 void V8Proxy::disposeContextHandles()
 {
-    if (!context().IsEmpty()) {
+    if (!m_context.IsEmpty()) {
         m_frame->loader()->client()->didDestroyScriptContextForFrame();
-        shared_context()->disposeHandle();
+        m_context.Dispose();
+        m_context.Clear();
     }
 
     if (!m_wrapperBoilerplates.IsEmpty()) {
@@ -802,8 +809,12 @@ void V8Proxy::clearForClose()
 {
     resetIsolatedWorlds();
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     if (!context().IsEmpty()) {
         LOCK_V8;
+=======
+    if (!m_context.IsEmpty()) {
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8Proxy.cpp
         v8::HandleScope handleScope;
 
         clearDocumentWrapper();
@@ -816,12 +827,16 @@ void V8Proxy::clearForNavigation()
     disconnectEventListeners();
     resetIsolatedWorlds();
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     if (!context().IsEmpty()) {
         LOCK_V8;
+=======
+    if (!m_context.IsEmpty()) {
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8Proxy.cpp
         v8::HandleScope handle;
         clearDocumentWrapper();
 
-        v8::Context::Scope contextScope(context());
+        v8::Context::Scope contextScope(m_context);
 
         // Clear the document wrapper cache before turning on access checks on
         // the old DOMWindow wrapper. This way, access to the document wrapper
@@ -834,7 +849,7 @@ void V8Proxy::clearForNavigation()
         wrapper->TurnOnAccessCheck();
 
         // Separate the context from its global object.
-        context()->DetachGlobal();
+        m_context->DetachGlobal();
 
         disposeContextHandles();
     }
@@ -845,7 +860,7 @@ void V8Proxy::setSecurityToken()
     Document* document = m_frame->document();
     // Setup security origin and security token.
     if (!document) {
-        context()->UseDefaultSecurityToken();
+        m_context->UseDefaultSecurityToken();
         return;
     }
 
@@ -865,14 +880,14 @@ void V8Proxy::setSecurityToken()
     // case, we use the global object as the security token to avoid
     // calling canAccess when a script accesses its own objects.
     if (token.isEmpty() || token == "null") {
-        context()->UseDefaultSecurityToken();
+        m_context->UseDefaultSecurityToken();
         return;
     }
 
     CString utf8Token = token.utf8();
     // NOTE: V8 does identity comparison in fast path, must use a symbol
     // as the security token.
-    context()->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
+    m_context->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
 }
 
 void V8Proxy::updateDocument()
@@ -891,7 +906,7 @@ void V8Proxy::updateDocument()
     initContextIfNeeded();
 
     // Bail out if context initialization failed.
-    if (context().IsEmpty())
+    if (m_context.IsEmpty())
         return;
 
     // We have a new document and we need to update the cache.
@@ -1100,7 +1115,7 @@ bool V8Proxy::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* windo
 void V8Proxy::initContextIfNeeded()
 {
     // Bail out if the context has already been initialized.
-    if (!context().IsEmpty())
+    if (!m_context.IsEmpty())
         return;
 
 #ifdef ANDROID_INSTRUMENT
@@ -1130,17 +1145,16 @@ void V8Proxy::initContextIfNeeded()
     }
 
 
-    v8::Persistent<v8::Context> context = createNewContext(m_global, 0);
-    if (context.IsEmpty())
+    m_context = createNewContext(m_global, 0);
+    if (m_context.IsEmpty())
         return;
-    m_context->set(context);
 
-
-    v8::Context::Scope contextScope(context);
+    v8::Local<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context);
+    v8::Context::Scope contextScope(v8Context);
 
     // Store the first global object created so we can reuse it.
     if (m_global.IsEmpty()) {
-        m_global = v8::Persistent<v8::Object>::New(context->Global());
+        m_global = v8::Persistent<v8::Object>::New(v8Context->Global());
         // Bail out if allocation of the first global objects fails.
         if (m_global.IsEmpty()) {
             disposeContextHandles();
@@ -1151,7 +1165,7 @@ void V8Proxy::initContextIfNeeded()
 #endif
     }
 
-    installHiddenObjectPrototype(context);
+    installHiddenObjectPrototype(v8Context);
     m_wrapperBoilerplates = v8::Persistent<v8::Array>::New(v8::Array::New(V8ClassIndex::WRAPPER_TYPE_COUNT));
     // Bail out if allocation failed.
     if (m_wrapperBoilerplates.IsEmpty()) {
@@ -1162,7 +1176,7 @@ void V8Proxy::initContextIfNeeded()
     V8GCController::registerGlobalHandle(PROXY, this, m_wrapperBoilerplates);
 #endif
 
-    if (!installDOMWindow(context, m_frame->domWindow()))
+    if (!installDOMWindow(v8Context, m_frame->domWindow()))
         disposeContextHandles();
 
     updateDocument();
@@ -1248,21 +1262,16 @@ v8::Local<v8::Context> V8Proxy::context(Frame* frame)
     return context;
 }
 
-PassRefPtr<SharedPersistent<v8::Context> > V8Proxy::shared_context(Frame* frame)
+v8::Local<v8::Context> V8Proxy::context()
 {
-    V8Proxy *proxy = V8Proxy::retrieve(frame);
-    if (!proxy)
-        return 0;
-
-    proxy->initContextIfNeeded();
-    RefPtr<SharedPersistent<v8::Context> > context = proxy->shared_context();
     if (V8IsolatedWorld* world = V8IsolatedWorld::getEntered()) {
-        context = world->shared_context();
-        if (frame != V8Proxy::retrieveFrame(context->get()))
-            return 0;
+        RefPtr<SharedPersistent<v8::Context> > context = world->sharedContext();
+        if (m_frame != V8Proxy::retrieveFrame(context->get()))
+            return v8::Local<v8::Context>();
+        return v8::Local<v8::Context>::New(context->get());
     }
-
-    return context;
+    initContextIfNeeded();
+    return v8::Local<v8::Context>::New(m_context);;
 }
 
 v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
@@ -1272,7 +1281,7 @@ v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
         return v8::Local<v8::Context>();
 
     proxy->initContextIfNeeded();
-    return v8::Local<v8::Context>::New(proxy->context());
+    return v8::Local<v8::Context>::New(proxy->m_context);
 }
 
 v8::Local<v8::Context> V8Proxy::currentContext()
@@ -1416,17 +1425,17 @@ void V8Proxy::registerExtension(v8::Extension* extension, int extensionGroup)
 bool V8Proxy::setContextDebugId(int debugId)
 {
     ASSERT(debugId > 0);
-    if (context().IsEmpty())
+    if (m_context.IsEmpty())
         return false;
     v8::HandleScope scope;
-    if (!context()->GetData()->IsUndefined())
+    if (!m_context->GetData()->IsUndefined())
         return false;
 
-    v8::Context::Scope contextScope(context());
+    v8::Context::Scope contextScope(m_context);
     v8::Handle<v8::Object> contextData = v8::Object::New();
     contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("page"));
     contextData->Set(v8::String::New(kContextDebugDataValue), v8::Integer::New(debugId));
-    context()->SetData(contextData);
+    m_context->SetData(contextData);
     return true;
 }
 
@@ -1459,4 +1468,16 @@ void V8Proxy::installHiddenObjectPrototype(v8::Handle<v8::Context> context)
     context->Global()->SetHiddenValue(hiddenObjectPrototypeString, objectPrototype);
 }
 
+v8::Local<v8::Context> toV8Context(ScriptExecutionContext* context)
+{
+    if (context->isDocument()) {
+        if (V8Proxy* proxy = V8Proxy::retrieve(context))
+            return proxy->context();
+    } else if (context->isWorkerContext()) {
+        if (WorkerContextExecutionProxy* proxy = static_cast<WorkerContext*>(context)->script()->proxy())
+            return proxy->context();
+    }
+    return v8::Local<v8::Context>();
+}
+
 }  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index 30f682d..86d3b39 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -82,6 +82,16 @@ namespace WebCore {
 
     void batchConfigureAttributes(v8::Handle<v8::ObjectTemplate>, v8::Handle<v8::ObjectTemplate>, const BatchedAttribute*, size_t attributeCount);
 
+    inline void configureAttribute(v8::Handle<v8::ObjectTemplate> instance, v8::Handle<v8::ObjectTemplate> proto, const BatchedAttribute& attribute)
+    {
+        (attribute.onProto ? proto : instance)->SetAccessor(v8::String::New(attribute.name),
+            attribute.getter,
+            attribute.setter,
+            attribute.data == V8ClassIndex::INVALID_CLASS_INDEX ? v8::Handle<v8::Value>() : v8::Integer::New(V8ClassIndex::ToInt(attribute.data)),
+            attribute.settings,
+            attribute.attribute);
+    }
+
     // BatchedConstant translates into calls to Set() for setting up an object's
     // constants. It sets the constant on both the FunctionTemplate and the
     // ObjectTemplate. PropertyAttributes is always ReadOnly.
@@ -251,7 +261,6 @@ namespace WebCore {
         // Returns V8 Context of a frame. If none exists, creates
         // a new context. It is potentially slow and consumes memory.
         static v8::Local<v8::Context> context(Frame*);
-        static PassRefPtr<SharedPersistent<v8::Context> > shared_context(Frame*);
         static v8::Local<v8::Context> mainWorldContext(Frame*);
         static v8::Local<v8::Context> currentContext();
 
@@ -296,15 +305,7 @@ namespace WebCore {
         static int sourceLineNumber();
         static String sourceName();
 
-        v8::Handle<v8::Context> context()
-        {
-            return m_context->get();
-        }
-
-        PassRefPtr<SharedPersistent<v8::Context> > shared_context()
-        {
-            return m_context;
-        }
+        v8::Local<v8::Context> context();
 
         PassRefPtr<V8ListenerGuard> listenerGuard()
         {
@@ -360,6 +361,8 @@ namespace WebCore {
         
         void resetIsolatedWorlds();
 
+        void setInjectedScriptContextDebugId(v8::Handle<v8::Context> targetContext);
+
         static bool canAccessPrivate(DOMWindow*);
 
         static const char* rangeExceptionName(int exceptionCode);
@@ -392,7 +395,7 @@ namespace WebCore {
 
         Frame* m_frame;
 
-        RefPtr<SharedPersistent<v8::Context> > m_context;
+        v8::Persistent<v8::Context> m_context;
 
         RefPtr<V8ListenerGuard> m_listenerGuard;
 
@@ -453,6 +456,8 @@ namespace WebCore {
     }
 
 
+    v8::Local<v8::Context> toV8Context(ScriptExecutionContext*);
+
     // Used by an interceptor callback that it hasn't found anything to
     // intercept.
     inline static v8::Local<v8::Object> notHandledByInterceptor()
diff --git a/WebCore/bindings/v8/V8Utilities.cpp b/WebCore/bindings/v8/V8Utilities.cpp
index a66f435..ecac358 100644
--- a/WebCore/bindings/v8/V8Utilities.cpp
+++ b/WebCore/bindings/v8/V8Utilities.cpp
@@ -135,9 +135,13 @@ void reportException(ScriptState* scriptState, v8::TryCatch& exceptionCatcher)
 
     // There can be a situation that an exception is thrown without setting a message.
     v8::Local<v8::Message> message = exceptionCatcher.Message();
-    if (message.IsEmpty())
-        errorMessage = toWebCoreString(exceptionCatcher.Exception()->ToString());
-    else {
+    if (message.IsEmpty()) {
+        v8::Local<v8::String> exceptionString = exceptionCatcher.Exception()->ToString();
+        // Conversion of the exception object to string can fail if an
+        // exception is thrown during conversion.
+        if (!exceptionString.IsEmpty())
+            errorMessage = toWebCoreString(exceptionString);
+    } else {
         errorMessage = toWebCoreString(message->Get());
         lineNumber = message->GetLineNumber();
         sourceURL = toWebCoreString(message->GetScriptResourceName());
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 24e493c..79911ae 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -36,18 +36,28 @@
 
 #include "Event.h"
 #include "V8Binding.h"
+<<<<<<< HEAD:WebCore/bindings/v8/V8WorkerContextEventListener.cpp
 #include "V8Utilities.h"
+=======
+#include "WorkerContext.h"
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/V8WorkerContextEventListener.cpp
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
-V8WorkerContextEventListener::V8WorkerContextEventListener(WorkerContextExecutionProxy* proxy, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(0, guard, listener, isInline)
-    , m_proxy(proxy)
+static WorkerContextExecutionProxy* workerProxy(ScriptExecutionContext* context)
 {
+    ASSERT(context->isWorkerContext());
+    WorkerContext* workerContext = static_cast<WorkerContext*>(context);
+    return workerContext->script()->proxy();
 }
 
-void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext*, Event* event)
+V8WorkerContextEventListener::V8WorkerContextEventListener(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
+    : V8EventListener(guard, listener, isInline)
+{
+}
+
+void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
     // Is the EventListener disconnected?
     if (disconnected())
@@ -60,12 +70,16 @@ void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext*, Event* e
     LOCK_V8;
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> context = m_proxy->context();
-    if (context.IsEmpty())
+    WorkerContextExecutionProxy* proxy = workerProxy(context);
+    if (!proxy)
+        return;
+
+    v8::Handle<v8::Context> v8Context = proxy->context();
+    if (v8Context.IsEmpty())
         return;
 
     // Enter the V8 context in which to perform the event handling.
-    v8::Context::Scope scope(context);
+    v8::Context::Scope scope(v8Context);
 
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = WorkerContextExecutionProxy::convertEventToV8Object(event);
@@ -73,7 +87,7 @@ void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext*, Event* e
     invokeEventHandler(context, event, jsEvent);
 }
 
-bool V8WorkerContextEventListener::reportError(const String& message, const String& url, int lineNumber)
+bool V8WorkerContextEventListener::reportError(ScriptExecutionContext* context, const String& message, const String& url, int lineNumber)
 {
     // Is the EventListener disconnected?
     if (disconnected())
@@ -84,14 +98,18 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
 
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> context = m_proxy->context();
-    if (context.IsEmpty())
+    WorkerContextExecutionProxy* proxy = workerProxy(context);
+    if (!proxy)
+        return false;
+
+    v8::Handle<v8::Context> v8Context = proxy->context();
+    if (v8Context.IsEmpty())
         return false;
 
     // Enter the V8 context in which to perform the event handling.
-    v8::Context::Scope scope(context);
+    v8::Context::Scope scope(v8Context);
 
-    v8::Local<v8::Object> listener = getListenerObject();
+    v8::Local<v8::Object> listener = getListenerObject(context);
     v8::Local<v8::Value> returnValue;
     {
         // Catch exceptions thrown in calling the function so they do not propagate to javascript code that caused the event to fire.
@@ -120,24 +138,25 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
     return errorHandled;
 }
 
-v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
+v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)
 {
-    v8::Local<v8::Function> handlerFunction = getListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event);
+    v8::Local<v8::Function> handlerFunction = getListenerFunction(context);
+    v8::Local<v8::Object> receiver = getReceiverObject(context, event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
     v8::Local<v8::Value> result = handlerFunction->Call(receiver, 1, parameters);
 
-    m_proxy->trackEvent(event);
+    if (WorkerContextExecutionProxy* proxy = workerProxy(context))
+        proxy->trackEvent(event);
 
     return result;
 }
 
-v8::Local<v8::Object> V8WorkerContextEventListener::getReceiverObject(Event* event)
+v8::Local<v8::Object> V8WorkerContextEventListener::getReceiverObject(ScriptExecutionContext* context, Event* event)
 {
-    v8::Local<v8::Object> listener = getListenerObject();
+    v8::Local<v8::Object> listener = getListenerObject(context);
 
     if (!listener.IsEmpty() && !listener->IsFunction())
         return listener;
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.h b/WebCore/bindings/v8/V8WorkerContextEventListener.h
index 3752533..3f9f862 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.h
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.h
@@ -44,22 +44,19 @@ namespace WebCore {
 
     class V8WorkerContextEventListener : public V8EventListener {
     public:
-        static PassRefPtr<V8WorkerContextEventListener> create(WorkerContextExecutionProxy* proxy, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
+        static PassRefPtr<V8WorkerContextEventListener> create(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
         {
-            return adoptRef(new V8WorkerContextEventListener(proxy, guard, listener, isInline));
+            return adoptRef(new V8WorkerContextEventListener(guard, listener, isInline));
         }
 
         virtual void handleEvent(ScriptExecutionContext*, Event*);
-        virtual bool reportError(const String& message, const String& url, int lineNumber);
-
-        WorkerContextExecutionProxy* proxy() const { return m_proxy; }
+        virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
 
     private:
-        V8WorkerContextEventListener(WorkerContextExecutionProxy*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isInline);
+        V8WorkerContextEventListener(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isInline);
 
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
-        v8::Local<v8::Object> getReceiverObject(Event*);
-        WorkerContextExecutionProxy* m_proxy;
+        virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
+        v8::Local<v8::Object> getReceiverObject(ScriptExecutionContext*, Event*);
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index 90c1f6f..128f486 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -43,6 +43,8 @@
 #include "EventException.h"
 #include "MessagePort.h"
 #include "RangeException.h"
+#include "SharedWorker.h"
+#include "SharedWorkerContext.h"
 #include "V8Binding.h"
 #include "V8DOMMap.h"
 #include "V8Index.h"
@@ -126,10 +128,18 @@ void WorkerContextExecutionProxy::initV8IfNeeded()
     v8::V8::IgnoreOutOfMemoryException();
     v8::V8::SetFatalErrorHandler(reportFatalErrorInV8);
 
+<<<<<<< HEAD:WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
 #if PLATFORM(ANDROID)
     const int workerThreadPreemptionIntervalMs = 5;
     v8::Locker::StartPreemption(workerThreadPreemptionIntervalMs);
 #endif
+=======
+    v8::ResourceConstraints resource_constraints;
+    uint32_t here;
+    resource_constraints.set_stack_limit(&here - kWorkerMaxStackSize / sizeof(uint32_t*));
+    v8::SetResourceConstraints(&resource_constraints);
+
+>>>>>>> webkit.org at r50258.:WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
     v8Initialized = true;
 }
 
@@ -405,7 +415,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
 
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
 {
-    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(this, m_listenerGuard, object, isInline);
+    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(m_listenerGuard, object, isInline);
 }
 
 void WorkerContextExecutionProxy::trackEvent(Event* event)
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index a08395c..e723bc6 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -107,6 +107,8 @@ namespace WebCore {
 
         static bool forgetV8EventObject(Event*);
 
+        static const int kWorkerMaxStackSize = 500 * 1024;
+
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
         int m_recursion;
diff --git a/WebCore/bindings/v8/custom/V8CustomBinding.h b/WebCore/bindings/v8/custom/V8CustomBinding.h
index 82ce1c1..7781fbc 100644
--- a/WebCore/bindings/v8/custom/V8CustomBinding.h
+++ b/WebCore/bindings/v8/custom/V8CustomBinding.h
@@ -78,6 +78,8 @@ struct NPObject;
     bool V8Custom::v8##NAME##IndexedSecurityCheck(v8::Local<v8::Object> host, \
         uint32_t index, v8::AccessType type, v8::Local<v8::Value> data)
 
+#define ACCESSOR_RUNTIME_ENABLER(NAME) bool V8Custom::v8##NAME##Enabled()
+
 namespace WebCore {
 
     class DOMWindow;
@@ -122,17 +124,25 @@ namespace WebCore {
         static const int kMessagePortInternalFieldCount = kDefaultWrapperInternalFieldCount + 2;
 
 #if ENABLE(WORKERS)
-        static const int kWorkerRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
-        static const int kWorkerInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+        static const int kAbstractWorkerRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kAbstractWorkerInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+
+        static const int kWorkerRequestCacheIndex = kAbstractWorkerInternalFieldCount + 0;
+        static const int kWorkerInternalFieldCount = kAbstractWorkerInternalFieldCount + 1;
 
         static const int kWorkerContextRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kWorkerContextMinimumInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 
         static const int kDedicatedWorkerContextRequestCacheIndex = kWorkerContextMinimumInternalFieldCount + 0;
         static const int kDedicatedWorkerContextInternalFieldCount = kWorkerContextMinimumInternalFieldCount + 1;
+#endif
 
-        static const int kAbstractWorkerRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
-        static const int kAbstractWorkerInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#if ENABLE(SHARED_WORKERS)
+        static const int kSharedWorkerRequestCacheIndex = kAbstractWorkerInternalFieldCount + 0;
+        static const int kSharedWorkerInternalFieldCount = kAbstractWorkerInternalFieldCount + 1;
+
+        static const int kSharedWorkerContextRequestCacheIndex = kWorkerContextMinimumInternalFieldCount + 0;
+        static const int kSharedWorkerContextInternalFieldCount = kWorkerContextMinimumInternalFieldCount + 1;
 #endif
 
 #if ENABLE(NOTIFICATIONS)
@@ -232,6 +242,8 @@ namespace WebCore {
     static bool v8##NAME##IndexedSecurityCheck(v8::Local<v8::Object> host, \
         uint32_t index, v8::AccessType type, v8::Local<v8::Value> data)
 
+#define DECLARE_ACCESSOR_RUNTIME_ENABLER(NAME) static bool v8##NAME##Enabled()
+
         DECLARE_PROPERTY_ACCESSOR(CanvasRenderingContext2DStrokeStyle);
         DECLARE_PROPERTY_ACCESSOR(CanvasRenderingContext2DFillStyle);
         DECLARE_PROPERTY_ACCESSOR(DOMWindowEvent);
@@ -241,6 +253,11 @@ namespace WebCore {
 
 #if ENABLE(VIDEO)
         DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowAudio);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowAudio);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowHTMLMediaElement);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowHTMLAudioElement);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowHTMLVideoElement);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowMediaError);
 #endif
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowImage);
@@ -280,6 +297,10 @@ namespace WebCore {
         DECLARE_CALLBACK(HTMLCollectionNamedItem);
         DECLARE_CALLBACK(HTMLCollectionCallAsFunction);
 
+        DECLARE_CALLBACK(HTMLAllCollectionItem);
+        DECLARE_CALLBACK(HTMLAllCollectionNamedItem);
+        DECLARE_CALLBACK(HTMLAllCollectionCallAsFunction);
+
         DECLARE_CALLBACK(HTMLSelectElementRemove);
 
         DECLARE_CALLBACK(HTMLOptionsCollectionRemove);
@@ -448,7 +469,6 @@ namespace WebCore {
         DECLARE_CALLBACK(TreeWalkerNextSibling);
         DECLARE_CALLBACK(TreeWalkerPreviousSibling);
 
-        DECLARE_CALLBACK(InspectorBackendProfiles);
         DECLARE_CALLBACK(InspectorBackendHighlightDOMNode);
         DECLARE_CALLBACK(InspectorBackendAddResourceSourceToFrame);
         DECLARE_CALLBACK(InspectorBackendAddSourceToFrame);
@@ -505,6 +525,7 @@ namespace WebCore {
         DECLARE_INDEXED_PROPERTY_SETTER(HTMLOptionsCollection);
         DECLARE_NAMED_PROPERTY_GETTER(HTMLSelectElementCollection);
         DECLARE_INDEXED_PROPERTY_SETTER(HTMLSelectElementCollection);
+        DECLARE_NAMED_PROPERTY_GETTER(HTMLAllCollection);
         DECLARE_NAMED_PROPERTY_GETTER(HTMLCollection);
 
 #if ENABLE(3D_CANVAS)
@@ -553,14 +574,20 @@ namespace WebCore {
 
         DECLARE_INDEXED_PROPERTY_GETTER(ClientRectList);
         DECLARE_INDEXED_PROPERTY_GETTER(FileList);
-  
+
 #if ENABLE(DATAGRID)
         DECLARE_PROPERTY_ACCESSOR(HTMLDataGridElementDataSource);
         DECLARE_INDEXED_PROPERTY_GETTER(DataGridColumnList);
         DECLARE_NAMED_PROPERTY_GETTER(DataGridColumnList);
-#endif      
+#endif
+
+#if ENABLE(DATABASE)
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowOpenDatabase);
+#endif
 
 #if ENABLE(DOM_STORAGE)
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowLocalStorage);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowSessionStorage);
         DECLARE_INDEXED_PROPERTY_GETTER(Storage);
         DECLARE_INDEXED_PROPERTY_SETTER(Storage);
         DECLARE_INDEXED_PROPERTY_DELETER(Storage);
@@ -604,6 +631,10 @@ namespace WebCore {
         DECLARE_CALLBACK(WorkerContextClearInterval);
         DECLARE_CALLBACK(WorkerContextAddEventListener);
         DECLARE_CALLBACK(WorkerContextRemoveEventListener);
+
+#if ENABLE(NOTIFICATIONS)
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(WorkerContextWebkitNotifications);
+#endif
 #endif // ENABLE(WORKERS)
 
 #if ENABLE(NOTIFICATIONS)
@@ -624,6 +655,11 @@ namespace WebCore {
 
 #if ENABLE(SHARED_WORKERS)
         DECLARE_CALLBACK(SharedWorkerConstructor);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowSharedWorker);
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowWebkitNotifications);
 #endif
 
         DECLARE_CALLBACK(GeolocationGetCurrentPosition);
@@ -638,8 +674,11 @@ namespace WebCore {
         DECLARE_PROPERTY_ACCESSOR(WebSocketOnmessage);
         DECLARE_PROPERTY_ACCESSOR(WebSocketOnclose);
         DECLARE_CALLBACK(WebSocketConstructor);
+        DECLARE_CALLBACK(WebSocketAddEventListener);
+        DECLARE_CALLBACK(WebSocketRemoveEventListener);
         DECLARE_CALLBACK(WebSocketSend);
         DECLARE_CALLBACK(WebSocketClose);
+        DECLARE_ACCESSOR_RUNTIME_ENABLER(DOMWindowWebSocket);
 #endif
 
 #undef DECLARE_INDEXED_ACCESS_CHECK
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
index 91abecd..17c86a3 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
@@ -35,15 +35,15 @@
 
 namespace WebCore {
 
-V8EventListener::V8EventListener(Frame* frame, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
-    : V8AbstractEventListener(frame, guard, isAttribute)
+V8EventListener::V8EventListener(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
+    : V8AbstractEventListener(guard, isAttribute)
 {
     setListenerObject(listener);
 }
 
-v8::Local<v8::Function> V8EventListener::getListenerFunction()
+v8::Local<v8::Function> V8EventListener::getListenerFunction(ScriptExecutionContext* context)
 {
-    v8::Local<v8::Object> listener = getListenerObject();
+    v8::Local<v8::Object> listener = getListenerObject(context);
 
     // Has the listener been disposed?
     if (listener.IsEmpty())
@@ -61,19 +61,20 @@ v8::Local<v8::Function> V8EventListener::getListenerFunction()
     return v8::Local<v8::Function>();
 }
 
-v8::Local<v8::Value> V8EventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
+v8::Local<v8::Value> V8EventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)
 {
-    v8::Local<v8::Function> handlerFunction = getListenerFunction();
+
+    v8::Local<v8::Function> handlerFunction = getListenerFunction(context);
     v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    V8Proxy* proxy = V8Proxy::retrieve(frame());
-    if (!proxy)
-        return v8::Local<v8::Value>();
-    return proxy->callFunction(handlerFunction, receiver, 1, parameters);
+    if (V8Proxy* proxy = V8Proxy::retrieve(context))
+        return proxy->callFunction(handlerFunction, receiver, 1, parameters);
+
+    return v8::Local<v8::Value>();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.h b/WebCore/bindings/v8/custom/V8CustomEventListener.h
index e34f24f..dc9d33b 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.h
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.h
@@ -44,18 +44,18 @@ namespace WebCore {
     // that can handle the event.
     class V8EventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8EventListener> create(Frame* frame, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
+        static PassRefPtr<V8EventListener> create(PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
         {
-            return adoptRef(new V8EventListener(frame, guard, listener, isAttribute));
+            return adoptRef(new V8EventListener(guard, listener, isAttribute));
         }
 
     protected:
-        V8EventListener(Frame*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isAttribute);
+        V8EventListener(PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isAttribute);
 
-        v8::Local<v8::Function> getListenerFunction();
+        v8::Local<v8::Function> getListenerFunction(ScriptExecutionContext*);
 
     private:
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
+      virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
      };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 0dc5a96..7eccfb1 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -45,12 +45,18 @@
 #include "FrameLoadRequest.h"
 #include "FrameView.h"
 #include "HTMLCollection.h"
+#include "MediaPlayer.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScheduledAction.h"
 #include "ScriptSourceCode.h"
 #include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "SharedWorkerRepository.h"
+#include "Storage.h"
+#include "WebSocket.h"
 #include "WindowFeatures.h"
 
 // Horizontal and vertical offset, from the parent content area, around newly
@@ -235,6 +241,71 @@ ACCESSOR_GETTER(DOMWindowAudio)
     return V8DOMWrapper::getConstructor(V8ClassIndex::AUDIO, window);
 }
 
+ACCESSOR_RUNTIME_ENABLER(DOMWindowAudio)
+{
+    return MediaPlayer::isAvailable();
+}
+
+ACCESSOR_RUNTIME_ENABLER(DOMWindowHTMLMediaElement)
+{
+    return MediaPlayer::isAvailable();
+}
+
+ACCESSOR_RUNTIME_ENABLER(DOMWindowHTMLAudioElement)
+{
+    return MediaPlayer::isAvailable();
+}
+
+ACCESSOR_RUNTIME_ENABLER(DOMWindowHTMLVideoElement)
+{
+    return MediaPlayer::isAvailable();
+}
+
+ACCESSOR_RUNTIME_ENABLER(DOMWindowMediaError)
+{
+    return MediaPlayer::isAvailable();
+}
+
+#endif
+
+#if ENABLE(SHARED_WORKERS)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowSharedWorker)
+{
+    return SharedWorkerRepository::isAvailable();
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowWebSocket)
+{
+    return WebSocket::isAvailable();
+}
+#endif
+
+#if ENABLE(DATABASE)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowOpenDatabase)
+{
+    return WebCore::RuntimeEnabledFeatures::databaseEnabled();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowLocalStorage)
+{
+    return RuntimeEnabledFeatures::localStorageEnabled();
+}
+
+ACCESSOR_RUNTIME_ENABLER(DOMWindowSessionStorage)
+{
+    return RuntimeEnabledFeatures::sessionStorageEnabled();
+}
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+ACCESSOR_RUNTIME_ENABLER(DOMWindowWebkitNotifications)
+{
+    return NotificationCenter::isAvailable();
+}
 #endif
 
 ACCESSOR_GETTER(DOMWindowImage)
diff --git a/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
new file mode 100644
index 0000000..419f374
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTMLAllCollection.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8NamedNodesCollection.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+static v8::Handle<v8::Value> getNamedItems(HTMLAllCollection* collection, AtomicString name)
+{
+    Vector<RefPtr<Node> > namedItems;
+    collection->namedItems(name, namedItems);
+
+    if (!namedItems.size())
+        return v8::Handle<v8::Value>();
+
+    if (namedItems.size() == 1)
+        return V8DOMWrapper::convertNodeToV8Object(namedItems.at(0).release());
+
+    NodeList* list = new V8NamedNodesCollection(namedItems);
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODELIST, list);
+}
+
+static v8::Handle<v8::Value> getItem(HTMLAllCollection* collection, v8::Handle<v8::Value> argument)
+{
+    v8::Local<v8::Uint32> index = argument->ToArrayIndex();
+    if (index.IsEmpty()) {
+        v8::Handle<v8::Value> result = getNamedItems(collection, toWebCoreString(argument->ToString()));
+
+        if (result.IsEmpty())
+            return v8::Undefined();
+
+        return result;
+    }
+
+    RefPtr<Node> result = collection->item(index->Uint32Value());
+    return V8DOMWrapper::convertNodeToV8Object(result.release());
+}
+
+NAMED_PROPERTY_GETTER(HTMLAllCollection)
+{
+    INC_STATS("DOM.HTMLAllCollection.NamedPropertyGetter");
+    // Search the prototype chain first.
+    v8::Handle<v8::Value> value = info.Holder()->GetRealNamedPropertyInPrototypeChain(name);
+
+    if (!value.IsEmpty())
+        return value;
+
+    // Search local callback properties next to find IDL defined
+    // properties.
+    if (info.Holder()->HasRealNamedCallbackProperty(name))
+        return v8::Handle<v8::Value>();
+
+    // Finally, search the DOM structure.
+    HTMLAllCollection* imp = V8DOMWrapper::convertToNativeObject<HTMLAllCollection>(V8ClassIndex::HTMLALLCOLLECTION, info.Holder());
+    return getNamedItems(imp, v8StringToAtomicWebCoreString(name));
+}
+
+CALLBACK_FUNC_DECL(HTMLAllCollectionItem)
+{
+    INC_STATS("DOM.HTMLAllCollection.item()");
+    HTMLAllCollection* imp = V8DOMWrapper::convertToNativeObject<HTMLAllCollection>(V8ClassIndex::HTMLALLCOLLECTION, args.Holder());
+    return getItem(imp, args[0]);
+}
+
+CALLBACK_FUNC_DECL(HTMLAllCollectionNamedItem)
+{
+    INC_STATS("DOM.HTMLAllCollection.namedItem()");
+    HTMLAllCollection* imp = V8DOMWrapper::convertToNativeObject<HTMLAllCollection>(V8ClassIndex::HTMLALLCOLLECTION, args.Holder());
+    v8::Handle<v8::Value> result = getNamedItems(imp, toWebCoreString(args[0]));
+
+    if (result.IsEmpty())
+        return v8::Undefined();
+
+    return result;
+}
+
+CALLBACK_FUNC_DECL(HTMLAllCollectionCallAsFunction)
+{
+    INC_STATS("DOM.HTMLAllCollection.callAsFunction()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    HTMLAllCollection* imp = V8DOMWrapper::convertToNativeObject<HTMLAllCollection>(V8ClassIndex::HTMLALLCOLLECTION, args.Holder());
+
+    if (args.Length() == 1)
+        return getItem(imp, args[0]);
+
+    // If there is a second argument it is the index of the item we want.
+    String name = toWebCoreString(args[0]);
+    v8::Local<v8::Uint32> index = args[1]->ToArrayIndex();
+    if (index.IsEmpty())
+        return v8::Undefined();
+
+    unsigned current = index->Uint32Value();
+    Node* node = imp->namedItem(name);
+    while (node) {
+        if (!current)
+            return V8DOMWrapper::convertNodeToV8Object(node);
+
+        node = imp->nextNamedItem(name);
+        current--;
+    }
+
+    return v8::Undefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
index c735c49..c82d88a 100644
--- a/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
@@ -81,8 +81,11 @@ CALLBACK_FUNC_DECL(HTMLAudioElementConstructor)
     V8DOMWrapper::convertNodeToV8Object(document);
 
     RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
-    if (args.Length() > 0)
+    audio->setAutobuffer(true);
+    if (args.Length() > 0) {
         audio->setSrc(toWebCoreString(args[0]));
+        audio->scheduleLoad();
+    }
 
     V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::NODE), audio.get());
     audio->ref();
diff --git a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index a0c3d74..afc9ed1 100644
--- a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -32,6 +32,7 @@
 #include "HTMLDocument.h"
 
 #include "Frame.h"
+#include "HTMLAllCollection.h"
 #include "HTMLCollection.h"
 #include "HTMLIFrameElement.h"
 #include "HTMLNames.h"
diff --git a/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp b/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
index e470bc8..de53ac7 100644
--- a/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
@@ -38,7 +38,6 @@
 #include "Frame.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
@@ -53,7 +52,7 @@ CALLBACK_FUNC_DECL(SharedWorkerConstructor)
     if (!args.IsConstructCall())
         return throwError("DOM object constructor cannot be called as a function.");
 
-    if (args.Length() < 1)
+    if (!args.Length())
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
     v8::TryCatch tryCatch;
@@ -73,17 +72,19 @@ CALLBACK_FUNC_DECL(SharedWorkerConstructor)
     if (!context)
         return v8::Undefined();
 
-    // Create the worker object.
+    // Create the SharedWorker object.
     // Note: it's OK to let this RefPtr go out of scope because we also call SetDOMWrapper(), which effectively holds a reference to obj.
     ExceptionCode ec = 0;
     RefPtr<SharedWorker> obj = SharedWorker::create(toWebCoreString(scriptUrl), name, context, ec);
+    if (ec)
+        return throwError(ec);
 
     // Setup the standard wrapper object internal fields.
     v8::Handle<v8::Object> wrapperObject = args.Holder();
-    V8Proxy::setDOMWrapper(wrapperObject, V8ClassIndex::SHAREDWORKER, obj.get());
+    V8DOMWrapper::setDOMWrapper(wrapperObject, V8ClassIndex::SHAREDWORKER, obj.get());
 
     obj->ref();
-    V8Proxy::setJSWrapperForActiveDOMObject(obj.get(), v8::Persistent<v8::Object>::New(wrapperObject));
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(obj.get(), v8::Persistent<v8::Object>::New(wrapperObject));
 
     return wrapperObject;
 }
diff --git a/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
index f498e4f..b20635b 100644
--- a/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -44,7 +44,36 @@
 
 namespace WebCore {
 
-// ??? AddEventListener, RemoveEventListener
+CALLBACK_FUNC_DECL(WebSocketAddEventListener)
+{
+    INC_STATS("DOM.WebSocket.addEventListener()");
+    WebSocket* webSocket = V8DOMWrapper::convertToNativeObject<WebSocket>(V8ClassIndex::WEBSOCKET, args.Holder());
+
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(webSocket, args[1], false, ListenerFindOrCreate);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        webSocket->addEventListener(type, listener, useCapture);
+
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kWebSocketCacheIndex);
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(WebSocketRemoveEventListener)
+{
+    INC_STATS("DOM.WebSocket.removeEventListener()");
+    WebSocket* webSocket = V8DOMWrapper::convertToNativeObject<WebSocket>(V8ClassIndex::WEBSOCKET, args.Holder());
+
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(webSocket, args[1], false, ListenerFindOnly);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        webSocket->removeEventListener(type, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kWebSocketCacheIndex);
+    }
+    return v8::Undefined();
+}
 
 CALLBACK_FUNC_DECL(WebSocketConstructor)
 {
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 21b3c30..36c7001 100755
--- a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -34,6 +34,7 @@
 
 #include "DOMTimer.h"
 #include "ExceptionCode.h"
+#include "NotificationCenter.h"
 #include "ScheduledAction.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -45,6 +46,13 @@
 
 namespace WebCore {
 
+#if ENABLE(NOTIFICATIONS)
+ACCESSOR_RUNTIME_ENABLER(WorkerContextWebkitNotifications)
+{
+    return NotificationCenter::isAvailable();
+}
+#endif
+
 ACCESSOR_GETTER(WorkerContextSelf)
 {
     INC_STATS(L"DOM.WorkerContext.self._get");
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 39105de..c3e4645 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -46,11 +46,9 @@ namespace WebCore {
 
 ACCESSOR_GETTER(XMLHttpRequestResponseText)
 {
-    // FIXME: This is only needed because webkit set this getter as custom.
-    // So we need a custom method to avoid forking the IDL file.
     INC_STATS("DOM.XMLHttpRequest.responsetext._get");
     XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    return v8StringOrNull(xmlHttpRequest->responseText());
+    return xmlHttpRequest->responseText().v8StringOrNull();
 }
 
 CALLBACK_FUNC_DECL(XMLHttpRequestAddEventListener)
diff --git a/WebCore/bridge/NP_jsobject.cpp b/WebCore/bridge/NP_jsobject.cpp
index 4a6a2b1..76e2738 100644
--- a/WebCore/bridge/NP_jsobject.cpp
+++ b/WebCore/bridge/NP_jsobject.cpp
@@ -37,6 +37,7 @@
 #include "c_utility.h"
 #include "c_instance.h"
 #include "IdentifierRep.h"
+#include "JSDOMBinding.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "runtime_root.h"
@@ -126,7 +127,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = call(exec, function, callType, callData, function, argList);
+        JSValue resultV = callInWorld(exec, function, callType, callData, function, argList, pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -176,7 +177,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = call(exec, function, callType, callData, obj->imp, argList);
+        JSValue resultV = callInWorld(exec, function, callType, callData, obj->imp, argList, pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
@@ -206,7 +207,7 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString));
+        Completion completion = evaluateInWorld(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString), JSC::JSValue(), pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
@@ -456,7 +457,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
         globalObject->globalData()->timeoutChecker.start();
-        JSValue resultV = construct(exec, constructor, constructType, constructData, argList);
+        JSValue resultV = constructInWorld(exec, constructor, constructType, constructData, argList, pluginWorld());
         globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
diff --git a/WebCore/bridge/c/c_instance.cpp b/WebCore/bridge/c/c_instance.cpp
index 6ce6572..7db19b6 100644
--- a/WebCore/bridge/c/c_instance.cpp
+++ b/WebCore/bridge/c/c_instance.cpp
@@ -121,18 +121,25 @@ JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, c
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+<<<<<<< HEAD:WebCore/bridge/c/c_instance.cpp
 #ifdef ANDROID_NPN_SETEXCEPTION
     SetGlobalException(0);
 #endif
+=======
+    bool retval = true;
+>>>>>>> webkit.org at r50258.:WebCore/bridge/c/c_instance.cpp
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
 
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -159,17 +166,24 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+<<<<<<< HEAD:WebCore/bridge/c/c_instance.cpp
 #ifdef ANDROID_NPN_SETEXCEPTION
     SetGlobalException(0);
 #endif
+=======
+    bool retval = true;
+>>>>>>> webkit.org at r50258.:WebCore/bridge/c/c_instance.cpp
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -200,14 +214,18 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
         convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
+    bool retval = true;
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
         ASSERT(globalExceptionString().isNull());
-        _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
+        retval = _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
     }
+    
+    if (!retval)
+        throwError(exec, GeneralError, "Error calling method on NPObject!");
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
diff --git a/WebCore/bridge/jni/jni_jsobject.mm b/WebCore/bridge/jni/jni_jsobject.mm
index eb4a6bd..cc28a75 100644
--- a/WebCore/bridge/jni/jni_jsobject.mm
+++ b/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,6 +29,7 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
@@ -302,7 +303,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
+    JSValue result = WebCore::callInWorld(exec, function, callType, callData, _imp, argList, WebCore::pluginWorld());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
@@ -321,7 +322,7 @@ jobject JavaJSObject::eval(jstring script) const
         return 0;
 
     rootObject->globalObject()->globalData()->timeoutChecker.start();
-    Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)));
+    Completion completion = WebCore::evaluateInWorld(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)), JSC::JSValue(), WebCore::pluginWorld());
     rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
diff --git a/WebCore/bridge/npapi.h b/WebCore/bridge/npapi.h
index af54acd..41f9bda 100644
--- a/WebCore/bridge/npapi.h
+++ b/WebCore/bridge/npapi.h
@@ -56,6 +56,12 @@
 #    endif /* XP_WIN */
 #endif /* _WIN32 */
 
+#ifdef __SYMBIAN32__
+#   ifndef XP_SYMBIAN
+#       define XP_SYMBIAN 1
+#   endif
+#endif  /* __SYMBIAN32__ */
+
 #ifdef __MWERKS__
 #    define _declspec __declspec
 #    ifdef macintosh
@@ -64,20 +70,15 @@
 #        endif /* XP_MAC */
 #    endif /* macintosh */
 #    ifdef __INTEL__
-#        undef NULL
-#        ifndef XP_WIN
-#            define XP_WIN 1
-#        endif /* __INTEL__ */
-#    endif /* XP_PC */
+#       ifndef XP_SYMBIAN
+#           undef NULL
+#           ifndef XP_WIN
+#               define XP_WIN 1
+#           endif /* XP_WIN */
+#       endif /* XP_SYMBIAN */
+#    endif /* __INTEL__ */
 #endif /* __MWERKS__ */
 
-#ifdef __SYMBIAN32__
-#   ifndef XP_SYMBIAN
-#       define XP_SYMBIAN 1
-#       undef XP_WIN
-#   endif
-#endif  /* __SYMBIAN32__ */
-
 #if defined(__APPLE_CC__) && !defined(__MACOS_CLASSIC__) && !defined(XP_UNIX)
 #   define XP_MACOSX
 #endif
@@ -106,6 +107,11 @@
     #include <stdio.h>
 #endif
 
+#if defined(XP_SYMBIAN)
+    #include <QEvent>
+    #include <QRegion>
+#endif
+
 #ifdef XP_WIN
     #include <windows.h>
 #endif
@@ -535,9 +541,9 @@ typedef struct _NPWindow
     uint32    height;
     NPRect    clipRect;    /* Clipping rectangle in port coordinates */
                         /* Used by MAC only.              */
-#ifdef XP_UNIX
+#if defined(XP_UNIX) || defined(XP_SYMBIAN)
     void *    ws_info;    /* Platform-dependent additonal data */
-#endif /* XP_UNIX */
+#endif /* XP_UNIX || XP_SYMBIAN */
     NPWindowType type;    /* Is this a window or a drawable? */
 } NPWindow;
 
@@ -587,6 +593,8 @@ typedef enum {
 typedef EventRecord    NPEvent;
 #endif
 
+#elif defined(XP_SYMBIAN)
+typedef QEvent NPEvent;
 #elif defined(XP_WIN)
 typedef struct _NPEvent
 {
@@ -617,6 +625,8 @@ typedef CGPathRef NPCGRegion;
 typedef HRGN NPRegion;
 #elif defined(XP_UNIX)
 typedef Region NPRegion;
+#elif defined(XP_SYMBIAN)
+typedef QRegion* NPRegion;
 #else
 typedef void *NPRegion;
 #endif /* XP_MAC */
diff --git a/WebCore/bridge/objc/objc_instance.mm b/WebCore/bridge/objc/objc_instance.mm
index f7550e4..9f2e3bb 100644
--- a/WebCore/bridge/objc/objc_instance.mm
+++ b/WebCore/bridge/objc/objc_instance.mm
@@ -28,9 +28,10 @@
 
 #import "FoundationExtras.h"
 #import "WebScriptObject.h"
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-#include <wtf/Assertions.h>
+#import <objc/objc-auto.h>
+#import <runtime/Error.h>
+#import <runtime/JSLock.h>
+#import <wtf/Assertions.h>
 
 #ifdef NDEBUG
 #define OBJC_LOG(formatAndArgs...) ((void)0)
@@ -123,10 +124,22 @@ ObjcInstance::~ObjcInstance()
     [pool drain];
 }
 
+static NSAutoreleasePool* allocateAutoReleasePool()
+{
+#if defined(OBJC_API_VERSION) && OBJC_API_VERSION >= 2
+    // If GC is enabled an autorelease pool is unnecessary, and the
+    // pool cannot be protected from GC so may be collected leading
+    // to a crash when we try to drain the release pool.
+    if (objc_collectingEnabled())
+        return nil;
+#endif
+    return [[NSAutoreleasePool alloc] init];
+}
+
 void ObjcInstance::virtualBegin()
 {
     if (!_pool)
-        _pool = [[NSAutoreleasePool alloc] init];
+        _pool = allocateAutoReleasePool();
     _beginCount++;
 }
 
diff --git a/WebCore/bridge/objc/objc_runtime.h b/WebCore/bridge/objc/objc_runtime.h
index 7c772a6..63f3254 100644
--- a/WebCore/bridge/objc/objc_runtime.h
+++ b/WebCore/bridge/objc/objc_runtime.h
@@ -104,10 +104,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | JSObject::StructureFlags;
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 3cb2156..6887325 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -458,7 +458,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
                 WTF::GregorianDateTime gdt;
-                date->getUTCTime(gdt);
+                WTF::msToGregorianDateTime(date->internalNumber(), true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
                     dist = 0;
@@ -834,9 +834,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.isDST = -1;
         double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
 
-        DateInstance* instance = new (exec) DateInstance(exec->lexicalGlobalObject()->dateStructure());
-        instance->setInternalValue(jsNumber(exec, trunc(ms)));
-        return instance;
+        return new (exec) DateInstance(exec, trunc(ms));
     }
 
     if (type == QMetaType::QByteArray) {
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index edb577c..f2ce954 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -151,7 +151,7 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType,  OverridesGetOwnPropertySlot | OverridesMarkChildren));
     }
 
 protected:
diff --git a/WebCore/bridge/runtime_array.h b/WebCore/bridge/runtime_array.h
index f614f7f..1218b8c 100644
--- a/WebCore/bridge/runtime_array.h
+++ b/WebCore/bridge/runtime_array.h
@@ -59,10 +59,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
 
diff --git a/WebCore/bridge/runtime_method.h b/WebCore/bridge/runtime_method.h
index 3233ffa..9676048 100644
--- a/WebCore/bridge/runtime_method.h
+++ b/WebCore/bridge/runtime_method.h
@@ -47,10 +47,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 private:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | ImplementsHasInstance | OverridesMarkChildren | InternalFunction::StructureFlags;
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
diff --git a/WebCore/bridge/runtime_object.h b/WebCore/bridge/runtime_object.h
index f16778e..391e078 100644
--- a/WebCore/bridge/runtime_object.h
+++ b/WebCore/bridge/runtime_object.h
@@ -62,10 +62,11 @@ public:
 
     static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType));
+        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags));
     }
 
 protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesGetPropertyNames | JSObject::StructureFlags;
     RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
diff --git a/WebCore/bridge/runtime_root.h b/WebCore/bridge/runtime_root.h
index eacbb57..fdd73c4 100644
--- a/WebCore/bridge/runtime_root.h
+++ b/WebCore/bridge/runtime_root.h
@@ -31,8 +31,10 @@
 #endif
 #include <runtime/Protect.h>
 
+#include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace JSC {
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 34b93c1..65a6ecf 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -161,6 +161,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
+    CSSPropertyWebkitBackgroundSize,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
@@ -264,7 +265,8 @@ static const int computedProperties[] = {
     CSSPropertyTextAnchor,
     CSSPropertyWritingMode,
     CSSPropertyGlyphOrientationHorizontal,
-    CSSPropertyGlyphOrientationVertical
+    CSSPropertyGlyphOrientationVertical,
+    CSSPropertyWebkitShadow
 #endif
 #ifdef ANDROID_CSS_TAP_HIGHLIGHT_COLOR
     ,
@@ -274,24 +276,6 @@ static const int computedProperties[] = {
 
 const unsigned numComputedProperties = sizeof(computedProperties) / sizeof(computedProperties[0]);
 
-static PassRefPtr<CSSValue> valueForShadow(const ShadowData* shadow, CSSPropertyID propertyID)
-{
-    if (!shadow)
-        return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-
-    RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-    for (const ShadowData* s = shadow; s; s = s->next) {
-        RefPtr<CSSPrimitiveValue> x = CSSPrimitiveValue::create(s->x, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> y = CSSPrimitiveValue::create(s->y, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> blur = CSSPrimitiveValue::create(s->blur, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? 0 : CSSPrimitiveValue::create(s->spread, CSSPrimitiveValue::CSS_PX);
-        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style == Normal ? 0 : CSSPrimitiveValue::createIdentifier(CSSValueInset);
-        RefPtr<CSSPrimitiveValue> color = CSSPrimitiveValue::createColor(s->color.rgb());
-        list->prepend(ShadowValue::create(x.release(), y.release(), blur.release(), spread.release(), style.release(), color.release()));
-    }
-    return list.release();
-}
-
 static int valueForRepeatRule(int rule)
 {
     switch (rule) {
@@ -579,6 +563,26 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringK
     return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
 }
 
+PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForShadow(const ShadowData* shadow, int id) const
+{
+    if (!shadow)
+        return CSSPrimitiveValue::createIdentifier(CSSValueNone);
+
+    CSSPropertyID propertyID = static_cast<CSSPropertyID>(id);
+
+    RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+    for (const ShadowData* s = shadow; s; s = s->next) {
+        RefPtr<CSSPrimitiveValue> x = CSSPrimitiveValue::create(s->x, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> y = CSSPrimitiveValue::create(s->y, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> blur = CSSPrimitiveValue::create(s->blur, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? 0 : CSSPrimitiveValue::create(s->spread, CSSPrimitiveValue::CSS_PX);
+        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style == Normal ? 0 : CSSPrimitiveValue::createIdentifier(CSSValueInset);
+        RefPtr<CSSPrimitiveValue> color = CSSPrimitiveValue::createColor(s->color.rgb());
+        list->prepend(ShadowValue::create(x.release(), y.release(), blur.release(), spread.release(), style.release(), color.release()));
+    }
+    return list.release();
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID) const
 {
     return getPropertyCSSValue(propertyID, UpdateLayout);
@@ -688,7 +692,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->backgroundImage())
                 return style->backgroundImage()->cssValue();
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-        case CSSPropertyBackgroundSize: {
+        case CSSPropertyBackgroundSize:
+        case CSSPropertyWebkitBackgroundSize: {
             EFillSizeType size = style->backgroundSizeType();
             if (size == Contain)
                 return CSSPrimitiveValue::createIdentifier(CSSValueContain);
@@ -789,7 +794,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitBoxReflect:
             return valueForReflection(style->boxReflect());
         case CSSPropertyWebkitBoxShadow:
-            return valueForShadow(style->boxShadow(), static_cast<CSSPropertyID>(propertyID));
+            return valueForShadow(style->boxShadow(), propertyID);
         case CSSPropertyCaptionSide:
             return CSSPrimitiveValue::create(style->captionSide());
         case CSSPropertyClear:
@@ -922,7 +927,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 // for how high to be in pixels does include things like minimum font size and the zoom factor.
                 // On the other hand, since font-size doesn't include the zoom factor, we really can't do
                 // that here either.
-                return CSSPrimitiveValue::create(static_cast<int>(length.percent() * style->fontDescription().specifiedSize()) / 100, CSSPrimitiveValue::CSS_PX);
+                // The line height returned is rounded to the nearest integer.
+                return CSSPrimitiveValue::create(length.calcMinValue(style->fontDescription().specifiedSize(), true), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(length.value(), CSSPrimitiveValue::CSS_PX);
         }
         case CSSPropertyListStyleImage:
@@ -1084,7 +1090,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyTextIndent:
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
-            return valueForShadow(style->textShadow(), static_cast<CSSPropertyID>(propertyID));
+            return valueForShadow(style->textShadow(), propertyID);
         case CSSPropertyTextRendering:
             return CSSPrimitiveValue::create(style->fontDescription().textRenderingMode());
         case CSSPropertyTextOverflow:
diff --git a/WebCore/css/CSSComputedStyleDeclaration.h b/WebCore/css/CSSComputedStyleDeclaration.h
index c1f34c3..842a995 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/WebCore/css/CSSComputedStyleDeclaration.h
@@ -27,6 +27,7 @@
 namespace WebCore {
 
 class CSSMutableStyleDeclaration;
+class ShadowData;
 
 enum EUpdateLayout { DoNotUpdateLayout = false, UpdateLayout = true };
 
@@ -66,6 +67,8 @@ private:
     virtual String removeProperty(int propertyID, ExceptionCode&);
     virtual void setProperty(int propertyId, const String& value, bool important, ExceptionCode&);
 
+    PassRefPtr<CSSValue> valueForShadow(const ShadowData*, int) const;
+
     RefPtr<Node> m_node;
 };
 
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index 1c1f7b4..0530e91 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -97,7 +97,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 50
+%expect 51
 
 %nonassoc LOWEST_PREC
 
@@ -268,7 +268,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %%
 
 stylesheet:
-    maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
+    maybe_space maybe_charset maybe_sgml import_list variables_list namespace_list rule_list
   | webkit_rule maybe_space
   | webkit_decls maybe_space
   | webkit_value maybe_space
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index b7155b3..0da1b85 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -457,9 +457,6 @@ Document* CSSParser::document() const
 
 bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, bool strict)
 {
-    if (unitflags & FNonNeg && value->fValue < 0)
-        return false;
-
     bool b = false;
     switch (value->unit) {
     case CSSPrimitiveValue::CSS_NUMBER:
@@ -503,6 +500,8 @@ bool CSSParser::validUnit(CSSParserValue* value, Units unitflags, bool strict)
     default:
         break;
     }
+    if (b && unitflags & FNonNeg && value->fValue < 0)
+        b = false;
     return b;
 }
 
@@ -926,6 +925,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackgroundPositionX:
     case CSSPropertyBackgroundPositionY:
     case CSSPropertyBackgroundSize:
+    case CSSPropertyWebkitBackgroundSize:
     case CSSPropertyBackgroundRepeat:
     case CSSPropertyBackgroundRepeatX:
     case CSSPropertyBackgroundRepeatY:
@@ -946,6 +946,13 @@ bool CSSParser::parseValue(int propId, bool important)
         int propId1, propId2;
         bool result = false;
         if (parseFillProperty(propId, propId1, propId2, val1, val2)) {
+            OwnPtr<ShorthandScope> shorthandScope;
+            if (propId == CSSPropertyBackgroundPosition ||
+                propId == CSSPropertyBackgroundRepeat ||
+                propId == CSSPropertyWebkitMaskPosition ||
+                propId == CSSPropertyWebkitMaskRepeat) {
+                shorthandScope.set(new ShorthandScope(this, propId));
+            }
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
@@ -1780,6 +1787,15 @@ void CSSParser::addFillValue(RefPtr<CSSValue>& lval, PassRefPtr<CSSValue> rval)
         lval = rval;
 }
 
+static bool parseBackgroundClip(CSSParserValue* parserValue, RefPtr<CSSValue>& cssValue)
+{
+    if (parserValue->id == CSSValueBorderBox || parserValue->id == CSSValuePaddingBox || parserValue->id == CSSValueWebkitText) {
+        cssValue = CSSPrimitiveValue::createIdentifier(parserValue->id);
+        return true;
+    }
+    return false;
+}
+
 const int cMaxFillProperties = 9;
 
 bool CSSParser::parseFillShorthand(int propId, const int* properties, int numProperties, bool important)
@@ -1831,6 +1847,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                 RefPtr<CSSValue> val1;
                 RefPtr<CSSValue> val2;
                 int propId1, propId2;
+                CSSParserValue* parserValue = m_valueList->current();
                 if (parseFillProperty(properties[i], propId1, propId2, val1, val2)) {
                     parsedProperty[i] = found = true;
                     addFillValue(values[i], val1.release());
@@ -1840,7 +1857,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                         addFillValue(repeatYValue, val2.release());
                     if (properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) {
                         // Reparse the value as a clip, and see if we succeed.
-                        if (parseFillProperty(CSSPropertyBackgroundClip, propId1, propId2, val1, val2))
+                        if (parseBackgroundClip(parserValue, val1))
                             addFillValue(clipValue, val1.release()); // The property parsed successfully.
                         else
                             addFillValue(clipValue, CSSInitialValue::createImplicit()); // Some value was used for origin that is not supported by clip. Just reset clip instead.
@@ -2373,7 +2390,7 @@ void CSSParser::parseFillRepeat(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& valu
     }
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
+PassRefPtr<CSSValue> CSSParser::parseFillSize(int propId, bool& allowComma)
 {
     allowComma = true;
     CSSParserValue* value = m_valueList->current();
@@ -2382,7 +2399,7 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
         return CSSPrimitiveValue::createIdentifier(value->id);
 
     RefPtr<CSSPrimitiveValue> parsedValue1;
-    
+
     if (value->id == CSSValueAuto)
         parsedValue1 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
     else {
@@ -2390,8 +2407,9 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
             return 0;
         parsedValue1 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
     }
-    
-    RefPtr<CSSPrimitiveValue> parsedValue2 = parsedValue1;
+
+    CSSPropertyID property = static_cast<CSSPropertyID>(propId);
+    RefPtr<CSSPrimitiveValue> parsedValue2;
     if ((value = m_valueList->next())) {
         if (value->id == CSSValueAuto)
             parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
@@ -2403,7 +2421,13 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
             parsedValue2 = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
         }
     }
-    
+    if (!parsedValue2) {
+        if (property == CSSPropertyWebkitBackgroundSize || property == CSSPropertyWebkitMaskSize)
+            parsedValue2 = parsedValue1;
+        else
+            parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
+    }
+
     return CSSPrimitiveValue::create(Pair::create(parsedValue1.release(), parsedValue2.release()));
 }
 
@@ -2479,10 +2503,8 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     }
                     break;
                 case CSSPropertyBackgroundClip:
-                    if (val->id == CSSValueBorderBox || val->id == CSSValuePaddingBox || val->id == CSSValueWebkitText) {
-                        currValue = CSSPrimitiveValue::createIdentifier(val->id);
+                    if (parseBackgroundClip(val, currValue))
                         m_valueList->next();
-                    }
                     break;
                 case CSSPropertyBackgroundOrigin:
                     if (val->id == CSSValueBorderBox || val->id == CSSValuePaddingBox || val->id == CSSValueContentBox) {
@@ -2524,8 +2546,9 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     // parseFillRepeat advances the m_valueList pointer
                     break;
                 case CSSPropertyBackgroundSize:
+                case CSSPropertyWebkitBackgroundSize:
                 case CSSPropertyWebkitMaskSize: {
-                    currValue = parseFillSize(allowComma);
+                    currValue = parseFillSize(propId, allowComma);
                     if (currValue)
                         m_valueList->next();
                     break;
@@ -3790,7 +3813,11 @@ bool CSSParser::parseShadow(int propId, bool important)
                 // Other operators aren't legal or we aren't done with the current shadow
                 // value.  Treat as invalid.
                 return false;
-            
+#if ENABLE(SVG)
+            // -webkit-shadow does not support multiple values.
+            if (static_cast<CSSPropertyID>(propId) == CSSPropertyWebkitShadow)
+                return false;
+#endif            
             // The value is good.  Commit it.
             context.commitValue();
         } else if (validUnit(val, FLength, true)) {
@@ -5242,11 +5269,6 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const opacity = "opacity";
                 name = opacity;
                 length = strlen(opacity);
-            } else if (strcmp(buffer, "-webkit-background-size") == 0) {
-                // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
-                const char* const backgroundSize = "background-size";
-                name = backgroundSize;
-                length = strlen(backgroundSize);
             } else if (hasPrefix(buffer + 7, length - 7, "-border-")) {
                 // -webkit-border-*-*-radius worked in Safari 4 and earlier. -webkit-border-radius syntax
                 // differs from border-radius, so it is remains as a distinct property.
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 1a156da..6d1bb32 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -83,7 +83,7 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseFillPositionXY(bool& xFound, bool& yFound);
         void parseFillPosition(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillSize(bool &allowComma);
+        PassRefPtr<CSSValue> parseFillSize(int propId, bool &allowComma);
         
         bool parseFillProperty(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseFillShorthand(int propId, const int* properties, int numProperties, bool important);
diff --git a/WebCore/css/CSSParserValues.h b/WebCore/css/CSSParserValues.h
index 24bd9b7..1e9767a 100644
--- a/WebCore/css/CSSParserValues.h
+++ b/WebCore/css/CSSParserValues.h
@@ -60,7 +60,7 @@ struct CSSParserValue {
     PassRefPtr<CSSValue> createCSSValue();
 };
 
-class CSSParserValueList {
+class CSSParserValueList : public FastAllocBase {
 public:
     CSSParserValueList()
         : m_current(0)
@@ -88,7 +88,7 @@ private:
     unsigned m_variablesCount;
 };
 
-struct CSSParserFunction {
+struct CSSParserFunction : FastAllocBase {
     CSSParserString name;
     CSSParserValueList* args;
 
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index 1f2c9ca..d2286bb 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -34,6 +34,8 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -684,6 +686,71 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
+static void appendCSSDouble(Vector<UChar>& vector, double value)
+{
+    // From the CSS specification section titled "Integers and real numbers",
+    // real numbers are only formatted as [sign] [digits] "." [digits].
+    // This differs from printf-style formatting in that exponents (e.g. 1.3e06)
+    // are not allowed.  Since NaN/inf are also not valid CSS values this
+    // function doesn't handle them.
+
+    // For compatibility with what was returned by older versions of
+    // WebKit, we target 6 digits of precision.
+    const int digitsAfterDecimalPoint = 6;
+    long long rounded = llround(fabs(value) * 1000000.0);
+    if (rounded == 0) {
+        vector.append('0');
+        return;
+    }
+
+    char buf[24];
+    int length = snprintf(buf, sizeof(buf), "%lld", rounded);
+    int decimalPoint = length - digitsAfterDecimalPoint;
+
+    // We are matching printf("%g")'s behavior and must trim trailing zeros,
+    // regardless of whether they're significant.
+    while (length > 0 && length > decimalPoint && buf[length - 1] == '0')
+        length--;
+
+    // Reserve an estimate of space for the number of digits we anticipate
+    // along with a minus sign/initial zero/decimal point.
+    vector.reserveCapacity(vector.size() + 3 + length);
+
+    if (value < 0)
+        vector.append('-');
+
+    if (decimalPoint <= 0) {
+        // Only digits after the decimal point.
+        vector.append('0');
+        vector.append('.');
+        for (int i = decimalPoint; i < 0; i++)
+            vector.append('0');
+        for (int i = 0; i < length; i++)
+            vector.append(buf[i]);
+    } else if (length <= decimalPoint) {
+        // Only digits before the decimal point.
+        for (int i = 0; i < length; i++)
+            vector.append(buf[i]);
+    } else {
+        // Digits before and after the decimal point.
+        for (int i = 0; i < decimalPoint; i++)
+            vector.append(buf[i]);
+        vector.append('.');
+        for (int i = decimalPoint; i < length; i++)
+            vector.append(buf[i]);
+    }
+}
+
+static String formatWithUnits(double value, const char* units)
+{
+    Vector<UChar> result;
+    appendCSSDouble(result, value);
+    result.reserveCapacity(result.size() + strlen(units));
+    for (int i = 0; units[i]; i++)
+        result.append(units[i]);
+    return String::adopt(result);
+}
+
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -695,61 +762,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = String::number(m_value.num);
+            text = formatWithUnits(m_value.num, "");
             break;
         case CSS_PERCENTAGE:
-            text = String::format("%.6lg%%", m_value.num);
+            text = formatWithUnits(m_value.num, "%");
             break;
         case CSS_EMS:
-            text = String::format("%.6lgem", m_value.num);
+            text = formatWithUnits(m_value.num, "em");
             break;
         case CSS_EXS:
-            text = String::format("%.6lgex", m_value.num);
+            text = formatWithUnits(m_value.num, "ex");
             break;
         case CSS_REMS:
-            text = String::format("%.6lgrem", m_value.num);
+            text = formatWithUnits(m_value.num, "rem");
             break;
         case CSS_PX:
-            text = String::format("%.6lgpx", m_value.num);
+            text = formatWithUnits(m_value.num, "px");
             break;
         case CSS_CM:
-            text = String::format("%.6lgcm", m_value.num);
+            text = formatWithUnits(m_value.num, "cm");
             break;
         case CSS_MM:
-            text = String::format("%.6lgmm", m_value.num);
+            text = formatWithUnits(m_value.num, "mm");
             break;
         case CSS_IN:
-            text = String::format("%.6lgin", m_value.num);
+            text = formatWithUnits(m_value.num, "in");
             break;
         case CSS_PT:
-            text = String::format("%.6lgpt", m_value.num);
+            text = formatWithUnits(m_value.num, "pt");
             break;
         case CSS_PC:
-            text = String::format("%.6lgpc", m_value.num);
+            text = formatWithUnits(m_value.num, "pc");
             break;
         case CSS_DEG:
-            text = String::format("%.6lgdeg", m_value.num);
+            text = formatWithUnits(m_value.num, "deg");
             break;
         case CSS_RAD:
-            text = String::format("%.6lgrad", m_value.num);
+            text = formatWithUnits(m_value.num, "rad");
             break;
         case CSS_GRAD:
-            text = String::format("%.6lggrad", m_value.num);
+            text = formatWithUnits(m_value.num, "grad");
             break;
         case CSS_MS:
-            text = String::format("%.6lgms", m_value.num);
+            text = formatWithUnits(m_value.num, "ms");
             break;
         case CSS_S:
-            text = String::format("%.6lgs", m_value.num);
+            text = formatWithUnits(m_value.num, "s");
             break;
         case CSS_HZ:
-            text = String::format("%.6lghz", m_value.num);
+            text = formatWithUnits(m_value.num, "hz");
             break;
         case CSS_KHZ:
-            text = String::format("%.6lgkhz", m_value.num);
+            text = formatWithUnits(m_value.num, "khz");
             break;
         case CSS_TURN:
-            text = String::format("%.6lgturn", m_value.num);
+            text = formatWithUnits(m_value.num, "turn");
             break;
         case CSS_DIMENSION:
             // FIXME
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 3616aa5..6f89df9 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -200,11 +200,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
-#if ENABLE(DATALIST)
         case ListButtonPart:
+#if ENABLE(DATALIST)
             m_value.ident = CSSValueListButton;
-            break;
 #endif
+            break;
         case ListItemPart:
             m_value.ident = CSSValueListitem;
             break;
@@ -378,6 +378,7 @@ template<> inline CSSPrimitiveValue::operator EFillBox() const
         case CSSValueContentBox:
             return ContentFillBox;
         case CSSValueText:
+        case CSSValueWebkitText:
             return TextFillBox;
         default:
             ASSERT_NOT_REACHED();
diff --git a/WebCore/css/CSSProperty.h b/WebCore/css/CSSProperty.h
index 7af8348..b5635d0 100644
--- a/WebCore/css/CSSProperty.h
+++ b/WebCore/css/CSSProperty.h
@@ -29,7 +29,7 @@
 
 namespace WebCore {
 
-class CSSProperty {
+class CSSProperty : public FastAllocBase {
 public:
     CSSProperty(int propID, PassRefPtr<CSSValue> value, bool important = false, int shorthandID = 0, bool implicit = false)
         : m_id(propID)
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index 7bed755..dff3a2b 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -160,6 +160,10 @@ zoom
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
+# -webkit-background-size differs from background-size only in the interpretation of
+# a single value: -webkit-background-size: l; is equivalent to background-size: l l;
+# whereas background-size: l; is equivalent to background-size: l auto;
+-webkit-background-size
 -webkit-binding
 -webkit-border-fit
 -webkit-border-horizontal-spacing
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 69c5598..3276964 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -2961,6 +2961,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_BACKGROUND_VALUE(origin, Origin, value)
         return;
     case CSSPropertyBackgroundSize:
+    case CSSPropertyWebkitBackgroundSize:
         HANDLE_BACKGROUND_VALUE(size, Size, value)
         return;
     case CSSPropertyWebkitMaskAttachment:
diff --git a/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index e8492d4..1f19983 100644
--- a/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -166,6 +166,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
 
             return 0;
         }
+        case CSSPropertyWebkitShadow:
+            return valueForShadow(svgStyle->shadow(), propertyID);
         case CSSPropertyMarker:
         case CSSPropertyEnableBackground:
         case CSSPropertyColorProfile:
diff --git a/WebCore/css/SVGCSSParser.cpp b/WebCore/css/SVGCSSParser.cpp
index 0ae9fbc..8730e49 100644
--- a/WebCore/css/SVGCSSParser.cpp
+++ b/WebCore/css/SVGCSSParser.cpp
@@ -257,6 +257,11 @@ bool CSSParser::parseSVGValue(int propId, bool important)
                 m_valueList->next();
         }
         break;
+    case CSSPropertyWebkitShadow:
+        if (id == CSSValueNone)
+            valid_primitive = true;
+        else
+            return parseShadow(propId, important);
 
     /* shorthand properties */
     case CSSPropertyMarker:
diff --git a/WebCore/css/SVGCSSPropertyNames.in b/WebCore/css/SVGCSSPropertyNames.in
index e400ffe..809eabe 100644
--- a/WebCore/css/SVGCSSPropertyNames.in
+++ b/WebCore/css/SVGCSSPropertyNames.in
@@ -46,3 +46,5 @@ glyph-orientation-vertical
 kerning
 text-anchor
 writing-mode
+
+-webkit-shadow
diff --git a/WebCore/css/SVGCSSStyleSelector.cpp b/WebCore/css/SVGCSSStyleSelector.cpp
index b81b4f2..7e4483f 100644
--- a/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/WebCore/css/SVGCSSStyleSelector.cpp
@@ -37,6 +37,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueList.h"
 #include "Document.h"
+#include "ShadowValue.h"
 #include "SVGColor.h"
 #include "SVGNames.h"
 #include "SVGPaint.h"
@@ -526,6 +527,35 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
             // Silently ignoring this property for now
             // http://bugs.webkit.org/show_bug.cgi?id=6022
             break;
+        case CSSPropertyWebkitShadow: {
+            if (isInherit)
+                return svgstyle->setShadow(m_parentStyle->svgStyle()->shadow() ? new ShadowData(*m_parentStyle->svgStyle()->shadow()) : 0);
+            if (isInitial || primitiveValue) // initial | none
+                return svgstyle->setShadow(0);
+
+            if (!value->isValueList())
+                return;
+
+            float zoomFactor = m_style->effectiveZoom();
+
+            CSSValueList *list = static_cast<CSSValueList*>(value);
+            ASSERT(list->length() == 1);
+            ShadowValue* item = static_cast<ShadowValue*>(list->itemWithoutBoundsCheck(0));
+            int x = item->x->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
+            int y = item->y->computeLengthInt(style(), m_rootElementStyle, zoomFactor);
+            int blur = item->blur ? item->blur->computeLengthInt(style(), m_rootElementStyle, zoomFactor) : 0;
+            Color color;
+            if (item->color)
+                color = getColorFromPrimitiveValue(item->color.get());
+
+            // -webkit-shadow does should not have a spread or style
+            ASSERT(!item->spread);
+            ASSERT(!item->style);
+                
+            ShadowData* shadowData = new ShadowData(x, y, blur, 0, Normal, color.isValid() ? color : Color::transparent);
+            svgstyle->setShadow(shadowData);
+            return;
+        }
         default:
             // If you crash here, it's because you added a css property and are not handling it
             // in either this switch statement or the one in CSSStyleSelector::applyProperty
diff --git a/WebCore/css/makevalues.pl b/WebCore/css/makevalues.pl
index 3f52e64..e49981d 100644
--- a/WebCore/css/makevalues.pl
+++ b/WebCore/css/makevalues.pl
@@ -86,7 +86,7 @@ const char* getValueName(unsigned short id);
 EOF
 close HEADER;
 
-system("gperf -L ANSI-C -E -C -n -o -t --key-positions=\"*\" -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf > CSSValueKeywords.c");
+system("gperf -L ANSI-C -E -C -n -o -t --key-positions=\"*\" -NfindValue -Hhash_val -Wwordlist_value -D CSSValueKeywords.gperf > CSSValueKeywords.c") == 0 || die "calling gperf failed: $?";
 
 open C, ">>CSSValueKeywords.c" || die "Could not open CSSValueKeywords.c for writing";
 print C  "static const char * const valueList[] = {\n";
diff --git a/WebCore/dom/BeforeLoadEvent.h b/WebCore/dom/BeforeLoadEvent.h
index 8c86773..fc5814a 100644
--- a/WebCore/dom/BeforeLoadEvent.h
+++ b/WebCore/dom/BeforeLoadEvent.h
@@ -34,6 +34,8 @@ namespace WebCore {
 
 class BeforeLoadEvent : public Event {
 public:
+    virtual bool isBeforeLoadEvent() const { return true; }
+
     static PassRefPtr<BeforeLoadEvent> create(const String& url)
     {
         return adoptRef(new BeforeLoadEvent(url));
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index 99b2c4f..5cd0781 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -912,10 +912,13 @@ static void dispatchChildRemovalEvents(Node* child)
 
 bool ContainerNode::dispatchBeforeLoadEvent(const String& sourceURL)
 {
+    if (!document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+        return true;
+
     RefPtr<ContainerNode> protector(this);
     RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
     dispatchEvent(beforeLoadEvent.get());
-    return inDocument() && !beforeLoadEvent->defaultPrevented();
+    return !beforeLoadEvent->defaultPrevented();
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index efa2f7a..9ac1092 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -58,6 +58,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLAllCollection.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCanvasElement.h"
@@ -534,6 +535,16 @@ Document::~Document()
         m_styleSheets->documentDestroyed();
 }
 
+Document::JSWrapperCache* Document::createWrapperCache(DOMWrapperWorld* world)
+{
+    JSWrapperCache* wrapperCache = new JSWrapperCache();
+    m_wrapperCacheMap.set(world, wrapperCache);
+#if USE(JSC)
+    world->rememberDocument(this);
+#endif
+    return wrapperCache;
+}
+
 void Document::resetLinkColor()
 {
     m_linkColor = Color(0, 0, 238);
@@ -976,7 +987,7 @@ Element* Document::elementFromPoint(int x, int y) const
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor  + view()->scrollX(), y * zoomFactor + view()->scrollY()));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -1006,7 +1017,7 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
         return 0;
 
     float zoomFactor = frame->pageZoomFactor();
-    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor + view()->scrollX(), y * zoomFactor + view()->scrollY()));
 
     if (!frameView->visibleContentRect().contains(point))
         return 0;
@@ -1622,6 +1633,9 @@ void Document::open(Document* ownerDocument)
 
     implicitOpen();
 
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
+
     if (m_frame)
         m_frame->loader()->didExplicitOpen();
 }
@@ -1643,7 +1657,11 @@ void Document::implicitOpen()
 {
     cancelParsing();
 
-    clear();
+    delete m_tokenizer;
+    m_tokenizer = 0;
+
+    removeChildren();
+
     m_tokenizer = createTokenizer();
     setParsing(true);
 
@@ -1772,7 +1790,7 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    ImageLoader::dispatchPendingLoadEvents();
+    ImageLoader::dispatchPendingEvents();
     dispatchWindowLoadEvent();
     dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
     if (f)
@@ -1921,16 +1939,6 @@ void Document::finishParsing()
         m_tokenizer->finish();
 }
 
-void Document::clear()
-{
-    delete m_tokenizer;
-    m_tokenizer = 0;
-
-    removeChildren();
-    if (DOMWindow* domWindow = this->domWindow())
-        domWindow->removeAllEventListeners();
-}
-
 const KURL& Document::virtualURL() const
 {
     return m_url;
@@ -2476,8 +2484,8 @@ void Document::removePendingSheet()
     if (!m_pendingStylesheets && m_tokenizer)
         m_tokenizer->executeScriptsWaitingForStylesheets();
 
-    if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && m_frame)
-        m_frame->loader()->gotoAnchor();
+    if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && view())
+        view()->scrollToFragment(m_frame->loader()->url());
 }
 
 void Document::updateStyleSelector()
@@ -3013,46 +3021,54 @@ void Document::dispatchWindowLoadEvent()
 
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
+    RefPtr<Event> event;
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
-        return Event::create();
-    if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
-        return KeyboardEvent::create();
-    if (eventType == "MessageEvent")
-        return MessageEvent::create();
-    if (eventType == "MouseEvent" || eventType == "MouseEvents")
-        return MouseEvent::create();
-    if (eventType == "MutationEvent" || eventType == "MutationEvents")
-        return MutationEvent::create();
-    if (eventType == "OverflowEvent")
-        return OverflowEvent::create();
-    if (eventType == "PageTransitionEvent")
-        return PageTransitionEvent::create();
-    if (eventType == "ProgressEvent")
-        return ProgressEvent::create();
+        event = Event::create();
+    else if (eventType == "KeyboardEvent" || eventType == "KeyboardEvents")
+        event = KeyboardEvent::create();
+    else if (eventType == "MessageEvent")
+        event = MessageEvent::create();
+    else if (eventType == "MouseEvent" || eventType == "MouseEvents")
+        event = MouseEvent::create();
+    else if (eventType == "MutationEvent" || eventType == "MutationEvents")
+        event = MutationEvent::create();
+    else if (eventType == "OverflowEvent")
+        event = OverflowEvent::create();
+    else if (eventType == "PageTransitionEvent")
+        event = PageTransitionEvent::create();
+    else if (eventType == "ProgressEvent")
+        event = ProgressEvent::create();
 #if ENABLE(DOM_STORAGE)
-    if (eventType == "StorageEvent")
-        return StorageEvent::create();
+    else if (eventType == "StorageEvent")
+        event = StorageEvent::create();
 #endif
-    if (eventType == "TextEvent")
-        return TextEvent::create();
-    if (eventType == "UIEvent" || eventType == "UIEvents")
-        return UIEvent::create();
-    if (eventType == "WebKitAnimationEvent")
-        return WebKitAnimationEvent::create();
-    if (eventType == "WebKitTransitionEvent")
-        return WebKitTransitionEvent::create();
-    if (eventType == "WheelEvent")
-        return WheelEvent::create();
+    else if (eventType == "TextEvent")
+        event = TextEvent::create();
+    else if (eventType == "UIEvent" || eventType == "UIEvents")
+        event = UIEvent::create();
+    else if (eventType == "WebKitAnimationEvent")
+        event = WebKitAnimationEvent::create();
+    else if (eventType == "WebKitTransitionEvent")
+        event = WebKitTransitionEvent::create();
+    else if (eventType == "WheelEvent")
+        event = WheelEvent::create();
 #if ENABLE(SVG)
-    if (eventType == "SVGEvents")
-        return Event::create();
-    if (eventType == "SVGZoomEvents")
-        return SVGZoomEvent::create();
+    else if (eventType == "SVGEvents")
+        event = Event::create();
+    else if (eventType == "SVGZoomEvents")
+        event = SVGZoomEvent::create();
 #endif
+<<<<<<< HEAD:WebCore/dom/Document.cpp
 #if ENABLE(TOUCH_EVENTS) // Android
     if (eventType == "TouchEvent")
         return TouchEvent::create();
 #endif
+=======
+    if (event) {
+        event->setCreatedByDOM(true);
+        return event.release();
+    }
+>>>>>>> webkit.org at r50258.:WebCore/dom/Document.cpp
     ec = NOT_SUPPORTED_ERR;
     return 0;
 }
@@ -3083,6 +3099,8 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
         addListenerType(ANIMATIONITERATION_LISTENER);
     else if (eventType == eventNames().webkitTransitionEndEvent)
         addListenerType(TRANSITIONEND_LISTENER);
+    else if (eventType == eventNames().beforeloadEvent)
+        addListenerType(BEFORELOAD_LISTENER);
 }
 
 CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
@@ -4107,9 +4125,9 @@ PassRefPtr<HTMLCollection> Document::anchors()
     return HTMLCollection::create(this, DocAnchors);
 }
 
-PassRefPtr<HTMLCollection> Document::all()
+PassRefPtr<HTMLAllCollection> Document::all()
 {
-    return HTMLCollection::create(this, DocAll);
+    return HTMLAllCollection::create(this);
 }
 
 PassRefPtr<HTMLCollection> Document::windowNamedItems(const String &name)
@@ -4658,7 +4676,7 @@ void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const
     Frame* frame = this->frame();
     if (frame) {
         FrameLoader* frameLoader = frame->loader();
-        frameLoader->didLoadResourceByXMLHttpRequest(identifier, sourceString);
+        frameLoader->notifier()->didLoadResourceByXMLHttpRequest(identifier, sourceString);
     }
 }
 
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index fc2eea0..9f5785e 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -71,6 +71,7 @@ namespace WebCore {
     class HitTestRequest;
     class HTMLCanvasElement;
     class HTMLCollection;
+    class HTMLAllCollection;
     class HTMLDocument;
     class HTMLElement;
     class HTMLFormElement;
@@ -79,6 +80,7 @@ namespace WebCore {
     class HTMLMapElement;
     class InspectorTimelineAgent;
     class IntPoint;
+    class DOMWrapperWorld;
     class JSNode;
     class MouseEventWithHitTestResults;
     class NodeFilter;
@@ -315,12 +317,13 @@ public:
     PassRefPtr<HTMLCollection> links();
     PassRefPtr<HTMLCollection> forms();
     PassRefPtr<HTMLCollection> anchors();
-    PassRefPtr<HTMLCollection> all();
     PassRefPtr<HTMLCollection> objects();
     PassRefPtr<HTMLCollection> scripts();
     PassRefPtr<HTMLCollection> windowNamedItems(const String& name);
     PassRefPtr<HTMLCollection> documentNamedItems(const String& name);
 
+    PassRefPtr<HTMLAllCollection> all();
+
     // Find first anchor with the given name.
     // First searches for an element with the given ID, but if that fails, then looks
     // for an anchor with the given name. ID matching is always case sensitive, but
@@ -473,7 +476,6 @@ public:
     void write(const String& text, Document* ownerDocument = 0);
     void writeln(const String& text, Document* ownerDocument = 0);
     void finishParsing();
-    void clear();
 
     bool wellFormed() const { return m_wellFormed; }
 
@@ -615,7 +617,8 @@ public:
         ANIMATIONEND_LISTENER                = 0x100,
         ANIMATIONSTART_LISTENER              = 0x200,
         ANIMATIONITERATION_LISTENER          = 0x400,
-        TRANSITIONEND_LISTENER               = 0x800
+        TRANSITIONEND_LISTENER               = 0x800,
+        BEFORELOAD_LISTENER                  = 0x1000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
@@ -832,7 +835,15 @@ public:
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
     typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
-    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
+    typedef HashMap<DOMWrapperWorld*, JSWrapperCache*> JSWrapperCacheMap;
+    JSWrapperCacheMap& wrapperCacheMap() { return m_wrapperCacheMap; }
+    JSWrapperCache* getWrapperCache(DOMWrapperWorld* world)
+    {
+        if (JSWrapperCache* wrapperCache = m_wrapperCacheMap.get(world))
+            return wrapperCache;
+        return createWrapperCache(world);
+    }
+    JSWrapperCache* createWrapperCache(DOMWrapperWorld*);
 
     virtual void finishedParsing();
 
@@ -1162,7 +1173,7 @@ private:
 
     unsigned m_numNodeListCaches;
 
-    JSWrapperCache m_wrapperCache;
+    JSWrapperCacheMap m_wrapperCacheMap;
 
 #if ENABLE(DATABASE)
     RefPtr<DatabaseThread> m_databaseThread;
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index e7a43c7..ce7010a 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -172,6 +172,9 @@ module core {
                  attribute HTMLElement body
                      setter raises (DOMException);
 
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        readonly attribute HTMLHeadElement head;
+#endif
         readonly attribute HTMLCollection images;
         readonly attribute HTMLCollection applets;
         readonly attribute HTMLCollection links;
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 50ff033..9edde25 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -123,6 +123,7 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
 void Element::removeAttribute(const QualifiedName& name, ExceptionCode& ec)
 {
     if (namedAttrMap) {
+        ec = 0;
         namedAttrMap->removeNamedItem(name, ec);
         if (ec == NOT_FOUND_ERR)
             ec = 0;
@@ -515,7 +516,7 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
         return;
     }
 
-    const AtomicString& localName = (shouldIgnoreAttributeCase(this) && !name.string().impl()->isLower()) ? AtomicString(name.string().lower()) : name;
+    const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
 
     // allocate attributemap if necessary
     Attribute* old = attributes(false)->getAttributeItem(localName, false);
@@ -1413,7 +1414,7 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
             ASSERT(isURLAttribute(attribute));
     }
 #endif
-    return document()->completeURL(getAttribute(name));
+    return document()->completeURL(deprecatedParseURL(getAttribute(name)));
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index cae4122..5d8eaaa 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -35,6 +35,7 @@ Event::Event()
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
+    , m_createdByDOM(false)
     , m_eventPhase(0)
     , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
@@ -49,6 +50,7 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
+    , m_createdByDOM(false)
     , m_eventPhase(0)
     , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
@@ -149,6 +151,11 @@ bool Event::isXMLHttpRequestProgressEvent() const
     return false;
 }
 
+bool Event::isBeforeLoadEvent() const
+{
+    return false;
+}
+
 #if ENABLE(SVG)
 bool Event::isSVGZoomEvent() const
 {
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index 30e5d27..b391985 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -114,6 +114,7 @@ namespace WebCore {
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
         virtual bool isWebKitTransitionEvent() const;
+        virtual bool isBeforeLoadEvent() const;
 #if ENABLE(SVG)
         virtual bool isSVGZoomEvent() const;
 #endif
@@ -147,6 +148,9 @@ namespace WebCore {
 
         virtual Clipboard* clipboard() const { return 0; }
 
+        bool createdByDOM() const { return m_createdByDOM; }
+        void setCreatedByDOM(bool createdByDOM) { m_createdByDOM = createdByDOM; }
+
     protected:
         Event();
         Event(const AtomicString& type, bool canBubble, bool cancelable);
@@ -164,6 +168,9 @@ namespace WebCore {
         bool m_defaultHandled;
         bool m_cancelBubble;
 
+        // Whether this event was created by document.createEvent().
+        bool m_createdByDOM;
+
         unsigned short m_eventPhase;
         EventTarget* m_currentTarget;
         RefPtr<EventTarget> m_target;
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index 31c29fb..578b7d5 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -64,7 +64,6 @@ namespace WebCore {
     macro(keypress) \
     macro(keyup) \
     macro(load) \
-    macro(loadend) \
     macro(loadstart) \
     macro(message) \
     macro(mousedown) \
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index ceb5221..694e78a 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -192,9 +192,16 @@ bool EventTarget::removeEventListener(const AtomicString& eventType, EventListen
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
-    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i) {
-        if (eventType == *d->firingEventEndIterators[i].eventType && index < *d->firingEventEndIterators[i].value)
-            --*d->firingEventEndIterators[i].value;
+    for (size_t i = 0; i < d->firingEventIterators.size(); ++i) {
+        if (eventType != d->firingEventIterators[i].eventType)
+            continue;
+
+        if (index >= d->firingEventIterators[i].end)
+            continue;
+
+        --d->firingEventIterators[i].end;
+        if (index <= d->firingEventIterators[i].iterator)
+            --d->firingEventIterators[i].iterator;
     }
 
     return true;
@@ -232,6 +239,10 @@ bool EventTarget::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
         ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
         return false;
     }
+
+    if (!scriptExecutionContext())
+        return false;
+
     return dispatchEvent(event);
 }
 
@@ -259,9 +270,15 @@ bool EventTarget::fireEventListeners(Event* event)
 
     RefPtr<EventTarget> protect = this;
 
+    // Fire all listeners registered for this event. Don't fire listeners removed
+    // during event dispatch. Also, don't fire event listeners added during event
+    // dispatch. Conveniently, all new event listeners will be added after 'end',
+    // so iterating to 'end' naturally excludes new event listeners.
+
+    size_t i = 0;
     size_t end = entry.size();
-    d->firingEventEndIterators.append(FiringEventEndIterator(&event->type(), &end));
-    for (size_t i = 0; i < end; ++i) {
+    d->firingEventIterators.append(FiringEventIterator(event->type(), i, end));
+    for ( ; i < end; ++i) {
         RegisteredEventListener& registeredListener = entry[i];
         if (event->eventPhase() == Event::CAPTURING_PHASE && !registeredListener.useCapture)
             continue;
@@ -271,7 +288,7 @@ bool EventTarget::fireEventListeners(Event* event)
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener->handleEvent(scriptExecutionContext(), event);
     }
-    d->firingEventEndIterators.removeLast();
+    d->firingEventIterators.removeLast();
 
     return !event->defaultPrevented();
 }
@@ -298,8 +315,10 @@ void EventTarget::removeAllEventListeners()
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
-    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i)
-        *d->firingEventEndIterators[i].value = 0;
+    for (size_t i = 0; i < d->firingEventIterators.size(); ++i) {
+        d->firingEventIterators[i].iterator = 0;
+        d->firingEventIterators[i].end = 0;
+    }
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 2d612e1..9a1975c 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -61,24 +61,26 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    struct FiringEventEndIterator {
-        FiringEventEndIterator(const AtomicString* eventType, size_t* value)
+    struct FiringEventIterator {
+        FiringEventIterator(const AtomicString& eventType, size_t& iterator, size_t& end)
             : eventType(eventType)
-            , value(value)
+            , iterator(iterator)
+            , end(end)
         {
         }
-        
-        const AtomicString* eventType;
-        size_t* value;
+
+        const AtomicString& eventType;
+        size_t& iterator;
+        size_t& end;
     };
-    typedef Vector<FiringEventEndIterator, 1> FiringEventEndIteratorVector;
+    typedef Vector<FiringEventIterator, 1> FiringEventIteratorVector;
 
     typedef Vector<RegisteredEventListener, 1> EventListenerVector;
     typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
 
     struct EventTargetData {
         EventListenerMap eventListenerMap;
-        FiringEventEndIteratorVector firingEventEndIterators;
+        FiringEventIteratorVector firingEventIterators;
     };
 
     class EventTarget {
@@ -209,7 +211,7 @@ namespace WebCore {
         EventTargetData* d = eventTargetData();
         if (!d)
             return false;
-        return d->firingEventEndIterators.size() != 0;
+        return d->firingEventIterators.size() != 0;
     }
 
     inline bool EventTarget::hasEventListeners()
diff --git a/WebCore/dom/ExceptionBase.cpp b/WebCore/dom/ExceptionBase.cpp
index c73d514..d175d8b 100644
--- a/WebCore/dom/ExceptionBase.cpp
+++ b/WebCore/dom/ExceptionBase.cpp
@@ -34,6 +34,7 @@ namespace WebCore {
 ExceptionBase::ExceptionBase(const ExceptionCodeDescription& description)
     : m_code(description.code)
     , m_name(description.name)
+    , m_description(description.description)
 {
     if (description.name)
         m_message = String::format("%s: %s Exception %d", description.name, description.typeName, description.code);
diff --git a/WebCore/dom/ExceptionBase.h b/WebCore/dom/ExceptionBase.h
index 44fad7e..81e2d7f 100644
--- a/WebCore/dom/ExceptionBase.h
+++ b/WebCore/dom/ExceptionBase.h
@@ -40,6 +40,7 @@ namespace WebCore {
         unsigned short code() const { return m_code; }
         String name() const { return m_name; }
         String message() const { return m_message; }
+        String description() const { return m_description; }
 
         String toString() const;
 
@@ -50,6 +51,7 @@ namespace WebCore {
         unsigned short m_code;
         String m_name;
         String m_message;
+        String m_description;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/ExceptionCode.cpp b/WebCore/dom/ExceptionCode.cpp
index 0291a21..7bb8a50 100644
--- a/WebCore/dom/ExceptionCode.cpp
+++ b/WebCore/dom/ExceptionCode.cpp
@@ -65,25 +65,70 @@ static const char* const exceptionNames[] = {
     "QUOTA_EXCEEDED_ERR"
 };
 
+static const char* const exceptionDescriptions[] = {
+    "Index or size was negative, or greater than the allowed value.",
+    "The specified range of text did not fit into a DOMString.",
+    "A Node was inserted somewhere it doesn't belong.",
+    "A Node was used in a different document than the one that created it (that doesn't support it).",
+    "An invalid or illegal character was specified, such as in an XML name.",
+    "Data was specified for a Node which does not support data.",
+    "An attempt was made to modify an object where modifications are not allowed.",
+    "An attempt was made to reference a Node in a context where it does not exist.",
+    "The implementation did not support the requested type of object or operation.",
+    "An attempt was made to add an attribute that is already in use elsewhere.",
+    "An attempt was made to use an object that is not, or is no longer, usable.",
+    "An invalid or illegal string was specified.",
+    "An attempt was made to modify the type of the underlying object.",
+    "An attempt was made to create or change an object in a way which is incorrect with regard to namespaces.",
+    "A parameter or an operation was not supported by the underlying object.",
+    "A call to a method such as insertBefore or removeChild would make the Node invalid with respect to \"partial validity\", this exception would be raised and the operation would not be done.",
+    "The type of an object was incompatible with the expected type of the parameter associated to the object.",
+    "An attempt was made to break through the security policy of the user agent.",
+    // FIXME: Couldn't find a description in the HTML/DOM specifications for NETWORK_ERR, ABORT_ERR, URL_MISMATCH_ERR, and QUOTA_EXCEEDED_ERR
+    "A network error occured.",
+    "The user aborted a request.",
+    "A worker global scope represented an absolute URL that is not equal to the resulting absolute URL.",
+    "An attempt was made to add something to storage that exceeded the quota."
+};
+
 static const char* const rangeExceptionNames[] = {
     "BAD_BOUNDARYPOINTS_ERR",
     "INVALID_NODE_TYPE_ERR"
 };
 
+static const char* const rangeExceptionDescriptions[] = {
+    "The boundary-points of a Range did not meet specific requirements.",
+    "The container of an boundary-point of a Range was being set to either a node of an invalid type or a node with an ancestor of an invalid type."
+};
+
 static const char* const eventExceptionNames[] = {
     "UNSPECIFIED_EVENT_TYPE_ERR"
 };
 
+static const char* const eventExceptionDescriptions[] = {
+    "The Event's type was not specified by initializing the event before the method was called."
+};
+
 static const char* const xmlHttpRequestExceptionNames[] = {
     "NETWORK_ERR",
     "ABORT_ERR"
 };
 
+static const char* const xmlHttpRequestExceptionDescriptions[] = {
+    "A network error occured in synchronous requests.",
+    "The user aborted a request in synchronous requests."
+};
+
 #if ENABLE(XPATH)
 static const char* const xpathExceptionNames[] = {
     "INVALID_EXPRESSION_ERR",
     "TYPE_ERR"
 };
+
+static const char* const xpathExceptionDescriptions[] = {
+    "The expression had a syntax error or otherwise is not a legal expression according to the rules of the specific XPathEvaluator.",
+    "The expression could not be converted to return the specified type."
+};
 #endif
 
 #if ENABLE(SVG)
@@ -92,6 +137,12 @@ static const char* const svgExceptionNames[] = {
     "SVG_INVALID_VALUE_ERR",
     "SVG_MATRIX_NOT_INVERTABLE"
 };
+
+static const char* const svgExceptionDescriptions[] = {
+    "An object of the wrong type was passed to an operation.",
+    "An invalid value was passed to an operation or assigned to an attribute.",
+    "An attempt was made to invert a matrix that is not invertible."
+};
 #endif
 
 void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& description)
@@ -101,6 +152,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
     const char* typeName;
     int code = ec;
     const char* const* nameTable;
+    const char* const* descriptionTable;
     int nameTableSize;
     int nameTableOffset;
     ExceptionType type;
@@ -110,6 +162,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM Range";
         code -= RangeException::RangeExceptionOffset;
         nameTable = rangeExceptionNames;
+        descriptionTable = rangeExceptionDescriptions;
         nameTableSize = sizeof(rangeExceptionNames) / sizeof(rangeExceptionNames[0]);
         nameTableOffset = RangeException::BAD_BOUNDARYPOINTS_ERR;
     } else if (code >= EventException::EventExceptionOffset && code <= EventException::EventExceptionMax) {
@@ -117,6 +170,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM Events";
         code -= EventException::EventExceptionOffset;
         nameTable = eventExceptionNames;
+        descriptionTable = eventExceptionDescriptions;
         nameTableSize = sizeof(eventExceptionNames) / sizeof(eventExceptionNames[0]);
         nameTableOffset = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
     } else if (code >= XMLHttpRequestException::XMLHttpRequestExceptionOffset && code <= XMLHttpRequestException::XMLHttpRequestExceptionMax) {
@@ -124,6 +178,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "XMLHttpRequest";
         code -= XMLHttpRequestException::XMLHttpRequestExceptionOffset;
         nameTable = xmlHttpRequestExceptionNames;
+        descriptionTable = xmlHttpRequestExceptionDescriptions;
         nameTableSize = sizeof(xmlHttpRequestExceptionNames) / sizeof(xmlHttpRequestExceptionNames[0]);
         // XMLHttpRequest exception codes start with 101 and we don't want 100 empty elements in the name array
         nameTableOffset = XMLHttpRequestException::NETWORK_ERR;
@@ -133,6 +188,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM XPath";
         code -= XPathException::XPathExceptionOffset;
         nameTable = xpathExceptionNames;
+        descriptionTable = xpathExceptionDescriptions;
         nameTableSize = sizeof(xpathExceptionNames) / sizeof(xpathExceptionNames[0]);
         // XPath exception codes start with 51 and we don't want 51 empty elements in the name array
         nameTableOffset = XPathException::INVALID_EXPRESSION_ERR;
@@ -143,6 +199,7 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         typeName = "DOM SVG";
         code -= SVGException::SVGExceptionOffset;
         nameTable = svgExceptionNames;
+        descriptionTable = svgExceptionDescriptions;
         nameTableSize = sizeof(svgExceptionNames) / sizeof(svgExceptionNames[0]);
         nameTableOffset = SVGException::SVG_WRONG_TYPE_ERR;
 #endif
@@ -150,17 +207,20 @@ void getExceptionCodeDescription(ExceptionCode ec, ExceptionCodeDescription& des
         type = DOMExceptionType;
         typeName = "DOM";
         nameTable = exceptionNames;
+        descriptionTable = exceptionDescriptions;
         nameTableSize = sizeof(exceptionNames) / sizeof(exceptionNames[0]);
         nameTableOffset = INDEX_SIZE_ERR;
     }
 
     description.typeName = typeName;
     description.name = (ec >= nameTableOffset && ec - nameTableOffset < nameTableSize) ? nameTable[ec - nameTableOffset] : 0;
+    description.description = (ec >= nameTableOffset && ec - nameTableOffset < nameTableSize) ? descriptionTable[ec - nameTableOffset] : 0;
     description.code = code;
     description.type = type;
 
     // All exceptions used in the DOM code should have names.
     ASSERT(description.name);
+    ASSERT(description.description);
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/ExceptionCode.h b/WebCore/dom/ExceptionCode.h
index 58b18e2..573fb36 100644
--- a/WebCore/dom/ExceptionCode.h
+++ b/WebCore/dom/ExceptionCode.h
@@ -77,6 +77,7 @@ namespace WebCore {
     struct ExceptionCodeDescription {
         const char* typeName; // has spaces and is suitable for use in exception description strings; maximum length is 10 characters
         const char* name; // exception name, also intended for use in exception description strings; 0 if name not known; maximum length is 27 characters
+        const char* description; // exception description, intended for use in exception strings; more readable explanation of error
         int code; // numeric value of the exception within a particular type
         ExceptionType type;
     };
diff --git a/WebCore/dom/MouseRelatedEvent.cpp b/WebCore/dom/MouseRelatedEvent.cpp
index 4ed85ce..87815b1 100644
--- a/WebCore/dom/MouseRelatedEvent.cpp
+++ b/WebCore/dom/MouseRelatedEvent.cpp
@@ -57,7 +57,7 @@ static int contentsX(AbstractView* abstractView)
     FrameView* frameView = frame->view();
     if (!frameView)
         return 0;
-    return frameView->scrollX();
+    return frameView->scrollX() / frame->pageZoomFactor();
 }
 
 static int contentsY(AbstractView* abstractView)
@@ -70,7 +70,7 @@ static int contentsY(AbstractView* abstractView)
     FrameView* frameView = frame->view();
     if (!frameView)
         return 0;
-    return frameView->scrollY();
+    return frameView->scrollY() / frame->pageZoomFactor();
 }
 
 MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> viewArg,
diff --git a/WebCore/dom/QualifiedName.cpp b/WebCore/dom/QualifiedName.cpp
index 607c846..2c5f39a 100644
--- a/WebCore/dom/QualifiedName.cpp
+++ b/WebCore/dom/QualifiedName.cpp
@@ -97,4 +97,11 @@ void QualifiedName::init()
     }
 }
 
+const AtomicString& QualifiedName::localNameUpper() const
+{
+    if (!m_impl->m_localNameUpper)
+        m_impl->m_localNameUpper = m_impl->m_localName.upper();
+    return m_impl->m_localNameUpper;
+}
+
 }
diff --git a/WebCore/dom/QualifiedName.h b/WebCore/dom/QualifiedName.h
index 939927b..3b9f5c4 100644
--- a/WebCore/dom/QualifiedName.h
+++ b/WebCore/dom/QualifiedName.h
@@ -41,9 +41,10 @@ public:
             return adoptRef(new QualifiedNameImpl(prefix, localName, namespaceURI));
         }
 
-        AtomicString m_prefix;
-        AtomicString m_localName;
-        AtomicString m_namespace;
+        const AtomicString m_prefix;
+        const AtomicString m_localName;
+        const AtomicString m_namespace;
+        mutable AtomicString m_localNameUpper;
 
     private:
         QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
@@ -76,6 +77,9 @@ public:
     const AtomicString& localName() const { return m_impl->m_localName; }
     const AtomicString& namespaceURI() const { return m_impl->m_namespace; }
 
+    // Uppercased localName, cached for efficiency
+    const AtomicString& localNameUpper() const;
+
     String toString() const;
 
     QualifiedNameImpl* impl() const { return m_impl; }
diff --git a/WebCore/dom/ScriptExecutionContext.cpp b/WebCore/dom/ScriptExecutionContext.cpp
index 45d4e23..f7046e3 100644
--- a/WebCore/dom/ScriptExecutionContext.cpp
+++ b/WebCore/dom/ScriptExecutionContext.cpp
@@ -36,6 +36,10 @@
 #include <wtf/MainThread.h>
 #include <wtf/PassRefPtr.h>
 
+#if USE(JSC)
+#include "JSDOMWindow.h"
+#endif
+
 namespace WebCore {
 
 class ProcessMessagesSoonTask : public ScriptExecutionContext::Task {
@@ -195,4 +199,20 @@ ScriptExecutionContext::Task::~Task()
 {
 }
 
+#if USE(JSC)
+JSC::JSGlobalData* ScriptExecutionContext::globalData()
+{
+     if (isDocument())
+        return JSDOMWindow::commonJSGlobalData();
+
+#if ENABLE(WORKERS)
+    if (isWorkerContext())
+        return static_cast<WorkerContext*>(this)->script()->globalData();
+#endif
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index bb78b6f..398afec 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -104,6 +104,10 @@ namespace WebCore {
         void removeTimeout(int timeoutId);
         DOMTimer* findTimeout(int timeoutId);
 
+#if USE(JSC)
+        JSC::JSGlobalData* globalData();
+#endif
+
     protected:
         // Explicitly override the security origin for this script context.
         // Note: It is dangerous to change the security origin of a script context
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index 49713ba..3d2a549 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -479,12 +479,14 @@ bool SelectElement::appendFormData(SelectElementData& data, Element* element, Fo
     // We return the first one if it was a combobox select
     if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
         OptionElement* optionElement = toOptionElement(items[0]);
-        const AtomicString& value = optionElement->value();
-        if (value.isNull())
-            list.appendData(name, optionElement->text().stripWhiteSpace());
-        else
-            list.appendData(name, value);
-        successful = true;
+        if (optionElement) {
+            const AtomicString& value = optionElement->value();
+            if (value.isNull())
+                list.appendData(name, optionElement->text().stripWhiteSpace());
+            else
+                list.appendData(name, value);
+            successful = true;
+        }
     }
 
     return successful;
@@ -874,13 +876,19 @@ void SelectElement::typeAheadFind(SelectElementData& data, Element* element, Key
     int index = (optionToListIndex(data, element, selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
     ASSERT(index >= 0);
 
+    // Compute a case-folded copy of the prefix string before beginning the search for
+    // a matching element. This code uses foldCase to work around the fact that
+    // String::startWith does not fold non-ASCII characters. This code can be changed
+    // to use startWith once that is fixed.
+    String prefixWithCaseFolded(prefix.foldCase());
     for (int i = 0; i < itemCount; ++i, index = (index + 1) % itemCount) {
         OptionElement* optionElement = toOptionElement(items[index]);
         if (!optionElement || items[index]->disabled())
             continue;
 
+        // Fold the option string and check if its prefix is equal to the folded prefix.
         String text = optionElement->textIndentedToRespectGroupLabel();
-        if (stripLeadingWhiteSpace(text).startsWith(prefix, false)) {
+        if (stripLeadingWhiteSpace(text).foldCase().startsWith(prefixWithCaseFolded)) {
             setSelectedIndex(data, element, listToOptionIndex(data, element, index));
             if (!data.usesMenuList())
                 listBoxOnChange(data, element);
diff --git a/WebCore/dom/StyledElement.cpp b/WebCore/dom/StyledElement.cpp
index 5212380..46ce137 100644
--- a/WebCore/dom/StyledElement.cpp
+++ b/WebCore/dom/StyledElement.cpp
@@ -240,8 +240,8 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
         if (namedAttrMap) {
             if (attr->isNull())
                 namedAttrMap->setID(nullAtom);
-            else if (document()->inCompatMode() && !attr->value().impl()->isLower())
-                namedAttrMap->setID(AtomicString(attr->value().string().lower()));
+            else if (document()->inCompatMode())
+                namedAttrMap->setID(attr->value().lower());
             else
                 namedAttrMap->setID(attr->value());
         }
diff --git a/WebCore/dom/XMLTokenizer.cpp b/WebCore/dom/XMLTokenizer.cpp
index 4d06343..30d39e0 100644
--- a/WebCore/dom/XMLTokenizer.cpp
+++ b/WebCore/dom/XMLTokenizer.cpp
@@ -40,6 +40,7 @@
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
 #include "HTMLStyleElement.h"
+#include "ImageLoader.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
 #include "ResourceHandle.h"
@@ -78,15 +79,41 @@ bool XMLTokenizer::isWMLDocument() const
 }
 #endif
 
-void XMLTokenizer::setCurrentNode(Node* n)
+void XMLTokenizer::pushCurrentNode(Node* n)
 {
-    bool nodeNeedsReference = n && n != m_doc;
-    if (nodeNeedsReference)
-        n->ref(); 
-    if (m_currentNodeIsReferenced) 
-        m_currentNode->deref(); 
+    ASSERT(n);
+    ASSERT(m_currentNode);
+    if (n != m_doc)
+        n->ref();
+    m_currentNodeStack.append(m_currentNode);
     m_currentNode = n;
-    m_currentNodeIsReferenced = nodeNeedsReference;
+}
+
+void XMLTokenizer::popCurrentNode()
+{
+    ASSERT(m_currentNode);
+    ASSERT(m_currentNodeStack.size());
+
+    if (m_currentNode != m_doc)
+        m_currentNode->deref();
+
+    m_currentNode = m_currentNodeStack.last();
+    m_currentNodeStack.removeLast();
+}
+
+void XMLTokenizer::clearCurrentNodeStack()
+{
+    if (m_currentNode && m_currentNode != m_doc)
+        m_currentNode->deref();
+    m_currentNode = 0;
+
+    if (m_currentNodeStack.size()) { // Aborted parsing.
+        for (size_t i = m_currentNodeStack.size() - 1; i != 0; --i)
+            m_currentNodeStack[i]->deref();
+        if (m_currentNodeStack[0] && m_currentNodeStack[0] != m_doc)
+            m_currentNodeStack[0]->deref();
+        m_currentNodeStack.clear();
+    }
 }
 
 void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
@@ -105,6 +132,9 @@ void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     }
     
     doWrite(s.toString());
+    
+    // After parsing, go ahead and dispatch image beforeload/load events.
+    ImageLoader::dispatchPendingEvents();
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -139,7 +169,7 @@ bool XMLTokenizer::enterText()
     RefPtr<Node> newNode = Text::create(m_doc, "");
     if (!m_currentNode->addChild(newNode.get()))
         return false;
-    setCurrentNode(newNode.get());
+    pushCurrentNode(newNode.get());
     return true;
 }
 
@@ -169,10 +199,7 @@ void XMLTokenizer::exitText()
     if (m_view && m_currentNode && !m_currentNode->attached())
         m_currentNode->attach();
 
-    // FIXME: What's the right thing to do if the parent is really 0?
-    // Just leaving the current node set to the text node doesn't make much sense.
-    if (Node* par = m_currentNode->parentNode())
-        setCurrentNode(par);
+    popCurrentNode();
 }
 
 void XMLTokenizer::end()
@@ -186,7 +213,7 @@ void XMLTokenizer::end()
         m_doc->updateStyleSelector();
     }
     
-    setCurrentNode(0);
+    clearCurrentNodeStack();
     if (!m_parsingFragment)
         m_doc->finishedParsing();    
 }
@@ -296,7 +323,7 @@ void XMLTokenizer::notifyFinished(CachedResource* unusedResource)
     if (errorOccurred) 
         scriptElement->dispatchErrorEvent();
     else {
-        m_view->frame()->loader()->executeScript(sourceCode);
+        m_view->frame()->script()->executeScript(sourceCode);
         scriptElement->dispatchLoadEvent();
     }
 
diff --git a/WebCore/dom/XMLTokenizer.h b/WebCore/dom/XMLTokenizer.h
index 2ec1bfa..095e8db 100644
--- a/WebCore/dom/XMLTokenizer.h
+++ b/WebCore/dom/XMLTokenizer.h
@@ -233,7 +233,10 @@ public:
         friend bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent);
 
         void initializeParserContext(const char* chunk = 0);
-        void setCurrentNode(Node*);
+
+        void pushCurrentNode(Node*);
+        void popCurrentNode();
+        void clearCurrentNodeStack();
 
         void insertErrorMessageBlock();
 
@@ -257,7 +260,7 @@ public:
         Vector<xmlChar> m_bufferedText;
 #endif
         Node* m_currentNode;
-        bool m_currentNodeIsReferenced;
+        Vector<Node*> m_currentNodeStack;
 
         bool m_sawError;
         bool m_sawXSLTransform;
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index e4a98d5..9aa0961 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -530,7 +530,6 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_context(0)
     , m_pendingCallbacks(new PendingCallbacks)
     , m_currentNode(_doc)
-    , m_currentNodeIsReferenced(false)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -557,7 +556,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_context(0)
     , m_pendingCallbacks(new PendingCallbacks)
     , m_currentNode(fragment)
-    , m_currentNodeIsReferenced(fragment)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -576,8 +574,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
 {
-    if (fragment)
-        fragment->ref();
+    fragment->ref();
     if (m_doc)
         m_doc->ref();
           
@@ -614,7 +611,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
 
 XMLTokenizer::~XMLTokenizer()
 {
-    setCurrentNode(0);
+    clearCurrentNodeStack();
     if (m_parsingFragment && m_doc)
         m_doc->deref();
     if (m_pendingScript)
@@ -801,7 +798,7 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
         return;
     }
 
-    setCurrentNode(newElement.get());
+    pushCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
 
@@ -822,22 +819,29 @@ void XMLTokenizer::endElementNs()
     exitText();
 
     Node* n = m_currentNode;
-    RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
 
     if (!n->isElementNode() || !m_view) {
-        setCurrentNode(parent.get());
+        popCurrentNode();
         return;
     }
 
     Element* element = static_cast<Element*>(n);
+
+    // The element's parent may have already been removed from document.
+    // Parsing continues in this case, but scripts aren't executed.
+    if (!element->inDocument()) {
+        popCurrentNode();
+        return;
+    }
+
     ScriptElement* scriptElement = toScriptElement(element);
     if (!scriptElement) {
-        setCurrentNode(parent.get());
+        popCurrentNode();
         return;
     }
 
-    // don't load external scripts for standalone documents (for now)
+    // Don't load external scripts for standalone documents (for now).
     ASSERT(!m_pendingScript);
     m_requestingScript = true;
 
@@ -862,10 +866,10 @@ void XMLTokenizer::endElementNs()
             } else 
                 m_scriptElement = 0;
         } else
-            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+            m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
-    setCurrentNode(parent.get());
+    popCurrentNode();
 }
 
 void XMLTokenizer::characters(const xmlChar* s, int len)
@@ -887,7 +891,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     if (m_parserStopped)
         return;
 
-#if PLATFORM(WIN_OS)
+#if COMPILER(MSVC)
     char m[1024];
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
@@ -901,7 +905,7 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     else
         handleError(type, m, lineNumber(), columnNumber());
 
-#if !PLATFORM(WIN_OS)
+#if !COMPILER(MSVC)
     free(m);
 #endif
 }
diff --git a/WebCore/dom/XMLTokenizerQt.cpp b/WebCore/dom/XMLTokenizerQt.cpp
index 04405d6..c6e73ba 100644
--- a/WebCore/dom/XMLTokenizerQt.cpp
+++ b/WebCore/dom/XMLTokenizerQt.cpp
@@ -85,7 +85,6 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_view(_view)
     , m_wroteText(false)
     , m_currentNode(_doc)
-    , m_currentNodeIsReferenced(false)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -114,7 +113,6 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_view(0)
     , m_wroteText(false)
     , m_currentNode(fragment)
-    , m_currentNodeIsReferenced(fragment)
     , m_sawError(false)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
@@ -133,8 +131,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_scriptStartLine(0)
     , m_parsingFragment(true)
 {
-    if (fragment)
-        fragment->ref();
+    fragment->ref();
     if (m_doc)
         m_doc->ref();
           
@@ -188,7 +185,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
 
 XMLTokenizer::~XMLTokenizer()
 {
-    setCurrentNode(0);
+    clearCurrentNodeStack();
     if (m_parsingFragment && m_doc)
         m_doc->deref();
     if (m_pendingScript)
@@ -569,7 +566,7 @@ void XMLTokenizer::parseStartElement()
         return;
     }
 
-    setCurrentNode(newElement.get());
+    pushCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
 
@@ -582,18 +579,26 @@ void XMLTokenizer::parseEndElement()
     exitText();
 
     Node* n = m_currentNode;
-    RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
 
     if (!n->isElementNode() || !m_view) {
-        setCurrentNode(parent.get());
+        if (!m_currentNodeStack.isEmpty())
+            popCurrentNode();
         return;
     }
 
     Element* element = static_cast<Element*>(n);
+
+    // The element's parent may have already been removed from document.
+    // Parsing continues in this case, but scripts aren't executed.
+    if (!element->inDocument()) {
+        popCurrentNode();
+        return;
+    }
+
     ScriptElement* scriptElement = toScriptElement(element);
     if (!scriptElement) {
-        setCurrentNode(parent.get());
+        popCurrentNode();
         return;
     }
 
@@ -611,7 +616,8 @@ void XMLTokenizer::parseEndElement()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -621,10 +627,10 @@ void XMLTokenizer::parseEndElement()
             } else 
                 m_scriptElement = 0;
         } else
-            m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
+            m_view->frame()->script()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
     }
     m_requestingScript = false;
-    setCurrentNode(parent.get());
+    popCurrentNode();
 }
 
 void XMLTokenizer::parseCharacters()
diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index 83d0bd3..7a8f025 100644
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -334,6 +334,38 @@ static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID
     setTextDecorationProperty(style, newTextDecoration.get(), propertID);
 }
 
+static bool fontWeightIsBold(CSSStyleDeclaration* style)
+{
+    ASSERT(style);
+    RefPtr<CSSValue> fontWeight = style->getPropertyCSSValue(CSSPropertyFontWeight);
+
+    if (!fontWeight)
+        return false;
+    if (!fontWeight->isPrimitiveValue())
+        return false;
+
+    // Because b tag can only bold text, there are only two states in plain html: bold and not bold.
+    // Collapse all other values to either one of these two states for editing purposes.
+    switch (static_cast<CSSPrimitiveValue*>(fontWeight.get())->getIdent()) {
+        case CSSValue100:
+        case CSSValue200:
+        case CSSValue300:
+        case CSSValue400:
+        case CSSValue500:
+        case CSSValueNormal:
+            return false;
+        case CSSValueBold:
+        case CSSValue600:
+        case CSSValue700:
+        case CSSValue800:
+        case CSSValue900:
+            return true;
+    }
+
+    ASSERT_NOT_REACHED(); // For CSSValueBolder and CSSValueLighter
+    return false; // Make compiler happy
+}
+
 RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle)
 {
     ASSERT(style);
@@ -345,6 +377,9 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
     diffTextDecorations(result.get(), CSSPropertyTextDecoration, computedTextDecorationsInEffect.get());
     diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, computedTextDecorationsInEffect.get());
 
+    if (fontWeightIsBold(result.get()) == fontWeightIsBold(computedStyle))
+        result->removeProperty(CSSPropertyFontWeight);
+
     return result;
 }
 
@@ -352,7 +387,6 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
 // e.g. when a user inserts a new paragraph, all properties listed here must be copied to the new paragraph.
 // FIXME: The current editingStyleProperties contains all inheritableProperties but we may not need to preserve all inheritable properties
 static const int editingStyleProperties[] = {
-    CSSPropertyBackgroundColor,
     // CSS inheritable properties
     CSSPropertyBorderCollapse,
     CSSPropertyColor,
@@ -1079,6 +1113,23 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
     }
 }
 
+bool ApplyStyleCommand::shouldRemoveTextDecorationTag(CSSStyleDeclaration* styleToApply, int textDecorationAddedByTag) const
+{
+    // Honor text-decorations-in-effect
+    RefPtr<CSSValue> textDecorationsToApply = styleToApply->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    if (!textDecorationsToApply || !textDecorationsToApply->isValueList())
+        textDecorationsToApply = styleToApply->getPropertyCSSValue(CSSPropertyTextDecoration);
+
+    // When there is no text decorations to apply, remove any one of u, s, & strike
+    if (!textDecorationsToApply || !textDecorationsToApply->isValueList())
+        return true;
+
+    // Remove node if it implicitly adds style not present in styleToApply
+    CSSValueList* valueList = static_cast<CSSValueList*>(textDecorationsToApply.get());
+    RefPtr<CSSPrimitiveValue> value = CSSPrimitiveValue::createIdentifier(textDecorationAddedByTag);
+    return !valueList->hasValue(value.get());
+}
+
 // This function maps from styling tags to CSS styles.  Used for knowing which
 // styling tags should be removed when toggling styles.
 bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement* elem, CSSMutableStyleDeclaration* style)
@@ -1092,36 +1143,25 @@ bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(
         case CSSPropertyFontWeight:
             // IE inserts "strong" tags for execCommand("bold"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(bTag) || elem->hasLocalName(strongTag))
-                return true;
+                return !equalIgnoringCase(property.value()->cssText(), "bold") || !elem->hasChildNodes();
             break;
         case CSSPropertyVerticalAlign:
-            if (elem->hasLocalName(subTag) || elem->hasLocalName(supTag))
-                return true;
+            if (elem->hasLocalName(subTag))
+                return !equalIgnoringCase(property.value()->cssText(), "sub") || !elem->hasChildNodes();
+            if (elem->hasLocalName(supTag))
+                return !equalIgnoringCase(property.value()->cssText(), "sup") || !elem->hasChildNodes();
             break;
         case CSSPropertyFontStyle:
             // IE inserts "em" tags for execCommand("italic"), so we remove them, even though they're not strictly presentational
             if (elem->hasLocalName(iTag) || elem->hasLocalName(emTag))
-                return true;
+                return !equalIgnoringCase(property.value()->cssText(), "italic") || !elem->hasChildNodes();
             break;
         case CSSPropertyTextDecoration:
         case CSSPropertyWebkitTextDecorationsInEffect:
-                ASSERT(property.value());
-                if (property.value()->isValueList()) {
-                    CSSValueList* valueList = static_cast<CSSValueList*>(property.value());
-                    DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
-                    DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
-                    // Because style is new style to be applied, we delete element only if the element is not used in style.
-                    if (!valueList->hasValue(underline.get()) && elem->hasLocalName(uTag))
-                        return true;
-                    if (!valueList->hasValue(lineThrough.get()) && (elem->hasLocalName(strikeTag) || elem->hasLocalName(sTag)))
-                        return true;
-                } else {
-                    // If the value is NOT a list, then it must be "none", in which case we should remove all text decorations.
-                    ASSERT(property.value()->cssText() == "none");
-                    if (elem->hasLocalName(uTag) || elem->hasLocalName(strikeTag) || elem->hasLocalName(sTag))
-                        return true;
-                }
-                break;
+                if (elem->hasLocalName(uTag))
+                    return shouldRemoveTextDecorationTag(style, CSSValueUnderline) || !elem->hasChildNodes();
+                else if (elem->hasLocalName(sTag) || elem->hasTagName(strikeTag))
+                    return shouldRemoveTextDecorationTag(style,CSSValueLineThrough) || !elem->hasChildNodes();
         }
     }
     return false;
@@ -1307,19 +1347,18 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
     if (!style || style->cssText().isEmpty())
         return;
 
-    if (node->isTextNode()) {
-        RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
-        surroundNodeRangeWithElement(node, node, styleSpan.get());
-        node = styleSpan.get();
-    }
-
-    if (!node->isElementNode())
-        return;
+    StyleChange styleChange(style, Position(node, 0));
+    if (styleChange.cssStyle().length()) {
+        if (node->isTextNode()) {
+            RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
+            surroundNodeRangeWithElement(node, node, styleSpan.get());
+            node = styleSpan.get();
+        }
 
-    HTMLElement *element = static_cast<HTMLElement *>(node);
+        if (!node->isElementNode())
+            return;
 
-    StyleChange styleChange(style, Position(element, 0));
-    if (styleChange.cssStyle().length()) {
+        HTMLElement *element = static_cast<HTMLElement *>(node);
         String cssText = styleChange.cssStyle();
         CSSMutableStyleDeclaration *decl = element->inlineStyleDecl();
         if (decl)
@@ -1679,6 +1718,20 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(Node* startNode, Node* endN
             break;
         node = next;
     }
+
+    Node* nextSibling = element->nextSibling();
+    Node* previousSibling = element->previousSibling();
+    if (nextSibling && nextSibling->isElementNode() && nextSibling->isContentEditable()
+        && areIdenticalElements(element.get(), static_cast<Element*>(nextSibling)))
+        mergeIdenticalElements(element, static_cast<Element*>(nextSibling));
+
+    if (previousSibling && previousSibling->isElementNode() && previousSibling->isContentEditable()) {
+        Node* mergedElement = previousSibling->nextSibling();
+        if (mergedElement->isElementNode() && mergedElement->isContentEditable()
+            && areIdenticalElements(static_cast<Element*>(previousSibling), static_cast<Element*>(mergedElement)))
+            mergeIdenticalElements(static_cast<Element*>(previousSibling), static_cast<Element*>(mergedElement));
+    }
+
     // FIXME: We should probably call updateStartEnd if the start or end was in the node
     // range so that the endingSelection() is canonicalized.  See the comments at the end of
     // VisibleSelection::validate().
diff --git a/WebCore/editing/ApplyStyleCommand.h b/WebCore/editing/ApplyStyleCommand.h
index 29aa483..2804604 100644
--- a/WebCore/editing/ApplyStyleCommand.h
+++ b/WebCore/editing/ApplyStyleCommand.h
@@ -62,6 +62,7 @@ private:
     CSSMutableStyleDeclaration* style() const { return m_style.get(); }
 
     // style-removal helpers
+    bool shouldRemoveTextDecorationTag(CSSStyleDeclaration* styleToApply, int textDecorationAddedByTag) const;
     bool implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement*, CSSMutableStyleDeclaration*);
     void replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&);
     void removeHTMLFontStyle(CSSMutableStyleDeclaration*, HTMLElement*);
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 0496a8f..1617be8 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -71,7 +71,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-CompositeEditCommand::CompositeEditCommand(Document *document) 
+CompositeEditCommand::CompositeEditCommand(Document *document)
     : EditCommand(document)
 {
 }
@@ -396,7 +396,7 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
     Node* node = position.node();
     if (!node || !node->isTextNode())
         return;
-    Text* textNode = static_cast<Text*>(node);    
+    Text* textNode = static_cast<Text*>(node);
     
     if (textNode->length() == 0)
         return;
@@ -739,6 +739,129 @@ void CompositeEditCommand::pushPartiallySelectedAnchorElementsDown()
     setEndingSelection(originalSelection);
 }
 
+// Clone the paragraph between start and end under blockElement,
+// preserving the hierarchy up to outerNode. 
+
+void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement)
+{
+    // First we clone the outerNode
+    
+    RefPtr<Node> lastNode = outerNode->cloneNode(isTableElement(outerNode));
+    appendNode(lastNode, blockElement);
+
+    if (start.node() != outerNode) {
+        Vector<RefPtr<Node> > ancestors;
+        
+        // Insert each node from innerNode to outerNode (excluded) in a list.
+        for (Node* n = start.node(); n && n != outerNode; n = n->parentNode())
+            ancestors.append(n);
+
+        // Clone every node between start.node() and outerBlock.
+
+        for (size_t i = ancestors.size(); i != 0; --i) {
+            Node* item = ancestors[i - 1].get();
+            RefPtr<Node> child = item->cloneNode(isTableElement(item));
+            appendNode(child, static_cast<Element *>(lastNode.get()));
+            lastNode = child.release();
+        }
+    }
+
+    // Handle the case of paragraphs with more than one node,
+    // cloning all the siblings until end.node() is reached.
+    
+    if (start.node() != end.node()) {
+        for (Node* n = start.node()->nextSibling(); n != NULL; n = n->nextSibling()) {
+            RefPtr<Node> clonedNode = n->cloneNode(true);
+            insertNodeAfter(clonedNode, lastNode);
+            lastNode = clonedNode.release();
+            if (n == end.node())
+                break;
+        }
+    }
+}
+
+    
+// There are bugs in deletion when it removes a fully selected table/list.
+// It expands and removes the entire table/list, but will let content
+// before and after the table/list collapse onto one line.   
+// Deleting a paragraph will leave a placeholder. Remove it (and prune
+// empty or unrendered parents).
+
+void CompositeEditCommand::cleanupAfterDeletion()
+{
+    VisiblePosition caretAfterDelete = endingSelection().visibleStart();
+    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
+        // Note: We want the rightmost candidate.
+        Position position = caretAfterDelete.deepEquivalent().downstream();
+        Node* node = position.node();
+        // Normally deletion will leave a br as a placeholder.
+        if (node->hasTagName(brTag))
+            removeNodeAndPruneAncestors(node);
+        // If the selection to move was empty and in an empty block that 
+        // doesn't require a placeholder to prop itself open (like a bordered
+        // div or an li), remove it during the move (the list removal code
+        // expects this behavior).
+        else if (isBlock(node))
+            removeNodeAndPruneAncestors(node);
+        else if (lineBreakExistsAtPosition(position)) {
+            // There is a preserved '\n' at caretAfterDelete.
+            // We can safely assume this is a text node.
+            Text* textNode = static_cast<Text*>(node);
+            if (textNode->length() == 1)
+                removeNodeAndPruneAncestors(node);
+            else
+                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
+        }
+    }
+}
+    
+// This is a version of moveParagraph that preserves style by keeping the original markup
+// It is currently used only by IndentOutdentCommand but it is meant to be used in the
+// future by several other commands such as InsertList and the align commands.
+// The blockElement parameter is the element to move the paragraph to,
+// outerNode is the top element of the paragraph hierarchy. 
+
+void CompositeEditCommand::moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode)
+{
+    ASSERT(outerNode);
+    ASSERT(blockElement);
+
+    VisiblePosition beforeParagraph = startOfParagraphToMove.previous();
+    VisiblePosition afterParagraph(endOfParagraphToMove.next());
+    
+    // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
+    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
+    Position start = startOfParagraphToMove.deepEquivalent().downstream();
+    Position end = endOfParagraphToMove.deepEquivalent().upstream();
+
+    cloneParagraphUnderNewElement(start, end, outerNode, blockElement);
+      
+    setEndingSelection(VisibleSelection(start, end, DOWNSTREAM));
+    deleteSelection(false, false, false, false);
+    
+    // There are bugs in deletion when it removes a fully selected table/list.
+    // It expands and removes the entire table/list, but will let content
+    // before and after the table/list collapse onto one line.
+       
+    cleanupAfterDeletion();
+    
+    // Add a br if pruning an empty block level element caused a collapse.  For example:
+    // foo^
+    // <div>bar</div>
+    // baz
+    // Imagine moving 'bar' to ^.  'bar' will be deleted and its div pruned.  That would
+    // cause 'baz' to collapse onto the line with 'foobar' unless we insert a br.
+    // Must recononicalize these two VisiblePositions after the pruning above.
+    beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
+    afterParagraph = VisiblePosition(afterParagraph.deepEquivalent());
+
+    if (beforeParagraph.isNotNull() && !isTableElement(beforeParagraph.deepEquivalent().node()) && (!isEndOfParagraph(beforeParagraph) || beforeParagraph == afterParagraph)) {
+        // FIXME: Trim text between beforeParagraph and afterParagraph if they aren't equal.
+        insertNodeAt(createBreakElement(document()), beforeParagraph.deepEquivalent());
+    }
+}
+    
+    
 // This moves a paragraph preserving its style.
 void CompositeEditCommand::moveParagraph(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, const VisiblePosition& destination, bool preserveSelection, bool preserveStyle)
 {
@@ -784,7 +907,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     VisiblePosition afterParagraph(endOfParagraphToMove.next());
 
     // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
-    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.    
+    // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
     Position start = startOfParagraphToMove.deepEquivalent().downstream();
     Position end = endOfParagraphToMove.deepEquivalent().upstream();
     
@@ -793,7 +916,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     Position endRangeCompliant = rangeCompliantEquivalent(end);
     RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.deprecatedEditingOffset(), endRangeCompliant.node(), endRangeCompliant.deprecatedEditingOffset());
 
-    // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
+    // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move. It
     // shouldn't matter though, since moved paragraphs will usually be quite small.
     RefPtr<DocumentFragment> fragment = startOfParagraphToMove != endOfParagraphToMove ? createFragmentFromMarkup(document(), createMarkup(range.get(), 0, DoNotAnnotateForInterchange, true), "") : 0;
     
@@ -813,42 +936,14 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().node()->inDocument());
-    
-    // There are bugs in deletion when it removes a fully selected table/list.  
-    // It expands and removes the entire table/list, but will let content
-    // before and after the table/list collapse onto one line.
-    
-    // Deleting a paragraph will leave a placeholder.  Remove it (and prune
-    // empty or unrendered parents).
-    VisiblePosition caretAfterDelete = endingSelection().visibleStart();
-    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
-        // Note: We want the rightmost candidate.
-        Position position = caretAfterDelete.deepEquivalent().downstream();
-        Node* node = position.node();
-        // Normally deletion will leave a br as a placeholder.
-        if (node->hasTagName(brTag))
-            removeNodeAndPruneAncestors(node);
-        // If the selection to move was empty and in an empty block that 
-        // doesn't require a placeholder to prop itself open (like a bordered 
-        // div or an li), remove it during the move (the list removal code 
-        // expects this behavior).
-        else if (isBlock(node))
-            removeNodeAndPruneAncestors(node);
-        else if (lineBreakExistsAtVisiblePosition(caretAfterDelete)) {
-            // There is a preserved '\n' at caretAfterDelete.
-            Text* textNode = static_cast<Text*>(node);
-            if (textNode->length() == 1)
-                removeNodeAndPruneAncestors(node);
-            else 
-                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
-        }
-    }
 
-    // Add a br if pruning an empty block level element caused a collapse.  For example:
+    cleanupAfterDeletion();
+
+    // Add a br if pruning an empty block level element caused a collapse. For example:
     // foo^
     // <div>bar</div>
     // baz
-    // Imagine moving 'bar' to ^.  'bar' will be deleted and its div pruned.  That would
+    // Imagine moving 'bar' to ^. 'bar' will be deleted and its div pruned. That would
     // cause 'baz' to collapse onto the line with 'foobar' unless we insert a br.
     // Must recononicalize these two VisiblePositions after the pruning above.
     beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
@@ -912,7 +1007,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
                 removeNodePreservingChildren(listNode->parentNode());
                 newBlock = createListItemElement(document());
             }
-            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph. 
+            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph.
         } else if (blockEnclosingList->hasTagName(olTag) || blockEnclosingList->hasTagName(ulTag))
             newBlock = createListItemElement(document());
     }
@@ -971,7 +1066,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     // to hold the caret before the highest blockquote.
     insertNodeBefore(br, highestBlockquote);
     VisiblePosition atBR(Position(br.get(), 0));
-    // If the br we inserted collapsed, for example foo<br><blockquote>...</blockquote>, insert 
+    // If the br we inserted collapsed, for example foo<br><blockquote>...</blockquote>, insert
     // a second one.
     if (!isStartOfParagraph(atBR))
         insertNodeBefore(createBreakElement(document()), br);
@@ -1002,7 +1097,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     return true;
 }
 
-// Operations use this function to avoid inserting content into an anchor when at the start or the end of 
+// Operations use this function to avoid inserting content into an anchor when at the start or the end of
 // that anchor, as in NSTextView.
 // FIXME: This is only an approximation of NSTextViews insertion behavior, which varies depending on how
 // the caret was made. 
@@ -1022,7 +1117,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
         VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
         VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
-        // If visually just after the anchor, insert *inside* the anchor unless it's the last 
+        // If visually just after the anchor, insert *inside* the anchor unless it's the last
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
             // Make sure anchors are pushed down before avoiding them so that we don't
diff --git a/WebCore/editing/CompositeEditCommand.h b/WebCore/editing/CompositeEditCommand.h
index 2c6403e..0cceaaa 100644
--- a/WebCore/editing/CompositeEditCommand.h
+++ b/WebCore/editing/CompositeEditCommand.h
@@ -102,6 +102,9 @@ protected:
     
     void moveParagraph(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
     void moveParagraphs(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
+    void moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode);
+    void cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement);
+    void cleanupAfterDeletion();
     
     bool breakOutOfEmptyListItem();
     bool breakOutOfEmptyMailBlockquotedParagraph();
diff --git a/WebCore/editing/EditorCommand.cpp b/WebCore/editing/EditorCommand.cpp
index abd0174..3379b3c 100644
--- a/WebCore/editing/EditorCommand.cpp
+++ b/WebCore/editing/EditorCommand.cpp
@@ -1291,10 +1291,10 @@ static String valueForeColor(Frame* frame, Event*)
 
 // Map of functions
 
+struct CommandEntry { const char* name; EditorInternalCommand command; };
+
 static const CommandMap& createCommandMap()
 {
-    struct CommandEntry { const char* name; EditorInternalCommand command; };
-    
     static const CommandEntry commands[] = {
         { "AlignCenter", { executeJustifyCenter, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "AlignJustified", { executeJustifyFull, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index 308ba74..808a2f8 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -33,7 +33,6 @@
 #include "InsertLineBreakCommand.h"
 #include "InsertListCommand.h"
 #include "Range.h"
-#include "DocumentFragment.h"
 #include "SplitElementCommand.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
@@ -81,14 +80,15 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     // FIXME: we need to deal with the case where there is no li (malformed HTML)
     if (!selectedListItem->hasTagName(liTag))
         return false;
-
+    
     // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
     Element* previousList = selectedListItem->previousElementSibling();
     Element* nextList = selectedListItem->nextElementSibling();
 
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
     insertNodeBefore(newList, selectedListItem);
-    appendParagraphIntoNode(visiblePositionBeforeNode(selectedListItem), visiblePositionAfterNode(selectedListItem), newList.get());
+
+    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, newList.get(), selectedListItem);
 
     if (canMergeLists(previousList, newList.get()))
         mergeIdenticalElements(previousList, newList);
@@ -98,87 +98,44 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     return true;
 }
     
-void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& startOfCurrentParagraph, const VisiblePosition& endOfCurrentParagraph, RefPtr<Element>& targetBlockquote, Node* nodeToSplitTo)
+void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
 {
     Node* enclosingCell = 0;
 
+    Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+    enclosingCell = enclosingNodeOfType(start, &isTableCell);
+    Node* nodeToSplitTo;
+    if (enclosingCell)
+        nodeToSplitTo = enclosingCell;
+    else if (enclosingList(start.node()))
+        nodeToSplitTo = enclosingBlock(start.node());
+    else
+        nodeToSplitTo = editableRootForPosition(start);
+
+    RefPtr<Node> outerBlock = splitTreeToNode(start.node(), nodeToSplitTo);
+
     if (!targetBlockquote) {
-        // Create a new blockquote and insert it as a child of the enclosing block element. We accomplish
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
         // this by splitting all parents of the current paragraph up to that point.
         targetBlockquote = createIndentBlockquoteElement(document());
-        if (isTableCell(nodeToSplitTo))
-            enclosingCell = nodeToSplitTo;
-        RefPtr<Node> startOfNewBlock = splitTreeToNode(startOfCurrentParagraph.deepEquivalent().node(), nodeToSplitTo);
-        insertNodeBefore(targetBlockquote, startOfNewBlock);
+        insertNodeBefore(targetBlockquote, outerBlock);
     }
 
-    VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-    appendParagraphIntoNode(startOfCurrentParagraph, endOfCurrentParagraph, targetBlockquote.get());
-
+    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, targetBlockquote.get(), outerBlock.get());
+    
     // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
     // the next paragraph is in the same cell.
     if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
         targetBlockquote = 0;
 }
 
-// Enclose all nodes between start and end by newParent, which is a sibling node of nodes between start and end
-// FIXME: moveParagraph is overly complicated.  We need to clean up moveParagraph so that it uses appendParagraphIntoNode
-// or prepare more specialized functions and delete moveParagraph
-void IndentOutdentCommand::appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent)
-{
-    ASSERT(newParent);
-    ASSERT(newParent->isContentEditable());
-    ASSERT(isStartOfParagraph(start) && isEndOfParagraph(end));
-
-    Position endOfParagraph = end.deepEquivalent().downstream();
-    Node* insertionPoint = newParent->lastChild();// Remember the place to put br later
-    // Look for the beginning of the last paragraph in newParent
-    Node* startOfLastParagraph = startOfParagraph(Position(newParent, newParent->childNodeCount())).deepEquivalent().node();
-    if (startOfLastParagraph && !startOfLastParagraph->isDescendantOf(newParent))
-        startOfLastParagraph = 0;
-
-    // Extend the range so that we can append wrapping nodes as well if they're containd within the paragraph
-    ExceptionCode ec = 0;
-    RefPtr<Range> selectedRange = createRange(document(), start, end, ec);
-    RefPtr<Range> extendedRange = extendRangeToWrappingNodes(selectedRange, selectedRange.get(), newParent->parentNode());
-    newParent->appendChild(extendedRange->extractContents(ec), ec);
-
-    // If the start of paragraph didn't change by appending nodes, we should insert br to seperate the paragraphs.
-    Node* startOfNewParagraph = startOfParagraph(Position(newParent, newParent->childNodeCount())).deepEquivalent().node();
-    if (startOfNewParagraph == startOfLastParagraph) {
-        if (insertionPoint)
-            newParent->insertBefore(createBreakElement(document()), insertionPoint->nextSibling(), ec);
-        else
-            newParent->appendChild(createBreakElement(document()), ec);
-    }
-
-    // Remove unnecessary br from the place where we moved the paragraph from
-    removeUnnecessaryLineBreakAt(endOfParagraph);
-}
-
-void IndentOutdentCommand::removeUnnecessaryLineBreakAt(const Position& endOfParagraph)
-{
-    // If there is something in this paragraph, then don't remove br.
-    if (!isStartOfParagraph(endOfParagraph) || !isEndOfParagraph(endOfParagraph))
-        return;
-
-    // We only care about br at the end of paragraph
-    Node* br = endOfParagraph.node();
-    Node* parentNode = br->parentNode();
-
-    // If the node isn't br or the parent node is empty, then don't remove.
-    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionInParentBeforeNode(parentNode), positionInParentAfterNode(parentNode)))
-        return;
-
-    removeNodeAndPruneAncestors(br);
-}
-
 void IndentOutdentCommand::indentRegion()
 {
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
-    RefPtr<Range> selectedRange = selection.firstRange();
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
 
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
@@ -203,24 +160,8 @@ void IndentOutdentCommand::indentRegion()
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (tryIndentingAsListItem(endOfCurrentParagraph))
             blockquoteForNextIndent = 0;
-        else {
-            VisiblePosition startOfCurrentParagraph = startOfParagraph(endOfCurrentParagraph);
-            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
-            // extend the region so that it contains all the ancestor blocks within the selection
-            ExceptionCode ec;
-            Element* unsplittableNode = unsplittableElementForPosition(endOfCurrentParagraph.deepEquivalent());
-            RefPtr<Range> originalRange = createRange(document(), endOfCurrentParagraph, endOfCurrentParagraph, ec);
-            RefPtr<Range> extendedRange = extendRangeToWrappingNodes(originalRange, selectedRange.get(), unsplittableNode);
-            if (originalRange != extendedRange) {
-                ExceptionCode ec = 0;
-                endOfCurrentParagraph = endOfParagraph(extendedRange->endPosition().previous());
-                blockNode = enclosingBlock(extendedRange->commonAncestorContainer(ec));
-            }
-
-            endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-            indentIntoBlockquote(startOfCurrentParagraph, endOfCurrentParagraph, blockquoteForNextIndent, blockNode);
-            // blockquoteForNextIndent will be updated in the function
-        }
+        else
+            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
         // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
         // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
@@ -229,7 +170,13 @@ void IndentOutdentCommand::indentRegion()
         }
         endOfCurrentParagraph = endOfNextParagraph;
     }
-
+    
+    updateLayout();
+    
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::outdentParagraph()
diff --git a/WebCore/editing/IndentOutdentCommand.h b/WebCore/editing/IndentOutdentCommand.h
index d83128e..817b4c8 100644
--- a/WebCore/editing/IndentOutdentCommand.h
+++ b/WebCore/editing/IndentOutdentCommand.h
@@ -46,14 +46,11 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    void appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent);
-    void removeUnnecessaryLineBreakAt(const Position& endOfParagraph);
-
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
     bool tryIndentingAsListItem(const VisiblePosition&);
-    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>& targetBlockquote, Node* nodeToSplitTo);
+    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
index 21ca924..0874201 100644
--- a/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
+++ b/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -57,7 +57,9 @@ static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeT
     parentNode->insertBefore(newNode, nodeToReplace, ec);
     ASSERT(!ec);
 
-    for (Node* child = nodeToReplace->firstChild(); child; child = child->nextSibling()) {
+    Node* nextChild;
+    for (Node* child = nodeToReplace->firstChild(); child; child = nextChild) {
+        nextChild = child->nextSibling();
         newNode->appendChild(child, ec);
         ASSERT(!ec);
     }
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index 7d99916..00672f2 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -725,6 +725,8 @@ bool SelectionController::modify(EAlteration alter, int verticalDistance, bool u
     if (userTriggered)
         m_frame->setSelectionGranularity(CharacterGranularity);
 
+    m_lastChangeWasHorizontalExtension = alter == EXTEND;
+
     return true;
 }
 
diff --git a/WebCore/editing/VisibleSelection.cpp b/WebCore/editing/VisibleSelection.cpp
index 8adfd71..206de86 100644
--- a/WebCore/editing/VisibleSelection.cpp
+++ b/WebCore/editing/VisibleSelection.cpp
@@ -237,7 +237,7 @@ void VisibleSelection::appendTrailingWhitespace()
 
     for (; charIt.length(); charIt.advance(1)) {
         UChar c = charIt.characters()[0];
-        if (!isSpaceOrNewline(c) && c != noBreakSpace)
+        if (!isSpaceOrNewline(c) && c != noBreakSpace || c == '\n')
             break;
         m_end = charIt.range()->endPosition();
     }
diff --git a/WebCore/history/qt/HistoryItemQt.cpp b/WebCore/history/qt/HistoryItemQt.cpp
index 098a786..c5fb069 100644
--- a/WebCore/history/qt/HistoryItemQt.cpp
+++ b/WebCore/history/qt/HistoryItemQt.cpp
@@ -23,10 +23,13 @@
 #include "CString.h"
 #include "FormData.h"
 
-bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
+bool WebCore::HistoryItem::restoreState(QDataStream& in, int version)
 {
-    // there is no different version right now
-    // switch  (version) {
+    // we only support version 1 for now
+
+    if (version != 1)
+        return false;
+
     WebCore::String url;
     WebCore::String title;
     WebCore::String altTitle;
@@ -87,10 +90,12 @@ bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
     return in.status() == QDataStream::Ok;
 }
 
-QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int /*version*/) const
+QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int version) const
 {
-    // there is no different version right now
-    // switch  (version) {
+    // we only support version 1 for now.
+    if (version != 1)
+        return out;
+
     out << urlString() << title() << alternateTitle() << lastVisitedTime();
     out << originalURLString() << referrer() << target() << parent();
     out << lastVisitWasHTTPNonGet() << lastVisitWasFailure() << isTargetItem();
diff --git a/WebCore/html/HTMLAllCollection.cpp b/WebCore/html/HTMLAllCollection.cpp
new file mode 100644
index 0000000..dbfed28
--- /dev/null
+++ b/WebCore/html/HTMLAllCollection.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLAllCollection.h"
+
+#include "Node.h"
+
+namespace WebCore {
+
+PassRefPtr<HTMLAllCollection> HTMLAllCollection::create(PassRefPtr<Node> base)
+{
+    return adoptRef(new HTMLAllCollection(base));
+}
+
+HTMLAllCollection::HTMLAllCollection(PassRefPtr<Node> base)
+    : HTMLCollection(base, DocAll)
+{
+}
+
+HTMLAllCollection::~HTMLAllCollection()
+{
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/HTMLAllCollection.h b/WebCore/html/HTMLAllCollection.h
new file mode 100644
index 0000000..1dd3ede
--- /dev/null
+++ b/WebCore/html/HTMLAllCollection.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLAllCollection_h
+#define HTMLAllCollection_h
+
+#include "HTMLCollection.h"
+
+namespace WebCore {
+
+class HTMLAllCollection : public HTMLCollection {
+public:
+    static PassRefPtr<HTMLAllCollection> create(PassRefPtr<Node>);
+    virtual ~HTMLAllCollection();
+
+private:
+    HTMLAllCollection(PassRefPtr<Node>);
+};
+
+} // namespace WebCore
+
+#endif // HTMLAllCollection_h
diff --git a/WebCore/html/HTMLAllCollection.idl b/WebCore/html/HTMLAllCollection.idl
new file mode 100644
index 0000000..d36f41e
--- /dev/null
+++ b/WebCore/html/HTMLAllCollection.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter,
+        HasNameGetter,
+        CustomCall,
+        MasqueradesAsUndefined
+    ] HTMLAllCollection {
+        readonly attribute unsigned long length;
+        [Custom] Node item(in unsigned long index);
+        [Custom] Node namedItem(in DOMString name);
+
+        // FIXME: This should return an HTMLAllCollection.
+        NodeList tags(in DOMString name);
+    };
+
+}
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index daa7919..968f144 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -27,6 +27,7 @@
 #include "DNS.h"
 #include "EventNames.h"
 #include "Frame.h"
+#include "FrameLoaderTypes.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
@@ -43,6 +44,7 @@ using namespace HTMLNames;
 HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document, CreateElement)
     , m_wasShiftKeyDownOnMouseDown(false)
+    , m_linkRelations(0)
 {
 }
 
@@ -67,7 +69,7 @@ bool HTMLAnchorElement::supportsFocus() const
 bool HTMLAnchorElement::isMouseFocusable() const
 {
     // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
-#if !PLATFORM(GTK)
+#if PLATFORM(MAC)
     if (isLink())
         return false;
 #endif
@@ -200,7 +202,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         }
 
         if (!evt->defaultPrevented() && document()->frame())
-            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true);
+            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true, hasRel(RelationNoReferrer) ? NoReferrer : SendReferrer);
 
         evt->setDefaultHandled();
     } else if (isLink() && isContentEditable()) {
@@ -274,10 +276,11 @@ void HTMLAnchorElement::parseMappedAttribute(MappedAttribute *attr)
             }
         }
     } else if (attr->name() == nameAttr ||
-             attr->name() == titleAttr ||
-             attr->name() == relAttr) {
+             attr->name() == titleAttr) {
         // Do nothing.
-    } else
+    } else if (attr->name() == relAttr)
+        setRel(attr->value());
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -321,6 +324,20 @@ void HTMLAnchorElement::setHref(const AtomicString& value)
     setAttribute(hrefAttr, value);
 }
 
+bool HTMLAnchorElement::hasRel(uint32_t relation) const
+{
+    return m_linkRelations & relation;
+}
+
+void HTMLAnchorElement::setRel(const String& value)
+{
+    m_linkRelations = 0;
+    ClassNames newLinkRelations(value, true);
+    // FIXME: Add link relations as they are implemented
+    if (newLinkRelations.contains("noreferrer"))
+        m_linkRelations |= RelationNoReferrer;
+}
+
 const AtomicString& HTMLAnchorElement::name() const
 {
     return getAttribute(nameAttr);
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index f538be2..e47ea99 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -28,6 +28,29 @@
 
 namespace WebCore {
 
+// Link relation bitmask values.
+// FIXME: Uncomment as the various link relations are implemented.
+enum {
+//     RelationAlternate   = 0x00000001,
+//     RelationArchives    = 0x00000002,
+//     RelationAuthor      = 0x00000004,
+//     RelationBoomark     = 0x00000008,
+//     RelationExternal    = 0x00000010,
+//     RelationFirst       = 0x00000020,
+//     RelationHelp        = 0x00000040,
+//     RelationIndex       = 0x00000080,
+//     RelationLast        = 0x00000100,
+//     RelationLicense     = 0x00000200,
+//     RelationNext        = 0x00000400,
+//     RelationNoFolow    = 0x00000800,
+    RelationNoReferrer     = 0x00001000,
+//     RelationPrev        = 0x00002000,
+//     RelationSearch      = 0x00004000,
+//     RelationSidebar     = 0x00008000,
+//     RelationTag         = 0x00010000,
+//     RelationUp          = 0x00020000,
+};
+
 class HTMLAnchorElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLAnchorElement> create(Document*);
@@ -51,6 +74,9 @@ public:
 
     bool isLiveLink() const;
 
+    bool hasRel(uint32_t relation) const;
+    void setRel(const String&);
+
 protected:
     HTMLAnchorElement(const QualifiedName&, Document*);
 
@@ -73,6 +99,7 @@ private:
 
     RefPtr<Element> m_rootEditableElementForSelectionOnMouseDown;
     bool m_wasShiftKeyDownOnMouseDown;
+    uint32_t m_linkRelations;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index 3e16015..ac8ce11 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -158,7 +158,6 @@ onkeyup
 onload
 onloadeddata
 onloadedmetadata
-onloadend
 onloadstart
 onmousedown
 onmousemove
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index e3fe329..7bae6e3 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -138,7 +138,7 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
         return String();
     }
 
-    if (m_size.isEmpty())
+    if (m_size.isEmpty() || !buffer())
         return String("data:,");
 
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType))
@@ -172,10 +172,11 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
             if (m_context && !m_context->is3d())
                 return 0;
             if (!m_context) {
-                m_context = new CanvasRenderingContext3D(this);
-
-                // Need to make sure a RenderLayer and compositing layer get created for the Canvas
-                setNeedsStyleRecalc(SyntheticStyleChange);
+                m_context = CanvasRenderingContext3D::create(this);
+                if (m_context) {
+                    // Need to make sure a RenderLayer and compositing layer get created for the Canvas
+                    setNeedsStyleRecalc(SyntheticStyleChange);
+                }
             }
             return m_context.get();
         }
diff --git a/WebCore/html/HTMLCollection.h b/WebCore/html/HTMLCollection.h
index b04bcbc..eea1777 100644
--- a/WebCore/html/HTMLCollection.h
+++ b/WebCore/html/HTMLCollection.h
@@ -64,6 +64,7 @@ public:
 
 protected:
     HTMLCollection(PassRefPtr<Node> base, CollectionType, CollectionCache*);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType);
 
     CollectionCache* info() const { return m_info; }
     void resetCollectionInfo() const;
@@ -71,8 +72,6 @@ protected:
     mutable bool m_idsDone; // for nextNamedItem()
 
 private:
-    HTMLCollection(PassRefPtr<Node> base, CollectionType);
-
     virtual Element* itemAfter(Element*) const;
     virtual unsigned calcLength() const;
     virtual void updateNameCache() const;
diff --git a/WebCore/html/HTMLCollection.idl b/WebCore/html/HTMLCollection.idl
index 1ba5ec7..45d1127 100644
--- a/WebCore/html/HTMLCollection.idl
+++ b/WebCore/html/HTMLCollection.idl
@@ -34,8 +34,9 @@ module html {
         [Custom] Node item(in unsigned long index);
         [Custom] Node namedItem(in DOMString name);
 
-        // Extensions
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         NodeList tags(in DOMString name);
+#endif
     };
 
 }
diff --git a/WebCore/html/HTMLDocument.cpp b/WebCore/html/HTMLDocument.cpp
index d00fc6c..c04f73f 100644
--- a/WebCore/html/HTMLDocument.cpp
+++ b/WebCore/html/HTMLDocument.cpp
@@ -307,8 +307,7 @@ PassRefPtr<Element> HTMLDocument::createElement(const AtomicString& name, Except
         ec = INVALID_CHARACTER_ERR;
         return 0;
     }
-    AtomicString lowerName = name.string().impl()->isLower() ? name : AtomicString(name.string().lower());
-    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, lowerName, xhtmlNamespaceURI), this, 0, false);
+    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, name.lower(), xhtmlNamespaceURI), this, 0, false);
 }
 
 static void addItemToMap(HashCountedSet<AtomicStringImpl*>& map, const AtomicString& name)
diff --git a/WebCore/html/HTMLDocument.idl b/WebCore/html/HTMLDocument.idl
index 3dd7a07..d250741 100644
--- a/WebCore/html/HTMLDocument.idl
+++ b/WebCore/html/HTMLDocument.idl
@@ -39,7 +39,7 @@ module html {
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // FIXME: This should eventually be available (if they are wanted) for all languages.
-                 attribute [Custom, Deletable] HTMLCollection all;
+                 attribute [Custom, Deletable] HTMLAllCollection all;
 #endif
 
         void clear();
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index a4807ba..af15f6e 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -67,7 +67,7 @@ String HTMLElement::nodeName() const
     // the string on a hit in the hash.
     // FIXME: We should have a way to detect XHTML elements and replace the hasPrefix() check with it.
     if (document()->isHTMLDocument() && !tagQName().hasPrefix())
-        return tagQName().localName().string().upper();
+        return tagQName().localNameUpper();
     return Element::nodeName();
 }
     
diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index 1bc4995..80df829 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -137,9 +137,11 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         m_viewSource = !attr->isNull();
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onbeforeunloadAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
         setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
     } else
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index 932e718..d353073 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -118,6 +118,8 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else if (attrName == compositeAttr) {
         if (!parseCompositeOperator(attr->value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
@@ -167,7 +169,7 @@ void HTMLImageElement::attach()
 {
     HTMLElement::attach();
 
-    if (renderer() && renderer()->isImage()) {
+    if (renderer() && renderer()->isImage() && m_imageLoader.haveFiredBeforeLoadEvent()) {
         RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index 5050237..f63ccc8 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -875,7 +875,7 @@ void HTMLInputElement::attach()
         if (!m_imageLoader)
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
-        if (renderer()) {
+        if (renderer() && m_imageLoader->haveFiredBeforeLoadEvent()) {
             RenderImage* imageObj = toRenderImage(renderer());
             imageObj->setCachedImage(m_imageLoader->image()); 
             
@@ -1567,9 +1567,16 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             if (r && r->isTextField())
                 toRenderTextControl(r)->setEdited(false);
         }
-        // Form may never have been present, or may have been destroyed by the change event.
-        if (form())
-            form()->submitClick(evt);
+
+        RefPtr<HTMLFormElement> formForSubmission = form();
+        // If there is no form and the element is an <isindex>, then create a temporary form just to be used for submission.
+        if (!formForSubmission && inputType() == ISINDEX)
+            formForSubmission = createTemporaryFormForIsIndex();
+
+        // Form may never have been present, or may have been destroyed by code responding to the change event.
+        if (formForSubmission)
+            formForSubmission->submitClick(evt);
+
         evt->setDefaultHandled();
         return;
     }
@@ -1587,6 +1594,19 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         HTMLFormControlElementWithState::defaultEventHandler(evt);
 }
 
+PassRefPtr<HTMLFormElement> HTMLInputElement::createTemporaryFormForIsIndex()
+{
+    RefPtr<HTMLFormElement> form = new HTMLFormElement(formTag, document());
+    form->registerFormElement(this);
+    form->setMethod("GET");
+    if (!document()->baseURL().isEmpty()) {
+        // We treat the href property of the <base> element as the form action, as per section 7.5 
+        // "Queries and Indexes" of the HTML 2.0 spec. <http://www.w3.org/MarkUp/html-spec/html-spec_7.html#SEC7.5>.
+        form->setAction(document()->baseURL().string());
+    }
+    return form.release();
+}
+
 bool HTMLInputElement::isURLAttribute(Attribute *attr) const
 {
     return (attr->name() == srcAttr);
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 799d92c..0e2da32 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -256,6 +256,8 @@ private:
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
 
+    PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
+
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
 #endif
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index 0136e08..729aceb 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -167,6 +167,8 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
             m_player->setAutobuffer(!attr->isNull());
     } else if (attrName == onabortAttr)
         setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else if (attrName == oncanplayAttr)
         setAttributeEventListener(eventNames().canplayEvent, createAttributeEventListener(this, attr));
     else if (attrName == oncanplaythroughAttr)
@@ -185,8 +187,6 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadedmetadataAttr)
         setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
-    else if (attrName == onloadendAttr)
-        setAttributeEventListener(eventNames().loadendEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadstartAttr)
         setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
     else if (attrName == onpauseAttr)
@@ -247,16 +247,12 @@ void HTMLMediaElement::insertedIntoDocument()
         scheduleLoad();
 }
 
-void HTMLMediaElement::willRemove()
-{
-    if (m_isFullscreen)
-        exitFullscreen();
-    HTMLElement::willRemove();
-}
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
         pause();
+    if (m_isFullscreen)
+        exitFullscreen();
     HTMLElement::removedFromDocument();
 }
 
@@ -466,17 +462,15 @@ void HTMLMediaElement::loadInternal()
     // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
     // the error attribute to a new MediaError object whose code attribute is set to
     // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
-    // context of the fetching process that is in progress for the element, and fire a progress
-    // event called loadend at the media element, in the context of the same fetching process.
+    // context of the fetching process that is in progress for the element.
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
-        // fire synchronous 'abort' and 'loadend'
+        // fire synchronous 'abort'
         bool totalKnown = m_player && m_player->totalBytesKnown();
         unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
         unsigned total = m_player ? m_player->totalBytes() : 0;
         dispatchEvent(ProgressEvent::create(eventNames().abortEvent, totalKnown, loaded, total));
-        dispatchEvent(ProgressEvent::create(eventNames().loadendEvent, totalKnown, loaded, total));
     }
 
     // 5
@@ -508,35 +502,34 @@ void HTMLMediaElement::loadInternal()
 
 void HTMLMediaElement::selectMediaResource()
 {
-    // 1 - If the media element has neither a src attribute nor any source element children, run these substeps
+    // 1 - Set the networkState to NETWORK_NO_SOURCE
+    m_networkState = NETWORK_NO_SOURCE;
+
+    // 2 - Asynchronously await a stable state.
+
+    // 3 - If the media element has neither a src attribute nor any source element children, run these substeps
     String mediaSrc = getAttribute(srcAttr);
     if (!mediaSrc && !havePotentialSourceChild()) {
         m_loadState = WaitingForSource;
 
-        // 1 -  Set the networkState to NETWORK_NO_SOURCE
-        m_networkState = NETWORK_NO_SOURCE;
-        
-        // 2 - While the media element has neither a src attribute nor any source element children, 
-        // wait. (This steps might wait forever.)
-
-        m_delayingTheLoadEvent = false;
+        // 1 - Set the networkState to NETWORK_EMPTY and abort these steps
+        m_networkState = NETWORK_EMPTY;
+        ASSERT(!m_delayingTheLoadEvent);
         return;
     }
 
-    // 2
+    // 4
     m_delayingTheLoadEvent = true;
-
-    // 3
     m_networkState = NETWORK_LOADING;
 
-    // 4
+    // 5
     scheduleProgressEvent(eventNames().loadstartEvent);
 
-    // 5 - If the media element has a src attribute, then run these substeps
+    // 6 - If the media element has a src attribute, then run these substeps
     ContentType contentType("");
-    if (!mediaSrc.isEmpty()) {
+    if (!mediaSrc.isNull()) {
         KURL mediaURL = document()->completeURL(mediaSrc);
-        if (isSafeToLoadURL(mediaURL, Complain)) {
+        if (isSafeToLoadURL(mediaURL, Complain) && dispatchBeforeLoadEvent(mediaURL.string())) {
             m_loadState = LoadingFromSrcAttr;
             loadResource(mediaURL, contentType);
         } else 
@@ -643,24 +636,19 @@ void HTMLMediaElement::noneSupported()
     m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
-    // 4 - Reaching this step indicates that either the URL failed to resolve, or the media
+    // 5 - Reaching this step indicates that either the URL failed to resolve, or the media
     // resource failed to load. Set the error attribute to a new MediaError object whose
     // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
-    // 5 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    // 6 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
 
-    // 6 - Queue a task to fire a progress event called error at the media element, in
+    // 7 - Queue a task to fire a progress event called error at the media element, in
     // the context of the fetching process that was used to try to obtain the media
     // resource in the resource fetch algorithm.
     scheduleProgressEvent(eventNames().errorEvent);
 
-    // 7 - Queue a task to fire a progress event called loadend at the media element, in
-    // the context of the fetching process that was used to try to obtain the media
-    // resource in the resource fetch algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
     // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
@@ -686,19 +674,15 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     // the context of the fetching process started by this instance of this algorithm.
     scheduleProgressEvent(eventNames().errorEvent);
 
-    // 4 - Queue a task to fire a progress event called loadend at the media element, in
-    // the context of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
-    // 5 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
+    // 4 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
     m_networkState = NETWORK_EMPTY;
     scheduleEvent(eventNames().emptiedEvent);
 
-    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // 7 - Abort the overall resource selection algorithm.
+    // 6 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
 }
 
@@ -785,7 +769,6 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
                 setReadyState(currentState);
 
             scheduleProgressEvent(eventNames().loadEvent);
-            scheduleProgressEvent(eventNames().loadendEvent);
         }
     }
 }
@@ -1384,7 +1367,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSo
 
         // Is it safe to load this url?
         mediaURL = source->src();
-        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid))
+        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid) || !dispatchBeforeLoadEvent(mediaURL.string()))
             goto check_again;
 
         // Making it this far means the <source> looks reasonable
@@ -1664,17 +1647,13 @@ void HTMLMediaElement::userCancelledLoad()
 #endif
     stopPeriodicTimers();
 
-    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
     // 3 - Queue a task to fire a progress event called abort at the media element, in the context
     // of the fetching process started by this instance of this algorithm.
     scheduleProgressEvent(eventNames().abortEvent);
 
-    // 4 - Queue a task to fire a progress event called loadend at the media element, in the context
-    // of the fetching process started by this instance of this algorithm.
-    scheduleProgressEvent(eventNames().loadendEvent);
-
     // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
     // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
     // simple event called emptied at the element. Otherwise, set set the element's networkState
@@ -1695,6 +1674,9 @@ void HTMLMediaElement::userCancelledLoad()
 
 void HTMLMediaElement::documentWillBecomeInactive()
 {
+    if (m_isFullscreen)
+        exitFullscreen();
+
     m_inActiveDocument = false;
     userCancelledLoad();
 
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index 0005e07..405f013 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -57,7 +57,6 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
-    virtual void willRemove();
     virtual void removedFromDocument();
     virtual void attach();
     virtual void recalcStyle(StyleChange);
diff --git a/WebCore/html/HTMLOptionsCollection.idl b/WebCore/html/HTMLOptionsCollection.idl
index 5f85fcb..a7e191a 100644
--- a/WebCore/html/HTMLOptionsCollection.idl
+++ b/WebCore/html/HTMLOptionsCollection.idl
@@ -21,7 +21,6 @@
 module html {
 
     // FIXME: The W3C spec says that HTMLOptionsCollection should not have a parent class.
-
     interface [
         GenerateNativeConverter,
         HasCustomIndexSetter,
@@ -36,9 +35,9 @@ module html {
              raises (DOMException);
         [Custom] void remove(in unsigned long index);
 
-#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        Node item(in unsigned long index);
-        Node namedItem(in DOMString name);
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        Node item(in unsigned long index); 
+        Node namedItem(in DOMString name); 
 #endif
     };
 
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index 7c01f6a..c38a9be 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -43,6 +43,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "ImageLoader.h"
 #include "InspectorTimelineAgent.h"
 #include "MappedAttribute.h"
 #include "Page.h"
@@ -419,13 +420,13 @@ HTMLTokenizer::State HTMLTokenizer::parseNonHTMLText(SegmentedString& src, State
 
     return state;
 }
-
+    
 HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 {
     // We are inside a <script>
     bool doScriptExec = false;
     int startLine = m_currentScriptTagStartLineNumber + 1; // Script line numbers are 1 based, HTMLTokenzier line numbers are 0 based
-
+    
     // Reset m_currentScriptTagStartLineNumber to indicate that we've finished parsing the current script element
     m_currentScriptTagStartLineNumber = 0;
 
@@ -562,7 +563,13 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
     if (m_fragment || !m_doc->frame())
         return state;
     m_executingScript++;
-
+    
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willEvaluateScriptTag(sourceCode.url().isNull() ? String() : sourceCode.url().string(), sourceCode.startLine());
+#endif
+    
     SegmentedString* savedPrependingSrc = m_currentPrependingSrc;
     SegmentedString prependingSrc;
     m_currentPrependingSrc = &prependingSrc;
@@ -573,7 +580,7 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
 #endif
 
     m_state = state;
-    m_doc->frame()->loader()->executeScript(sourceCode);
+    m_doc->frame()->script()->executeScript(sourceCode);
     state = m_state;
 
     state.setAllowYield(true);
@@ -619,7 +626,12 @@ HTMLTokenizer::State HTMLTokenizer::scriptExecution(const ScriptSourceCode& sour
     }
 
     m_currentPrependingSrc = savedPrependingSrc;
-
+    
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didEvaluateScriptTag();
+#endif
+    
     return state;
 }
 
@@ -1624,7 +1636,7 @@ inline bool HTMLTokenizer::continueProcessing(int& processedCount, double startT
     processedCount++;
     return true;
 }
-
+    
 void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 {
     if (!m_buffer)
@@ -1821,6 +1833,9 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
+    
+    // After parsing, go ahead and dispatch image beforeload/load events.
+    ImageLoader::dispatchPendingEvents();
 }
 
 void HTMLTokenizer::stopParsing()
@@ -2005,6 +2020,14 @@ void HTMLTokenizer::enlargeScriptBuffer(int len)
         CRASH();
 
     int newSize = m_scriptCodeCapacity + delta;
+    // If we allow fastRealloc(ptr, 0), it will call CRASH(). We run into this
+    // case if the HTML being parsed begins with "<!--" and there's more data
+    // coming.
+    if (!newSize) {
+        ASSERT(!m_scriptCode);
+        return;
+    }
+
     m_scriptCode = static_cast<UChar*>(fastRealloc(m_scriptCode, newSize * sizeof(UChar)));
     m_scriptCodeCapacity = newSize;
 }
diff --git a/WebCore/html/ValidityState.cpp b/WebCore/html/ValidityState.cpp
index 5bf8382..6b0a0b4 100644
--- a/WebCore/html/ValidityState.cpp
+++ b/WebCore/html/ValidityState.cpp
@@ -26,6 +26,12 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "RegularExpression.h"
+#include <wtf/StdLibExtras.h>
+
+#define EMAIL_LOCALPART "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+"
+#define EMAIL_DOMAINPART "[a-z0-9-]+(\\.[a-z0-9-]+)+"
+#define EMAIL_PATTERN EMAIL_LOCALPART "@" EMAIL_DOMAINPART
 
 namespace WebCore {
 
@@ -55,6 +61,19 @@ bool ValidityState::typeMismatch()
         return !HTMLInputElement::formStringToDouble(value, 0);
     case HTMLInputElement::URL:
         return !KURL(KURL(), value).isValid();
+    case HTMLInputElement::EMAIL:
+    {
+        if (!input->multiple())
+            return !isValidEmailAddress(value);
+            
+        Vector<String> email_list;
+        value.split(',', email_list);
+        for (unsigned i = 0; i < email_list.size(); ++i)
+            if (!isValidEmailAddress(email_list[i]))
+                return true;
+
+        return false;
+    }
     default:
         return false;
     }
@@ -95,4 +114,19 @@ bool ValidityState::isValidColorString(const String& value)
     return color.isValid() && !color.hasAlpha();
 }
 
+bool ValidityState::isValidEmailAddress(const String& email)
+{
+    if (email.isEmpty())
+        return false;
+
+    DEFINE_STATIC_LOCAL(AtomicString, emailPattern, (EMAIL_PATTERN));
+    DEFINE_STATIC_LOCAL(RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
+
+    int matchLength = 0;
+    int emailLength = email.length();
+    int matchOffset = regExp.match(email, 0, &matchLength);
+
+    return matchOffset == 0 && matchLength == emailLength;
+}
+
 } // namespace
diff --git a/WebCore/html/ValidityState.h b/WebCore/html/ValidityState.h
index 67afa53..1dee306 100644
--- a/WebCore/html/ValidityState.h
+++ b/WebCore/html/ValidityState.h
@@ -56,6 +56,7 @@ namespace WebCore {
         String m_customErrorMessage;
 
         static bool isValidColorString(const String&);
+        bool isValidEmailAddress(const String&);
     };
 
 } // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasActiveInfo.h b/WebCore/html/canvas/CanvasActiveInfo.h
new file mode 100644
index 0000000..b04b0d0
--- /dev/null
+++ b/WebCore/html/canvas/CanvasActiveInfo.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasActiveInfo_h
+#define CanvasActiveInfo_h
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class CanvasActiveInfo : public RefCounted<CanvasActiveInfo> {
+public:
+    static PassRefPtr<CanvasActiveInfo> create(const String& name, unsigned type, int size)
+    {
+        return adoptRef(new CanvasActiveInfo(name, type, size));
+    }
+    String name() const { return m_name; }
+    unsigned type() const { return m_type; }
+    int size() const { return m_size; }
+
+private:
+    CanvasActiveInfo(const String& name, unsigned type, int size)
+        : m_name(name)
+        , m_type(type)
+        , m_size(size)
+    {
+        ASSERT(name.length());
+        ASSERT(type);
+        ASSERT(size);
+    }
+    String m_name;
+    unsigned m_type;
+    int m_size;
+};
+
+}
+
+#endif // CanvasActiveInfo_h
diff --git a/WebCore/html/canvas/CanvasActiveInfo.idl b/WebCore/html/canvas/CanvasActiveInfo.idl
new file mode 100644
index 0000000..6ceae29
--- /dev/null
+++ b/WebCore/html/canvas/CanvasActiveInfo.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        Conditional=3D_CANVAS,
+    ] CanvasActiveInfo {
+        readonly attribute int size;
+        readonly attribute unsigned int type;
+        readonly attribute DOMString name;
+    };
+
+}
diff --git a/WebCore/html/canvas/CanvasArray.h b/WebCore/html/canvas/CanvasArray.h
index e34ad8c..8cedbbe 100644
--- a/WebCore/html/canvas/CanvasArray.h
+++ b/WebCore/html/canvas/CanvasArray.h
@@ -34,6 +34,14 @@
 namespace WebCore {
     class CanvasArray : public RefCounted<CanvasArray> {
     public:
+        virtual bool isByteArray() const { return false; }
+        virtual bool isUnsignedByteArray() const { return false; }
+        virtual bool isShortArray() const { return false; }
+        virtual bool isUnsignedShortArray() const { return false; }
+        virtual bool isIntArray() const { return false; }
+        virtual bool isUnsignedIntArray() const { return false; }
+        virtual bool isFloatArray() const { return false; }
+        
         PassRefPtr<CanvasArrayBuffer> buffer() {
             return m_buffer;
         }
diff --git a/WebCore/html/canvas/CanvasArray.idl b/WebCore/html/canvas/CanvasArray.idl
index 01bb37e..63b2dcd 100644
--- a/WebCore/html/canvas/CanvasArray.idl
+++ b/WebCore/html/canvas/CanvasArray.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS] CanvasArray {
+    interface [Conditional=3D_CANVAS, CustomToJS] CanvasArray {
         readonly attribute long length;
         int sizeInBytes();
         int alignedSizeInBytes();
diff --git a/WebCore/html/canvas/CanvasByteArray.h b/WebCore/html/canvas/CanvasByteArray.h
index 329f396..69cadf7 100644
--- a/WebCore/html/canvas/CanvasByteArray.h
+++ b/WebCore/html/canvas/CanvasByteArray.h
@@ -38,6 +38,8 @@ namespace WebCore {
 
     class CanvasByteArray : public CanvasArray {
     public:
+        virtual bool isByteArray() const { return true; }
+
         static PassRefPtr<CanvasByteArray> create(unsigned length);
         static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
         static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/html/canvas/CanvasFloatArray.h b/WebCore/html/canvas/CanvasFloatArray.h
index 49bd897..d2dc4ff 100644
--- a/WebCore/html/canvas/CanvasFloatArray.h
+++ b/WebCore/html/canvas/CanvasFloatArray.h
@@ -35,6 +35,8 @@ namespace WebCore {
     
     class CanvasFloatArray : public CanvasArray {
     public:
+        virtual bool isFloatArray() const { return true; }
+
         static PassRefPtr<CanvasFloatArray> create(unsigned length);
         static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
         static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/html/canvas/CanvasIntArray.h b/WebCore/html/canvas/CanvasIntArray.h
index 8846be7..4977034 100644
--- a/WebCore/html/canvas/CanvasIntArray.h
+++ b/WebCore/html/canvas/CanvasIntArray.h
@@ -36,6 +36,8 @@ namespace WebCore {
     
     class CanvasIntArray : public CanvasArray {
     public:
+        virtual bool isIntArray() const { return true; }
+
         static PassRefPtr<CanvasIntArray> create(unsigned length);
         static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
         static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/html/canvas/CanvasObject.h b/WebCore/html/canvas/CanvasObject.h
index 413da71..748278d 100644
--- a/WebCore/html/canvas/CanvasObject.h
+++ b/WebCore/html/canvas/CanvasObject.h
@@ -48,12 +48,12 @@ namespace WebCore {
             deleteObject();
             m_context = 0;
         }
-        
+
+        CanvasRenderingContext3D* context() const { return m_context; }
+
     protected:
         CanvasObject(CanvasRenderingContext3D*);
         virtual void _deleteObject(Platform3DObject) = 0;
-        
-        CanvasRenderingContext3D* context() const { return m_context; }
     
     private:
         Platform3DObject m_object;
diff --git a/WebCore/html/canvas/CanvasRenderingContext.h b/WebCore/html/canvas/CanvasRenderingContext.h
index 9ac9e57..f752377 100644
--- a/WebCore/html/canvas/CanvasRenderingContext.h
+++ b/WebCore/html/canvas/CanvasRenderingContext.h
@@ -38,6 +38,7 @@ namespace WebCore {
         CanvasRenderingContext(HTMLCanvasElement*);
         virtual ~CanvasRenderingContext() { }
         
+        // Ref and deref the m_canvas
         void ref();
         void deref();
         
@@ -46,7 +47,7 @@ namespace WebCore {
         virtual bool is2d() const { return false; }
         virtual bool is3d() const { return false; }
 
-    protected:
+    private:
         HTMLCanvasElement* m_canvas;
     };
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index ed462fc..3341901 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -165,10 +165,10 @@ void CanvasRenderingContext2D::setStrokeStyle(PassRefPtr<CanvasStyle> style)
     if (!style)
         return;
 
-    if (m_canvas->originClean()) {
+    if (canvas()->originClean()) {
         if (CanvasPattern* pattern = style->canvasPattern()) {
             if (!pattern->originClean())
-                m_canvas->setOriginTainted();
+                canvas()->setOriginTainted();
         }
     }
 
@@ -189,10 +189,10 @@ void CanvasRenderingContext2D::setFillStyle(PassRefPtr<CanvasStyle> style)
     if (!style)
         return;
  
-    if (m_canvas->originClean()) {
+    if (canvas()->originClean()) {
         if (CanvasPattern* pattern = style->canvasPattern()) {
             if (!pattern->originClean())
-                m_canvas->setOriginTainted();
+                canvas()->setOriginTainted();
         }
     }
 
@@ -447,7 +447,7 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
     if (!ctm.isInvertible())
         return;
     c->concatCTM(c->getCTM().inverse());
-    c->concatCTM(m_canvas->baseTransform());
+    c->concatCTM(canvas()->baseTransform());
     state().m_transform.multiply(ctm.inverse());
     m_path.transform(ctm);
 
@@ -630,7 +630,7 @@ void CanvasRenderingContext2D::rect(float x, float y, float width, float height)
 #if ENABLE(DASHBOARD_SUPPORT)
 void CanvasRenderingContext2D::clearPathForDashboardBackwardCompatibilityMode()
 {
-    if (Settings* settings = m_canvas->document()->settings())
+    if (Settings* settings = canvas()->document()->settings())
         if (settings->usesDashboardBackwardCompatibilityMode())
             m_path.clear();
 }
@@ -687,7 +687,7 @@ void CanvasRenderingContext2D::clip()
         return;
     if (!state().m_invertibleCTM)
         return;
-    c->clip(m_path);
+    c->canvasClip(m_path);
 #if ENABLE(DASHBOARD_SUPPORT)
     clearPathForDashboardBackwardCompatibilityMode();
 #endif
@@ -935,8 +935,8 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
 
 void CanvasRenderingContext2D::checkOrigin(const KURL& url)
 {
-    if (m_canvas->document()->securityOrigin()->taintsCanvas(url))
-        m_canvas->setOriginTainted();
+    if (canvas()->document()->securityOrigin()->taintsCanvas(url))
+        canvas()->setOriginTainted();
 }
 
 void CanvasRenderingContext2D::checkOrigin(const String& url)
@@ -986,11 +986,11 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
     if (!cachedImage)
         return;
 
-    if (m_canvas->originClean())
+    if (canvas()->originClean())
         checkOrigin(cachedImage->response().url());
 
-    if (m_canvas->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
-        m_canvas->setOriginTainted();
+    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
 
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
@@ -1012,14 +1012,14 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas,
     drawImage(canvas, FloatRect(0, 0, canvas->width(), canvas->height()), FloatRect(x, y, width, height), ec);
 }
 
-void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, const FloatRect& srcRect,
+void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const FloatRect& srcRect,
     const FloatRect& dstRect, ExceptionCode& ec)
 {
-    ASSERT(canvas);
+    ASSERT(sourceCanvas);
 
     ec = 0;
 
-    FloatRect srcCanvasRect = FloatRect(FloatPoint(), canvas->size());
+    FloatRect srcCanvasRect = FloatRect(FloatPoint(), sourceCanvas->size());
     if (!srcCanvasRect.contains(normalizeRect(srcRect)) || srcRect.width() == 0 || srcRect.height() == 0) {
         ec = INDEX_SIZE_ERR;
         return;
@@ -1038,12 +1038,12 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, const FloatR
     FloatRect destRect = c->roundToDevicePixels(dstRect);
         
     // FIXME: Do this through platform-independent GraphicsContext API.
-    ImageBuffer* buffer = canvas->buffer();
+    ImageBuffer* buffer = sourceCanvas->buffer();
     if (!buffer)
         return;
 
-    if (!canvas->originClean())
-        m_canvas->setOriginTainted();
+    if (!sourceCanvas->originClean())
+        canvas()->setOriginTainted();
 
     c->drawImage(buffer->image(), destRect, sourceRect, state().m_globalComposite);
     willDraw(destRect); // This call comes after drawImage, since the buffer we draw into may be our own, and we need to make sure it is dirty.
@@ -1088,11 +1088,11 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
     if (!state().m_invertibleCTM)
         return;
 
-    if (m_canvas->originClean())
+    if (canvas()->originClean())
         checkOrigin(video->currentSrc());
 
-    if (m_canvas->originClean() && !video->hasSingleSecurityOrigin())
-        m_canvas->setOriginTainted();
+    if (canvas()->originClean() && !video->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
 
     FloatRect sourceRect = c->roundToDevicePixels(srcRect);
     FloatRect destRect = c->roundToDevicePixels(dstRect);
@@ -1121,11 +1121,11 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
     if (!cachedImage)
         return;
 
-    if (m_canvas->originClean())
+    if (canvas()->originClean())
         checkOrigin(cachedImage->response().url());
 
-    if (m_canvas->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
-        m_canvas->setOriginTainted();
+    if (canvas()->originClean() && !cachedImage->image()->hasSingleSecurityOrigin())
+        canvas()->setOriginTainted();
 
     GraphicsContext* c = drawingContext();
     if (!c)
@@ -1155,7 +1155,7 @@ void CanvasRenderingContext2D::setCompositeOperation(const String& operation)
 void CanvasRenderingContext2D::prepareGradientForDashboard(CanvasGradient* gradient) const
 {
 #if ENABLE(DASHBOARD_SUPPORT)
-    if (Settings* settings = m_canvas->document()->settings())
+    if (Settings* settings = canvas()->document()->settings())
         if (settings->usesDashboardBackwardCompatibilityMode())
             gradient->setDashboardCompatibilityMode();
 #else
@@ -1205,7 +1205,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    bool originClean = !m_canvas->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
+    bool originClean = !canvas()->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
 
@@ -1253,12 +1253,12 @@ void CanvasRenderingContext2D::willDraw(const FloatRect& r, unsigned options)
         // we'd have to keep the clip path around.
     }
     
-    m_canvas->willDraw(dirtyRect);
+    canvas()->willDraw(dirtyRect);
 }
 
 GraphicsContext* CanvasRenderingContext2D::drawingContext() const
 {
-    return m_canvas->drawingContext();
+    return canvas()->drawingContext();
 }
 
 static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
@@ -1276,7 +1276,7 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float
         return 0;
     }
     FloatSize unscaledSize(sw, sh);
-    IntSize scaledSize = m_canvas->convertLogicalToDevice(unscaledSize);
+    IntSize scaledSize = canvas()->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
         scaledSize.setWidth(1);
     if (scaledSize.height() < 1)
@@ -1287,18 +1287,18 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float
 
 PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy, float sw, float sh, ExceptionCode& ec) const
 {
-    if (!m_canvas->originClean()) {
+    if (!canvas()->originClean()) {
         ec = SECURITY_ERR;
         return 0;
     }
     
     FloatRect unscaledRect(sx, sy, sw, sh);
-    IntRect scaledRect = m_canvas->convertLogicalToDevice(unscaledRect);
+    IntRect scaledRect = canvas()->convertLogicalToDevice(unscaledRect);
     if (scaledRect.width() < 1)
         scaledRect.setWidth(1);
     if (scaledRect.height() < 1)
         scaledRect.setHeight(1);
-    ImageBuffer* buffer = m_canvas ? m_canvas->buffer() : 0;
+    ImageBuffer* buffer = canvas() ? canvas()->buffer() : 0;
     if (!buffer)
         return createEmptyImageData(scaledRect.size());
     return buffer->getUnmultipliedImageData(scaledRect);
@@ -1326,7 +1326,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
         return;
     }
 
-    ImageBuffer* buffer = m_canvas->buffer();
+    ImageBuffer* buffer = canvas()->buffer();
     if (!buffer)
         return;
 
@@ -1363,7 +1363,7 @@ String CanvasRenderingContext2D::font() const
 void CanvasRenderingContext2D::setFont(const String& newFont)
 {
     RefPtr<CSSMutableStyleDeclaration> tempDecl = CSSMutableStyleDeclaration::create();
-    CSSParser parser(!m_canvas->document()->inCompatMode()); // Use the parse mode of the canvas' document when parsing CSS.
+    CSSParser parser(!canvas()->document()->inCompatMode()); // Use the parse mode of the canvas' document when parsing CSS.
         
     String declarationText("font: ");
     declarationText += newFont;
@@ -1377,11 +1377,11 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     // Map the <canvas> font into the text style. If the font uses keywords like larger/smaller, these will work
     // relative to the canvas.
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    if (m_canvas->computedStyle())
-        newStyle->setFontDescription(m_canvas->computedStyle()->fontDescription());
+    if (canvas()->computedStyle())
+        newStyle->setFontDescription(canvas()->computedStyle()->fontDescription());
 
     // Now map the font property into the style.
-    CSSStyleSelector* styleSelector = m_canvas->document()->styleSelector();
+    CSSStyleSelector* styleSelector = canvas()->document()->styleSelector();
     styleSelector->applyPropertyToStyle(CSSPropertyFont, tempDecl->getPropertyCSSValue(CSSPropertyFont).get(), newStyle.get());
     
     state().m_font = newStyle->font();
@@ -1455,8 +1455,8 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     // FIXME: Handle maxWidth.
     // FIXME: Need to turn off font smoothing.
 
-    bool rtl = m_canvas->computedStyle() ? m_canvas->computedStyle()->direction() == RTL : false;
-    bool override = m_canvas->computedStyle() ? m_canvas->computedStyle()->unicodeBidi() == Override : false;
+    bool rtl = canvas()->computedStyle() ? canvas()->computedStyle()->direction() == RTL : false;
+    bool override = canvas()->computedStyle() ? canvas()->computedStyle()->unicodeBidi() == Override : false;
 
     unsigned length = text.length();
     const UChar* string = text.characters();
@@ -1508,11 +1508,11 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         textRect.inflate(c->strokeThickness() / 2);
 
     if (fill)
-        m_canvas->willDraw(textRect);
+        canvas()->willDraw(textRect);
     else {
         // When stroking text, pointy miters can extend outside of textRect, so we
         // punt and dirty the whole canvas.
-        m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+        canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
     }
     
 #if PLATFORM(CG)
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
index b810500..612b4c3 100644
--- a/WebCore/html/canvas/CanvasRenderingContext3D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -28,6 +28,8 @@
 #if ENABLE(3D_CANVAS)
 
 #include "CanvasRenderingContext3D.h"
+
+#include "CanvasActiveInfo.h"
 #include "CanvasBuffer.h"
 #include "CanvasFramebuffer.h"
 #include "CanvasProgram.h"
@@ -40,12 +42,23 @@
 
 namespace WebCore {
 
-CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* canvas)
-    : CanvasRenderingContext(canvas)
+PassOwnPtr<CanvasRenderingContext3D> CanvasRenderingContext3D::create(HTMLCanvasElement* canvas)
+{
+    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create());
+    if (!context)
+        return 0;
+        
+    return new CanvasRenderingContext3D(canvas, context.release());
+}
+
+CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
+    : CanvasRenderingContext(passedCanvas)
+    , m_context(context)
     , m_needsUpdate(true)
     , m_markedCanvasDirty(false)
 {
-    m_context.reshape(m_canvas->width(), m_canvas->height());
+    ASSERT(m_context);
+    m_context->reshape(canvas()->width(), canvas()->height());
 }
 
 CanvasRenderingContext3D::~CanvasRenderingContext3D()
@@ -56,14 +69,14 @@ CanvasRenderingContext3D::~CanvasRenderingContext3D()
 void CanvasRenderingContext3D::markContextChanged()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer()) {
-        m_canvas->renderBox()->layer()->rendererContentChanged();
+    if (canvas()->renderBox() && canvas()->renderBox()->hasLayer()) {
+        canvas()->renderBox()->layer()->rendererContentChanged();
     } else {
 #endif
         if (!m_markedCanvasDirty) {
             // Make sure the canvas's image buffer is allocated.
-            m_canvas->buffer();
-            m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+            canvas()->buffer();
+            canvas()->willDraw(FloatRect(0, 0, canvas()->width(), canvas()->height()));
             m_markedCanvasDirty = true;
         }
 #if USE(ACCELERATED_COMPOSITING)
@@ -74,7 +87,7 @@ void CanvasRenderingContext3D::markContextChanged()
 void CanvasRenderingContext3D::beginPaint()
 {
     if (m_markedCanvasDirty) {
-        m_context.beginPaint(this);
+        m_context->beginPaint(this);
     }
 }
 
@@ -82,7 +95,7 @@ void CanvasRenderingContext3D::endPaint()
 {
     if (m_markedCanvasDirty) {
         m_markedCanvasDirty = false;
-        m_context.endPaint();
+        m_context->endPaint();
     }
 }
 
@@ -90,18 +103,18 @@ void CanvasRenderingContext3D::reshape(int width, int height)
 {
     if (m_needsUpdate) {
 #if USE(ACCELERATED_COMPOSITING)
-        if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer())
-            m_canvas->renderBox()->layer()->rendererContentChanged();
+        if (canvas()->renderBox() && canvas()->renderBox()->hasLayer())
+            canvas()->renderBox()->layer()->rendererContentChanged();
 #endif
         m_needsUpdate = false;
     }
     
-    m_context.reshape(width, height);
+    m_context->reshape(width, height);
 }
 
 int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
 {
-    int result = m_context.sizeInBytes(type);
+    int result = m_context->sizeInBytes(type);
     if (result <= 0) {
         ec = SYNTAX_ERR;
     }
@@ -110,7 +123,7 @@ int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
 
 void CanvasRenderingContext3D::activeTexture(unsigned long texture)
 {
-    m_context.activeTexture(texture);
+    m_context->activeTexture(texture);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -118,7 +131,7 @@ void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader
 {
     if (!program || !shader)
         return;
-    m_context.attachShader(program, shader);
+    m_context->attachShader(program, shader);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -126,94 +139,94 @@ void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsign
 {
     if (!program)
         return;
-    m_context.bindAttribLocation(program, index, name);
+    m_context->bindAttribLocation(program, index, name);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
 {
-    m_context.bindBuffer(target, buffer);
+    m_context->bindBuffer(target, buffer);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
 {
-    m_context.bindFramebuffer(target, buffer);
+    m_context->bindFramebuffer(target, buffer);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
 {
-    m_context.bindRenderbuffer(target, renderbuffer);
+    m_context->bindRenderbuffer(target, renderbuffer);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
 {
-    m_context.bindTexture(target, texture);
+    m_context->bindTexture(target, texture);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
 {
-    m_context.blendColor(red, green, blue, alpha);
+    m_context->blendColor(red, green, blue, alpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::blendEquation( unsigned long mode )
 {
-    m_context.blendEquation(mode);
+    m_context->blendEquation(mode);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
 {
-    m_context.blendEquationSeparate(modeRGB, modeAlpha);
+    m_context->blendEquationSeparate(modeRGB, modeAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
 {
-    m_context.blendFunc(sfactor, dfactor);
+    m_context->blendFunc(sfactor, dfactor);
     cleanupAfterGraphicsCall(false);
 }       
 
 void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
 {
-    m_context.blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    m_context->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
 {
-    m_context.bufferData(target, size, usage);
+    m_context->bufferData(target, size, usage);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
 {
-    m_context.bufferData(target, data, usage);
+    m_context->bufferData(target, data, usage);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
 {
-    m_context.bufferSubData(target, offset, data);
+    m_context->bufferSubData(target, offset, data);
     cleanupAfterGraphicsCall(false);
 }
 
 unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
 {
-    return m_context.checkFramebufferStatus(target);
+    return m_context->checkFramebufferStatus(target);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::clear(unsigned long mask)
 {
-    m_context.clear(mask);
+    m_context->clear(mask);
     cleanupAfterGraphicsCall(true);
 }
 
@@ -227,43 +240,43 @@ void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a
         b = 0;
     if (isnan(a))
         a = 1;
-    m_context.clearColor(r, g, b, a);
+    m_context->clearColor(r, g, b, a);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::clearDepth(double depth)
 {
-    m_context.clearDepth(depth);
+    m_context->clearDepth(depth);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::clearStencil(long s)
 {
-    m_context.clearStencil(s);
+    m_context->clearStencil(s);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
 {
-    m_context.colorMask(red, green, blue, alpha);
+    m_context->colorMask(red, green, blue, alpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
 {
-    m_context.compileShader(shader);
+    m_context->compileShader(shader);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
 {
-    m_context.copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
 {
-    m_context.copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -317,7 +330,7 @@ PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long ty
 
 void CanvasRenderingContext3D::cullFace(unsigned long mode)
 {
-    m_context.cullFace(mode);
+    m_context->cullFace(mode);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -371,19 +384,19 @@ void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
 
 void CanvasRenderingContext3D::depthFunc(unsigned long func)
 {
-    m_context.depthFunc(func);
+    m_context->depthFunc(func);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::depthMask(bool flag)
 {
-    m_context.depthMask(flag);
+    m_context->depthMask(flag);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
 {
-    m_context.depthRange(zNear, zFar);
+    m_context->depthRange(zNear, zFar);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -392,58 +405,58 @@ void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader
     if (!program || !shader)
         return;
 
-    m_context.detachShader(program, shader);
+    m_context->detachShader(program, shader);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::disable(unsigned long cap)
 {
-    m_context.disable(cap);
+    m_context->disable(cap);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
 {
-    m_context.disableVertexAttribArray(index);
+    m_context->disableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
 
 
 void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
 {
-    m_context.drawArrays(mode, first, count);
+    m_context->drawArrays(mode, first, count);
     cleanupAfterGraphicsCall(true);
 }
 
 void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
 {
-    m_context.drawElements(mode, count, type, offset);
+    m_context->drawElements(mode, count, type, offset);
     cleanupAfterGraphicsCall(true);
 }
 
 void CanvasRenderingContext3D::enable(unsigned long cap)
 {
-    m_context.enable(cap);
+    m_context->enable(cap);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
 {
-    m_context.enableVertexAttribArray(index);
+    m_context->enableVertexAttribArray(index);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::finish()
 {
-    m_context.finish();
+    m_context->finish();
     cleanupAfterGraphicsCall(true);
 }
 
 
 void CanvasRenderingContext3D::flush()
 {
-    m_context.flush();
+    m_context->flush();
     cleanupAfterGraphicsCall(true);
 }
 
@@ -452,7 +465,7 @@ void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, uns
     if (!buffer)
         return;
         
-    m_context.framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    m_context->framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -461,269 +474,289 @@ void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsign
     if (!texture)
         return;
         
-    m_context.framebufferTexture2D(target, attachment, textarget, texture, level);
+    m_context->framebufferTexture2D(target, attachment, textarget, texture, level);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::frontFace(unsigned long mode)
 {
-    m_context.frontFace(mode);
+    m_context->frontFace(mode);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::generateMipmap(unsigned long target)
 {
-    m_context.generateMipmap(target);
+    m_context->generateMipmap(target);
     cleanupAfterGraphicsCall(false);
 }
 
+PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    ActiveInfo info;
+    if (!program || program->context() != this || !m_context->getActiveAttrib(program, index, info)) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    return CanvasActiveInfo::create(info.name, info.type, info.size);
+}
+
+PassRefPtr<CanvasActiveInfo> CanvasRenderingContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ExceptionCode& ec)
+{
+    ActiveInfo info;
+    if (!program || program->context() != this || !m_context->getActiveUniform(program, index, info)) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+    return CanvasActiveInfo::create(info.name, info.type, info.size);
+}
+
 int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
 {
-    return m_context.getAttribLocation(program, name);
+    return m_context->getAttribLocation(program, name);
 }
 
 bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
 {
-    bool result = m_context.getBoolean(pname);
+    bool result = m_context->getBoolean(pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
 {
-    RefPtr<CanvasUnsignedByteArray> array = m_context.getBooleanv(pname);
+    RefPtr<CanvasUnsignedByteArray> array = m_context->getBooleanv(pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
 {
-    int result = m_context.getBufferParameteri(target, pname);
+    int result = m_context->getBufferParameteri(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getBufferParameteriv(target, pname);
+    RefPtr<CanvasIntArray> array = m_context->getBufferParameteriv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 unsigned long CanvasRenderingContext3D::getError()
 {
-    return m_context.getError();
+    return m_context->getError();
 }
 
 float CanvasRenderingContext3D::getFloat(unsigned long pname)
 {
-    float result = m_context.getFloat(pname);
+    float result = m_context->getFloat(pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getFloatv(pname);
+    RefPtr<CanvasFloatArray> array = m_context->getFloatv(pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
 {
-    int result = m_context.getFramebufferAttachmentParameteri(target, attachment, pname);
+    int result = m_context->getFramebufferAttachmentParameteri(target, attachment, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getFramebufferAttachmentParameteriv(target, attachment, pname);
+    RefPtr<CanvasIntArray> array = m_context->getFramebufferAttachmentParameteriv(target, attachment, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getInteger(unsigned long pname)
 {
-    float result = m_context.getInteger(pname);
+    float result = m_context->getInteger(pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getIntegerv(pname);
+    RefPtr<CanvasIntArray> array = m_context->getIntegerv(pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
 {
-    int result = m_context.getProgrami(program, pname);
+    int result = m_context->getProgrami(program, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getProgramiv(program, pname);
+    RefPtr<CanvasIntArray> array = m_context->getProgramiv(program, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
 {
-    String s = m_context.getProgramInfoLog(program);
+    String s = m_context->getProgramInfoLog(program);
     cleanupAfterGraphicsCall(false);
     return s;
 }
 
 int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
 {
-    int result = m_context.getRenderbufferParameteri(target, pname);
+    int result = m_context->getRenderbufferParameteri(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getRenderbufferParameteriv(target, pname);
+    RefPtr<CanvasIntArray> array = m_context->getRenderbufferParameteriv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
 {
-    int result = m_context.getShaderi(shader, pname);
+    int result = m_context->getShaderi(shader, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getShaderiv(shader, pname);
+    RefPtr<CanvasIntArray> array = m_context->getShaderiv(shader, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
 {
-    String s = m_context.getShaderInfoLog(shader);
+    String s = m_context->getShaderInfoLog(shader);
     cleanupAfterGraphicsCall(false);
     return s;
 }
 
 String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
 {
-    String s = m_context.getShaderSource(shader);
+    String s = m_context->getShaderSource(shader);
     cleanupAfterGraphicsCall(false);
     return s;
 }
 
 String CanvasRenderingContext3D::getString(unsigned long name)
 {
-    return m_context.getString(name);
+    return m_context->getString(name);
 }
 
 float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
 {
-    float result = m_context.getTexParameterf(target, pname);
+    float result = m_context->getTexParameterf(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getTexParameterfv(target, pname);
+    RefPtr<CanvasFloatArray> array = m_context->getTexParameterfv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
 {
-    int result = m_context.getTexParameteri(target, pname);
+    int result = m_context->getTexParameteri(target, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getTexParameteriv(target, pname);
+    RefPtr<CanvasIntArray> array = m_context->getTexParameteriv(target, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
 {
-    float result = m_context.getUniformf(program, location);
+    float result = m_context->getUniformf(program, location);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getUniformfv(program, location);
+    RefPtr<CanvasFloatArray> array = m_context->getUniformfv(program, location);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
 {
-    long result = m_context.getUniformi(program, location);
+    long result = m_context->getUniformi(program, location);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
 {
-    RefPtr<CanvasIntArray> array = m_context.getUniformiv(program, location);
+    RefPtr<CanvasIntArray> array = m_context->getUniformiv(program, location);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
 {
-    return m_context.getUniformLocation(program, name);
+    return m_context->getUniformLocation(program, name);
 }
 
 float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
 {
-    float result = m_context.getVertexAttribf(index, pname);
+    float result = m_context->getVertexAttribf(index, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
 {
-    RefPtr<CanvasFloatArray> array = m_context.getVertexAttribfv(index, pname);
+    RefPtr<CanvasFloatArray> array = m_context->getVertexAttribfv(index, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
 {
-    long result = m_context.getVertexAttribi(index, pname);
+    long result = m_context->getVertexAttribi(index, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
 {
-    RefPtr<CanvasIntArray> array = m_context.getVertexAttribiv(index, pname);
+    RefPtr<CanvasIntArray> array = m_context->getVertexAttribiv(index, pname);
     cleanupAfterGraphicsCall(false);
     return array;
 }
 
 long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
 {
-    long result = m_context.getVertexAttribOffset(index, pname);
+    long result = m_context->getVertexAttribOffset(index, pname);
     cleanupAfterGraphicsCall(false);
     return result;
 }
 
 void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
 {
-    m_context.hint(target, mode);
+    m_context->hint(target, mode);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -732,42 +765,42 @@ bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
     if (!buffer)
         return false;
         
-    return m_context.isBuffer(buffer);
+    return m_context->isBuffer(buffer);
 }
 
 bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
 {
-    return m_context.isEnabled(cap);
+    return m_context->isEnabled(cap);
 }
 
 bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
 {
-    return m_context.isFramebuffer(framebuffer);
+    return m_context->isFramebuffer(framebuffer);
 }
 
 bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
 {
-    return m_context.isProgram(program);
+    return m_context->isProgram(program);
 }
 
 bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
 {
-    return m_context.isRenderbuffer(renderbuffer);
+    return m_context->isRenderbuffer(renderbuffer);
 }
 
 bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
 {
-    return m_context.isShader(shader);
+    return m_context->isShader(shader);
 }
 
 bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
 {
-    return m_context.isTexture(texture);
+    return m_context->isTexture(texture);
 }
 
 void CanvasRenderingContext3D::lineWidth(double width)
 {
-    m_context.lineWidth((float) width);
+    m_context->lineWidth((float) width);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -776,85 +809,92 @@ void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
     if (!program)
         return;
         
-    m_context.linkProgram(program);
+    m_context->linkProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
 {
-    m_context.pixelStorei(pname, param);
+    m_context->pixelStorei(pname, param);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::polygonOffset(double factor, double units)
 {
-    m_context.polygonOffset((float) factor, (float) units);
+    m_context->polygonOffset((float) factor, (float) units);
     cleanupAfterGraphicsCall(false);
 }
 
+PassRefPtr<CanvasArray> CanvasRenderingContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    RefPtr<CanvasArray> array = m_context->readPixels(x, y, width, height, format, type);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
 void CanvasRenderingContext3D::releaseShaderCompiler()
 {
-    m_context.releaseShaderCompiler();
+    m_context->releaseShaderCompiler();
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
 {
-    m_context.renderbufferStorage(target, internalformat, width, height);
+    m_context->renderbufferStorage(target, internalformat, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
 {
-    m_context.sampleCoverage((float) value, invert);
+    m_context->sampleCoverage((float) value, invert);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
 {
-    m_context.scissor(x, y, width, height);
+    m_context->scissor(x, y, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
 {
-    m_context.shaderSource(shader, string);
+    m_context->shaderSource(shader, string);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
 {
-    m_context.stencilFunc(func, ref, mask);
+    m_context->stencilFunc(func, ref, mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
 {
-    m_context.stencilFuncSeparate(face, func, ref, mask);
+    m_context->stencilFuncSeparate(face, func, ref, mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilMask(unsigned long mask)
 {
-    m_context.stencilMask(mask);
+    m_context->stencilMask(mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
 {
-    m_context.stencilMaskSeparate(face, mask);
+    m_context->stencilMaskSeparate(face, mask);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
 {
-    m_context.stencilOp(fail, zfail, zpass);
+    m_context->stencilOp(fail, zfail, zpass);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
 {
-    m_context.stencilOpSeparate(face, fail, zfail, zpass);
+    m_context->stencilOpSeparate(face, fail, zfail, zpass);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -864,7 +904,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsig
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, internalformat, width, height,
+    m_context->texImage2D(target, level, internalformat, width, height,
                          border, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
@@ -875,7 +915,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsig
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, internalformat, width, height,
+    m_context->texImage2D(target, level, internalformat, width, height,
                          border, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
@@ -885,7 +925,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLI
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, image, flipY, premultiplyAlpha);
+    m_context->texImage2D(target, level, image, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -894,7 +934,7 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLC
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, canvas, flipY, premultiplyAlpha);
+    m_context->texImage2D(target, level, canvas, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -903,19 +943,19 @@ void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLV
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texImage2D(target, level, video, flipY, premultiplyAlpha);
+    m_context->texImage2D(target, level, video, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
 {
-    m_context.texParameterf(target, pname, param);
+    m_context->texParameterf(target, pname, param);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
 {
-    m_context.texParameteri(target, pname, param);
+    m_context->texParameteri(target, pname, param);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -925,7 +965,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -935,7 +975,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -945,7 +985,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -955,7 +995,7 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -965,13 +1005,13 @@ void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, un
 {
     // FIXME: For now we ignore any errors returned
     ec = 0;
-    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    m_context->texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform1f(long location, float x)
 {
-    m_context.uniform1f(location, x);
+    m_context->uniform1f(location, x);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -981,7 +1021,7 @@ void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
     if (!v)
         return;
         
-    m_context.uniform1fv(location, v->data(), v->length());
+    m_context->uniform1fv(location, v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -991,13 +1031,13 @@ void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
     if (!v)
         return;
         
-    m_context.uniform1fv(location, v, size);
+    m_context->uniform1fv(location, v, size);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform1i(long location, int x)
 {
-    m_context.uniform1i(location, x);
+    m_context->uniform1i(location, x);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1007,7 +1047,7 @@ void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
     if (!v)
         return;
         
-    m_context.uniform1iv(location, v->data(), v->length());
+    m_context->uniform1iv(location, v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1017,13 +1057,13 @@ void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
     if (!v)
         return;
         
-    m_context.uniform1iv(location, v, size);
+    m_context->uniform1iv(location, v, size);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
 {
-    m_context.uniform2f(location, x, y);
+    m_context->uniform2f(location, x, y);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1034,7 +1074,7 @@ void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2fv(location, v->data(), v->length() / 2);
+    m_context->uniform2fv(location, v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1045,13 +1085,13 @@ void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2fv(location, v, size / 2);
+    m_context->uniform2fv(location, v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
 {
-    m_context.uniform2i(location, x, y);
+    m_context->uniform2i(location, x, y);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1062,7 +1102,7 @@ void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2iv(location, v->data(), v->length() / 2);
+    m_context->uniform2iv(location, v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1073,13 +1113,13 @@ void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 2
-    m_context.uniform2iv(location, v, size / 2);
+    m_context->uniform2iv(location, v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
 {
-    m_context.uniform3f(location, x, y, z);
+    m_context->uniform3f(location, x, y, z);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1090,7 +1130,7 @@ void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3fv(location, v->data(), v->length() / 3);
+    m_context->uniform3fv(location, v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1101,13 +1141,13 @@ void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3fv(location, v, size / 3);
+    m_context->uniform3fv(location, v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
 {
-    m_context.uniform3i(location, x, y, z);
+    m_context->uniform3i(location, x, y, z);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1118,7 +1158,7 @@ void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3iv(location, v->data(), v->length() / 3);
+    m_context->uniform3iv(location, v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1129,13 +1169,13 @@ void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 3
-    m_context.uniform3iv(location, v, size / 3);
+    m_context->uniform3iv(location, v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
 {
-    m_context.uniform4f(location, x, y, z, w);
+    m_context->uniform4f(location, x, y, z, w);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1146,7 +1186,7 @@ void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4fv(location, v->data(), v->length() / 4);
+    m_context->uniform4fv(location, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1157,13 +1197,13 @@ void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4fv(location, v, size / 4);
+    m_context->uniform4fv(location, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
 {
-    m_context.uniform4i(location, x, y, z, w);
+    m_context->uniform4i(location, x, y, z, w);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1174,7 +1214,7 @@ void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4iv(location, v->data(), v->length() / 4);
+    m_context->uniform4iv(location, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1185,7 +1225,7 @@ void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniform4iv(location, v, size / 4);
+    m_context->uniform4iv(location, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1196,7 +1236,7 @@ void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, C
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
+    m_context->uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1207,7 +1247,7 @@ void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, f
         return;
         
     // FIXME: length needs to be a multiple of 4
-    m_context.uniformMatrix2fv(location, transpose, v, size / 4);
+    m_context->uniformMatrix2fv(location, transpose, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1218,7 +1258,7 @@ void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, C
         return;
         
     // FIXME: length needs to be a multiple of 9
-    m_context.uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
+    m_context->uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1229,7 +1269,7 @@ void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, f
         return;
         
     // FIXME: length needs to be a multiple of 9
-    m_context.uniformMatrix3fv(location, transpose, v, size / 9);
+    m_context->uniformMatrix3fv(location, transpose, v, size / 9);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1240,7 +1280,7 @@ void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, C
         return;
         
     // FIXME: length needs to be a multiple of 16
-    m_context.uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
+    m_context->uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1251,32 +1291,32 @@ void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, f
         return;
         
     // FIXME: length needs to be a multiple of 16
-    m_context.uniformMatrix4fv(location, transpose, v, size / 16);
+    m_context->uniformMatrix4fv(location, transpose, v, size / 16);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
 {
-    m_context.useProgram(program);
+    m_context->useProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
 {
-    m_context.validateProgram(program);
+    m_context->validateProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
 {
-    m_context.vertexAttrib1f(indx, v0);
+    m_context->vertexAttrib1f(indx, v0);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib1fv(indx, v->data());
+    m_context->vertexAttrib1fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1285,20 +1325,20 @@ void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib1fv(indx, v);
+    m_context->vertexAttrib1fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
 {
-    m_context.vertexAttrib2f(indx, v0, v1);
+    m_context->vertexAttrib2f(indx, v0, v1);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib2fv(indx, v->data());
+    m_context->vertexAttrib2fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1307,20 +1347,20 @@ void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib2fv(indx, v);
+    m_context->vertexAttrib2fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
 {
-    m_context.vertexAttrib3f(indx, v0, v1, v2);
+    m_context->vertexAttrib3f(indx, v0, v1, v2);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib3fv(indx, v->data());
+    m_context->vertexAttrib3fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1329,20 +1369,20 @@ void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib3fv(indx, v);
+    m_context->vertexAttrib3fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
 {
-    m_context.vertexAttrib4f(indx, v0, v1, v2, v3);
+    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
 {
     // FIXME: Need to make sure array is big enough for attribute being set
-    m_context.vertexAttrib4fv(indx, v->data());
+    m_context->vertexAttrib4fv(indx, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1351,13 +1391,13 @@ void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int
     // FIXME: Need to make sure array is big enough for attribute being set
     UNUSED_PARAM(size);
     
-    m_context.vertexAttrib4fv(indx, v);
+    m_context->vertexAttrib4fv(indx, v);
     cleanupAfterGraphicsCall(false);
 }
 
 void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
 {
-    m_context.vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -1371,7 +1411,7 @@ void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, uns
         width = 100;
     if (isnan(height))
         height = 100;
-    m_context.viewport(x, y, width, height);
+    m_context->viewport(x, y, width, height);
     cleanupAfterGraphicsCall(false);
 }
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.h b/WebCore/html/canvas/CanvasRenderingContext3D.h
index a4a68fc..70d9b95 100644
--- a/WebCore/html/canvas/CanvasRenderingContext3D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -36,6 +36,7 @@
 
 namespace WebCore {
 
+class CanvasActiveInfo;
 class CanvasBuffer;
 class CanvasFramebuffer;
 class CanvasObject;
@@ -50,8 +51,8 @@ class WebKitCSSMatrix;
 
     class CanvasRenderingContext3D : public CanvasRenderingContext {
     public:
-        CanvasRenderingContext3D(HTMLCanvasElement*);
-        ~CanvasRenderingContext3D();
+        static PassOwnPtr<CanvasRenderingContext3D> create(HTMLCanvasElement*);
+        virtual ~CanvasRenderingContext3D();
 
         virtual bool is3d() const { return true; }
 
@@ -123,7 +124,10 @@ class WebKitCSSMatrix;
         void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
-        
+
+        PassRefPtr<CanvasActiveInfo> getActiveAttrib(CanvasProgram*, unsigned long index, ExceptionCode&);
+        PassRefPtr<CanvasActiveInfo> getActiveUniform(CanvasProgram*, unsigned long index, ExceptionCode&);
+
         int  getAttribLocation(CanvasProgram*, const String& name);
 
         bool getBoolean(unsigned long pname);
@@ -187,8 +191,7 @@ class WebKitCSSMatrix;
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        // TBD
-        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
@@ -285,7 +288,7 @@ class WebKitCSSMatrix;
 
         void viewport(long x, long y, unsigned long width, unsigned long height);
 
-        GraphicsContext3D* graphicsContext3D() { return &m_context; }
+        GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
     
         void reshape(int width, int height);
 
@@ -297,18 +300,21 @@ class WebKitCSSMatrix;
         
     private:
         friend class CanvasObject;
+
+        CanvasRenderingContext3D(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
+
         void addObject(CanvasObject*);
         void detachAndRemoveAllObjects();
 
         void markContextChanged();
         void cleanupAfterGraphicsCall(bool changed)
         {
-            m_context.checkError();
+            m_context->checkError();
             if (changed)
                 markContextChanged();
         }
         
-        GraphicsContext3D m_context;
+        OwnPtr<GraphicsContext3D> m_context;
         bool m_needsUpdate;
         bool m_markedCanvasDirty;
         // FIXME: I think this is broken -- it does not increment any
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.idl b/WebCore/html/canvas/CanvasRenderingContext3D.idl
index 4b9a889..db0fff3 100644
--- a/WebCore/html/canvas/CanvasRenderingContext3D.idl
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.idl
@@ -530,8 +530,11 @@ module html {
         void         generateMipmap(in unsigned long target);
         
         // FIXME: these need to be added per the WebGL spec
-        // CanvasActiveInfo getActiveAttrib(GLuint program, GLuint index);
-        // CanvasActiveInfo getActiveUniform(GLuint program, GLuint index);
+        CanvasActiveInfo getActiveAttrib(in CanvasProgram program, in unsigned long index)
+            raises (DOMException);
+        CanvasActiveInfo getActiveUniform(in CanvasProgram program, in unsigned long index)
+            raises (DOMException);
+
         // CanvasShaderArray glGetAttachedShaders(GLuint program);
 
         int          getAttribLocation(in CanvasProgram program, in DOMString name);
@@ -597,8 +600,7 @@ module html {
         void         pixelStorei(in unsigned long pname, in long param);
         void         polygonOffset(in double factor, in double units);
         
-        // FIXME
-        //void         readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type, void* pixels);
+        CanvasArray readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type);
         
         void         releaseShaderCompiler();
         void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
diff --git a/WebCore/html/canvas/CanvasShortArray.h b/WebCore/html/canvas/CanvasShortArray.h
index 00a170f..1eeef0c 100644
--- a/WebCore/html/canvas/CanvasShortArray.h
+++ b/WebCore/html/canvas/CanvasShortArray.h
@@ -36,6 +36,8 @@ namespace WebCore {
     
     class CanvasShortArray : public CanvasArray {
     public:
+        virtual bool isShortArray() const { return true; }
+
         static PassRefPtr<CanvasShortArray> create(unsigned length);
         static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
         static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.h b/WebCore/html/canvas/CanvasUnsignedByteArray.h
index 6293034..d8864e0 100644
--- a/WebCore/html/canvas/CanvasUnsignedByteArray.h
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.h
@@ -36,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedByteArray : public CanvasArray {
     public:
+        virtual bool isUnsignedByteArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
         static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.h b/WebCore/html/canvas/CanvasUnsignedIntArray.h
index 5b5994c..10b8edf 100644
--- a/WebCore/html/canvas/CanvasUnsignedIntArray.h
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.h
@@ -36,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedIntArray : public CanvasArray {
     public:
+        virtual bool isUnsignedIntArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
         static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.h b/WebCore/html/canvas/CanvasUnsignedShortArray.h
index 1f6252e..9e27566 100644
--- a/WebCore/html/canvas/CanvasUnsignedShortArray.h
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.h
@@ -36,6 +36,8 @@ namespace WebCore {
     
     class CanvasUnsignedShortArray : public CanvasArray {
     public:
+        virtual bool isUnsignedShortArray() const { return true; }
+
         static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
         static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
         static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index 6cfb75e..eb8d49a 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -90,7 +90,12 @@ void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
     jsonObj.set("url", m_url);
     jsonObj.set("groupLevel", static_cast<int>(m_groupLevel));
     jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
-    frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
+    frontend->addConsoleMessage(jsonObj, m_frames, m_wrappedArguments,  m_message);
+}
+
+void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend* frontend)
+{
+    frontend->updateConsoleMessageRepeatCount(m_repeatCount);
 }
 #endif // ENABLE(INSPECTOR)
 
diff --git a/WebCore/inspector/ConsoleMessage.h b/WebCore/inspector/ConsoleMessage.h
index d03f2b7..8ed6660 100644
--- a/WebCore/inspector/ConsoleMessage.h
+++ b/WebCore/inspector/ConsoleMessage.h
@@ -49,6 +49,7 @@ namespace WebCore {
 
 #if ENABLE(INSPECTOR)
         void addToConsole(InspectorFrontend* frontend);
+        void updateRepeatCountInConsole(InspectorFrontend* frontend);
 #endif
         void incrementCount() { ++m_repeatCount; };
         bool isEqual(ScriptState*, ConsoleMessage* msg) const;
diff --git a/WebCore/inspector/DOMDispatchTimelineItem.cpp b/WebCore/inspector/DOMDispatchTimelineItem.cpp
deleted file mode 100644
index acff513..0000000
--- a/WebCore/inspector/DOMDispatchTimelineItem.cpp
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#include "config.h"
-#include "DOMDispatchTimelineItem.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "Event.h"
-#include "InspectorFrontend.h"
-
-namespace WebCore {
-
-DOMDispatchTimelineItem::DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event& event)
-    : TimelineItem(previous, startTime, DOMDispatchTimelineItemType)
-    , m_eventType(event.type().string())
-{
-}
-
-ScriptObject DOMDispatchTimelineItem::convertToScriptObject(InspectorFrontend* frontend)
-{
-    ScriptObject selfObj = TimelineItem::convertToScriptObject(frontend);
-    ScriptObject dataObj = frontend->newScriptObject();
-    dataObj.set("type", m_eventType);
-    selfObj.set("data", dataObj);
-    return selfObj;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/DOMDispatchTimelineItem.h b/WebCore/inspector/DOMDispatchTimelineItem.h
deleted file mode 100644
index 384ce25..0000000
--- a/WebCore/inspector/DOMDispatchTimelineItem.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#ifndef DOMDispatchTimelineItem_h
-#define DOMDispatchTimelineItem_h
-
-#include "TimelineItem.h"
-#include "PlatformString.h"
-
-namespace WebCore {
-
-    class Event;
-    class InspectorFrontend;
-
-    class DOMDispatchTimelineItem : public TimelineItem {
-    public:
-        DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event&);
-
-        virtual ~DOMDispatchTimelineItem() { }
-
-    protected:
-        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
-
-    private:
-        String m_eventType;
-    };
-
-} // namespace WebCore
-
-#endif // !defined(DOMDispatchTimelineItem_h)
-
diff --git a/WebCore/inspector/InspectorBackend.cpp b/WebCore/inspector/InspectorBackend.cpp
index 1273512..83a9719 100644
--- a/WebCore/inspector/InspectorBackend.cpp
+++ b/WebCore/inspector/InspectorBackend.cpp
@@ -258,33 +258,26 @@ const String& InspectorBackend::platform() const
     return platform;
 }
 
-void InspectorBackend::enableTimeline(bool always)
+void InspectorBackend::startTimelineProfiler()
 {
     if (m_inspectorController)
-        m_inspectorController->enableTimeline(always);
+        m_inspectorController->startTimelineProfiler();
 }
 
-void InspectorBackend::disableTimeline(bool always)
+void InspectorBackend::stopTimelineProfiler()
 {
     if (m_inspectorController)
-        m_inspectorController->disableTimeline(always);
+        m_inspectorController->stopTimelineProfiler();
 }
 
-bool InspectorBackend::timelineEnabled() const
+bool InspectorBackend::timelineProfilerEnabled() const
 {
     if (m_inspectorController)
-        return m_inspectorController->timelineEnabled();
+        return m_inspectorController->timelineProfilerEnabled();
     return false;
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-const ProfilesArray& InspectorBackend::profiles() const
-{
-    if (m_inspectorController)
-        return m_inspectorController->profiles();
-    return m_emptyProfiles;
-}
-
 void InspectorBackend::startProfiling()
 {
     if (m_inspectorController)
@@ -316,6 +309,18 @@ bool InspectorBackend::profilerEnabled()
     return false;
 }
 
+void InspectorBackend::getProfileHeaders(long callId)
+{
+    if (m_inspectorController)
+        m_inspectorController->getProfileHeaders(callId);
+}
+
+void InspectorBackend::getProfile(long callId, unsigned uid)
+{
+    if (m_inspectorController)
+        m_inspectorController->getProfile(callId, uid);
+}
+
 void InspectorBackend::enableDebugger(bool always)
 {
     if (m_inspectorController)
@@ -455,6 +460,35 @@ void InspectorBackend::copyNode(long nodeId)
     String markup = createMarkup(node);
     Pasteboard::generalPasteboard()->writePlainText(markup);
 }
+    
+void InspectorBackend::removeNode(long callId, long nodeId)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
+
+    Node* node = nodeForId(nodeId);
+    if (!node) {
+        // Use -1 to denote an error condition.
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    Node* parentNode = node->parentNode();
+    if (!parentNode) {
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    ExceptionCode code;
+    parentNode->removeChild(node, code);
+    if (code) {
+        frontend->didRemoveNode(callId, -1);
+        return;
+    }
+
+    frontend->didRemoveNode(callId, nodeId);
+}
 
 void InspectorBackend::getCookies(long callId, const String& domain)
 {
diff --git a/WebCore/inspector/InspectorBackend.h b/WebCore/inspector/InspectorBackend.h
index d7eea8c..9d75e2f 100644
--- a/WebCore/inspector/InspectorBackend.h
+++ b/WebCore/inspector/InspectorBackend.h
@@ -95,13 +95,11 @@ public:
 
     const String& platform() const;
 
-    void enableTimeline(bool always);
-    void disableTimeline(bool always);
-    bool timelineEnabled() const;
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+    bool timelineProfilerEnabled() const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    const ProfilesArray& profiles() const;
-
     void startProfiling();
     void stopProfiling();
 
@@ -109,6 +107,9 @@ public:
     void disableProfiler(bool always);
     bool profilerEnabled();
 
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+
     void enableDebugger(bool always);
     void disableDebugger(bool always);
     bool debuggerEnabled() const;
@@ -137,6 +138,7 @@ public:
     void setTextNodeValue(long callId, long nodeId, const String& value);
     void getEventListenersForNode(long callId, long nodeId);
     void copyNode(long nodeId);
+    void removeNode(long callId, long nodeId);
 
     void getCookies(long callId, const String& domain);
     void deleteCookie(const String& cookieName, const String& domain);
@@ -170,9 +172,6 @@ private:
 
     InspectorController* m_inspectorController;
     InspectorClient* m_client;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    ProfilesArray m_emptyProfiles;
-#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorBackend.idl b/WebCore/inspector/InspectorBackend.idl
index 8803765..7a00c6a 100644
--- a/WebCore/inspector/InspectorBackend.idl
+++ b/WebCore/inspector/InspectorBackend.idl
@@ -61,9 +61,9 @@ module core {
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
         DOMString platform();
-        void enableTimeline(in boolean always);
-        void disableTimeline(in boolean always);
-        boolean timelineEnabled();
+        void startTimelineProfiler();
+        void stopTimelineProfiler();
+        boolean timelineProfilerEnabled();
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
@@ -100,7 +100,8 @@ module core {
         void startProfiling();
         void stopProfiling();
 
-        [Custom] Array profiles();
+        void getProfileHeaders(in long callId);
+        void getProfile(in long callId, in unsigned long uid);
 #endif
         void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments, in boolean async);
         void getChildNodes(in long callId, in long nodeId);
@@ -109,6 +110,7 @@ module core {
         void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
         void getEventListenersForNode(in long callId, in long nodeId);
         void copyNode(in long nodeId);
+        void removeNode(in long callId, in long nodeId);
 
         void getCookies(in long callId, in DOMString domain);
         void deleteCookie(in DOMString cookieName, in DOMString domain);
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index 0922d7d..a6628cd 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -107,12 +107,12 @@ using namespace std;
 namespace WebCore {
 
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
+static const char* const CPUProfileType = "CPU";
 static const char* const resourceTrackingEnabledSettingName = "resourceTrackingEnabled";
 static const char* const debuggerEnabledSettingName = "debuggerEnabled";
 static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
-static const char* const timelineEnabledSettingName = "timelineEnabled";
 
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
@@ -171,6 +171,8 @@ InspectorController::~InspectorController()
         s_settingCache = 0;
     }
     
+    releaseDOMAgent();
+
     m_inspectorBackend->disconnectController();
 }
 
@@ -372,13 +374,14 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
     if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage)) {
         m_previousMessage->incrementCount();
         delete consoleMessage;
+        if (windowVisible())
+            m_previousMessage->updateRepeatCountInConsole(m_frontend.get());
     } else {
         m_previousMessage = consoleMessage;
         m_consoleMessages.append(consoleMessage);
+        if (windowVisible())
+            m_previousMessage->addToConsole(m_frontend.get());
     }
-
-    if (m_frontend)
-        m_previousMessage->addToConsole(m_frontend.get());
 }
 
 void InspectorController::clearConsoleMessages(bool clearUI)
@@ -552,11 +555,10 @@ void InspectorController::setFrontendProxyObject(ScriptState* scriptState, Scrip
     m_scriptState = scriptState;
     m_injectedScriptObj = injectedScriptObj;
     m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
-    m_domAgent = new InspectorDOMAgent(m_frontend.get());
-
-    Setting timelineEnabled = setting(timelineEnabledSettingName);
-    if (m_timelineAgent.get() || (timelineEnabled.type() == Setting::BooleanType && timelineEnabled.booleanValue()))
-        m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
+    releaseDOMAgent();
+    m_domAgent = InspectorDOMAgent::create(m_frontend.get());
+    if (m_timelineAgent)
+        m_timelineAgent->resetFrontendProxyObject(m_frontend.get());
 }
 
 void InspectorController::show()
@@ -611,11 +613,7 @@ void InspectorController::close()
 
     m_frontend.set(0);
     m_injectedScriptObj = ScriptObject();
-    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
-    // no references to the DOM agent from the DOM tree.
-    if (m_domAgent)
-        m_domAgent->setDocument(0);
-    m_domAgent = 0;
+    releaseDOMAgent();
     m_timelineAgent = 0;
     m_scriptState = 0;
     if (m_page)
@@ -645,6 +643,15 @@ void InspectorController::closeWindow()
     m_client->closeWindow();
 }
 
+void InspectorController::releaseDOMAgent()
+{
+    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
+    // no references to the DOM agent from the DOM tree.
+    if (m_domAgent)
+        m_domAgent->setDocument(0);
+    m_domAgent = 0;
+}
+
 void InspectorController::populateScriptObjects()
 {
     ASSERT(m_frontend);
@@ -656,9 +663,11 @@ void InspectorController::populateScriptObjects()
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         it->second->createScriptObject(m_frontend.get());
-        m_frontend->addCookieDomain(it->second->frame()->document()->url().host());
+        KURL resourceURL = it->second->frame()->document()->url();
+        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
+            m_frontend->addCookieDomain(resourceURL.host());
     }
-        
+
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
         m_consoleMessages[i]->addToConsole(m_frontend.get());
@@ -724,7 +733,7 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (m_frontend)
+            if (windowVisible())
                 resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
@@ -765,7 +774,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                m_mainResource->createScriptObject(m_frontend.get());
+                if (windowVisible())
+                    m_mainResource->createScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -859,7 +869,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     ensureResourceTrackingSettingsLoaded();
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
-    
+
     RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
 
     if (isMainResource) {
@@ -869,7 +879,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible())
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -895,7 +905,7 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
+    if (windowVisible() && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -904,8 +914,11 @@ void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loade
     if (!enabled() || !isMainResourceLoader(loader, url))
         return;
 
-    if (m_mainResource)
+    if (m_mainResource) {
         m_mainResource->markDOMContentEventTime();
+        if (windowVisible())
+            m_mainResource->updateScriptObject(m_frontend.get());
+    }
 }
 
 void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
@@ -913,8 +926,11 @@ void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, con
     if (!enabled() || !isMainResourceLoader(loader, url))
         return;
 
-    if (m_mainResource)
+    if (m_mainResource) {
         m_mainResource->markLoadEventTime();
+        if (windowVisible())
+            m_mainResource->updateScriptObject(m_frontend.get());
+    }
 }
 
 bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
@@ -935,7 +951,7 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && m_frontend)
+    if (resource != m_mainResource && windowVisible())
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -948,7 +964,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -960,7 +976,7 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -976,9 +992,11 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (m_frontend) {
+    if (windowVisible()) {
         resource->updateScriptObject(m_frontend.get());
-        m_frontend->addCookieDomain(resource->frame()->document()->url().host());
+        KURL resourceURL = resource->frame()->document()->url();
+        if (resourceURL.protocolInHTTPFamily() || resourceURL.protocolIs("file"))
+            m_frontend->addCookieDomain(resourceURL.host());
     }
 }
 
@@ -995,7 +1013,7 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     addResource(resource.get());
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1010,7 +1028,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1027,11 +1045,11 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (m_frontend)
+    if (windowVisible())
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::enableResourceTracking(bool always)
+void InspectorController::enableResourceTracking(bool always, bool reload)
 {
     if (!enabled())
         return;
@@ -1047,7 +1065,8 @@ void InspectorController::enableResourceTracking(bool always)
     if (m_frontend)
         m_frontend->resourceTrackingWasEnabled();
 
-    m_inspectedPage->mainFrame()->loader()->reload();
+    if (reload)
+        m_inspectedPage->mainFrame()->loader()->reload();
 }
 
 void InspectorController::disableResourceTracking(bool always)
@@ -1075,44 +1094,38 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         m_resourceTrackingEnabled = true;
 }
 
-void InspectorController::enableTimeline(bool always)
+void InspectorController::startTimelineProfiler()
 {
     if (!enabled())
         return;
 
-    if (always)
-        setSetting(timelineEnabledSettingName, Setting(true));
-
-    if (m_timelineAgent.get())
+    if (m_timelineAgent)
         return;
 
     m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
     if (m_frontend)
-        m_frontend->timelineWasEnabled();
+        m_frontend->timelineProfilerWasStarted();
 }
 
-void InspectorController::disableTimeline(bool always)
+void InspectorController::stopTimelineProfiler()
 {
     if (!enabled())
         return;
 
-    if (always)
-        setSetting(timelineEnabledSettingName, Setting(false));
-
-    if (!m_timelineAgent.get())
+    if (!m_timelineAgent)
         return;
 
-    m_timelineAgent.set(0);
+    m_timelineAgent = 0;
     if (m_frontend)
-        m_frontend->timelineWasDisabled();
+        m_frontend->timelineProfilerWasStopped();
 }
 
-bool InspectorController::timelineEnabled() const
+bool InspectorController::timelineProfilerEnabled() const
 {
     if (!enabled())
         return false;
 
-    return m_timelineAgent.get();
+    return m_timelineAgent;
 }
 
 #if ENABLE(DATABASE)
@@ -1147,7 +1160,7 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
     m_databaseResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (m_frontend && windowVisible())
+    if (windowVisible())
         resource->bind(m_frontend.get());
 }
 #endif
@@ -1238,7 +1251,7 @@ void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLoca
     m_domStorageResources.set(resource->id(), resource);
 
     // Resources are only bound while visible.
-    if (m_frontend && windowVisible())
+    if (windowVisible())
         resource->bind(m_frontend.get());
 }
 
@@ -1339,11 +1352,11 @@ void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned li
         return;
 
     RefPtr<Profile> profile = prpProfile;
-    m_profiles.append(profile);
+    m_profiles.add(profile->uid(), profile);
 
     if (m_frontend) {
         JSLock lock(SilenceAssertionsOnly);
-        m_frontend->addProfile(toJS(m_scriptState, profile.get()));
+        m_frontend->addProfileHeader(createProfileHeader(*profile));
     }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
@@ -1354,8 +1367,10 @@ void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile>
     RefPtr<Profile> profile = prpProfile;
 
     UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(profile->title());
+    message += encodeWithURLEscapeSequences(CPUProfileType);
     message += "/";
+    message += encodeWithURLEscapeSequences(profile->title());
+    message += "#";
     message += UString::from(profile->uid());
     message += "\" finished.";
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
@@ -1364,11 +1379,42 @@ void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile>
 void InspectorController::addStartProfilingMessageToConsole(const UString& title, unsigned lineNumber, const UString& sourceURL)
 {
     UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(CPUProfileType);
+    message += "/";
     message += encodeWithURLEscapeSequences(title);
-    message += "/0\" started.";
+    message += "#0\" started.";
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
+void InspectorController::getProfileHeaders(long callId)
+{
+    if (!m_frontend)
+        return;
+    ScriptArray result = m_frontend->newScriptArray();
+    ProfilesMap::iterator profilesEnd = m_profiles.end();
+    int i = 0;
+    for (ProfilesMap::iterator it = m_profiles.begin(); it != profilesEnd; ++it)
+        result.set(i++, createProfileHeader(*it->second));
+    m_frontend->didGetProfileHeaders(callId, result);
+}
+
+void InspectorController::getProfile(long callId, unsigned uid)
+{
+    if (!m_frontend)
+        return;
+    ProfilesMap::iterator it = m_profiles.find(uid);
+    if (it != m_profiles.end())
+        m_frontend->didGetProfile(callId, toJS(m_scriptState, it->second.get()));
+}
+
+ScriptObject InspectorController::createProfileHeader(const JSC::Profile& profile)
+{
+    ScriptObject header = m_frontend->newScriptObject();
+    header.set("title", profile.title());
+    header.set("uid", profile.uid());
+    return header;
+}
+
 UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
@@ -1400,7 +1446,7 @@ void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>
 
     UString title = getCurrentUserInitiatedProfileName(true);
 
-    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
     Profiler::profiler()->startProfiling(scriptState, title);
 
     addStartProfilingMessageToConsole(title, 0, UString());
@@ -1417,7 +1463,7 @@ void InspectorController::stopUserInitiatedProfiling()
 
     UString title = getCurrentUserInitiatedProfileName();
 
-    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
     RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
     if (profile)
         addProfile(profile, 0, UString());
@@ -1549,7 +1595,7 @@ void InspectorController::didContinue()
 
 void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
 {
-    if (m_frontend && windowVisible())
+    if (m_frontend)
         m_frontend->evaluateForTestInFrontend(callId, script);
     else
         m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index 06fd250..58458bc 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -227,14 +227,14 @@ public:
     void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
     void scriptImported(unsigned long identifier, const String& sourceString);
 
-    void enableResourceTracking(bool always = false);
+    void enableResourceTracking(bool always = false, bool reload = true);
     void disableResourceTracking(bool always = false);
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
 
-    void enableTimeline(bool always = false);
-    void disableTimeline(bool always = false);
-    bool timelineEnabled() const;
+    void startTimelineProfiler();
+    void stopTimelineProfiler();
+    bool timelineProfilerEnabled() const;
     InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
 
     void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
@@ -269,7 +269,6 @@ public:
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
-    const ProfilesArray& profiles() const { return m_profiles; }
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
 
@@ -307,6 +306,7 @@ private:
     void storeLastActivePanel(const String& panelName);
     void closeWindow();
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
+    void releaseDOMAgent();
 
     friend class InspectorFrontend;
     // Following are used from InspectorFrontend only. We don't want to expose them to the
@@ -321,9 +321,14 @@ private:
     void deleteCookie(const String& cookieName, const String& domain);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    typedef HashMap<unsigned int, RefPtr<JSC::Profile> > ProfilesMap;
+
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
+    void getProfileHeaders(long callId);
+    void getProfile(long callId, unsigned uid);
+    ScriptObject createProfileHeader(const JSC::Profile& profile);
 #endif
 #if ENABLE(DATABASE)
     void selectDatabase(Database* database);
@@ -403,7 +408,7 @@ private:
     int m_currentUserInitiatedProfileNumber;
     unsigned m_nextUserInitiatedProfileNumber;
     Timer<InspectorController> m_startProfiling;
-    ProfilesArray m_profiles;
+    ProfilesMap m_profiles;
 #endif
 };
 
diff --git a/WebCore/inspector/InspectorDOMAgent.h b/WebCore/inspector/InspectorDOMAgent.h
index b9bdb6b..3f736f7 100644
--- a/WebCore/inspector/InspectorDOMAgent.h
+++ b/WebCore/inspector/InspectorDOMAgent.h
@@ -68,6 +68,11 @@ namespace WebCore {
 
     class InspectorDOMAgent : public EventListener {
     public:
+        static PassRefPtr<InspectorDOMAgent> create(InspectorFrontend* frontend)
+        {
+            return adoptRef(new InspectorDOMAgent(frontend));
+        }
+
         static const InspectorDOMAgent* cast(const EventListener* listener)
         {
             return listener->type() == InspectorDOMAgentType
diff --git a/WebCore/inspector/InspectorDOMStorageResource.cpp b/WebCore/inspector/InspectorDOMStorageResource.cpp
index 37818e7..c93e987 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -104,7 +104,7 @@ void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* ev
     ASSERT(eventNames().storageEvent == event->type());
     StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
     Storage* storage = storageEvent->storageArea();
-    bool isLocalStorage = storageEvent->source()->localStorage() == storage;
+    bool isLocalStorage = storage->frame()->domWindow()->localStorage() == storage;
     if (isSameHostAndType(storage->frame(), isLocalStorage))
         m_frontend->updateDOMStorage(m_id);
 }
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
index ad935a8..2c422ac 100644
--- a/WebCore/inspector/InspectorFrontend.cpp
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -78,9 +78,9 @@ void InspectorFrontend::didCommitLoad()
     callSimpleFunction("didCommitLoad");
 }
 
-void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+void InspectorFrontend::addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addConsoleMessage"));
     function->appendArgument(messageObj);
     if (!frames.isEmpty()) {
         for (unsigned i = 0; i < frames.size(); ++i)
@@ -93,6 +93,13 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
     function->call();
 }
 
+void InspectorFrontend::updateConsoleMessageRepeatCount(const int count)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateConsoleMessageRepeatCount"));
+    function->appendArgument(count);
+    function->call();
+}
+
 void InspectorFrontend::clearConsoleMessages()
 {
     callSimpleFunction("clearConsoleMessages");
@@ -197,20 +204,20 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
-void InspectorFrontend::timelineWasEnabled()
+void InspectorFrontend::timelineProfilerWasStarted()
 {
-    callSimpleFunction("timelineWasEnabled");
+    callSimpleFunction("timelineProfilerWasStarted");
 }
 
-void InspectorFrontend::timelineWasDisabled()
+void InspectorFrontend::timelineProfilerWasStopped()
 {
-    callSimpleFunction("timelineWasDisabled");
+    callSimpleFunction("timelineProfilerWasStopped");
 }
 
-void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
+void InspectorFrontend::addRecordToTimeline(const ScriptObject& record)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addItemToTimeline"));
-    function->appendArgument(itemObj);
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addRecordToTimeline"));
+    function->appendArgument(record);
     function->call();
 }
 
@@ -261,9 +268,9 @@ void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source,
     function->call();
 }
 
-void InspectorFrontend::addProfile(const JSC::JSValue& profile)
+void InspectorFrontend::addProfileHeader(const ScriptValue& profile)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfile"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfileHeader"));
     function->appendArgument(profile);
     function->call();
 }
@@ -275,6 +282,22 @@ void InspectorFrontend::setRecordingProfile(bool isProfiling)
     function->call();
 }
 
+void InspectorFrontend::didGetProfileHeaders(int callId, const ScriptArray& headers)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfileHeaders"));
+    function->appendArgument(callId);
+    function->appendArgument(headers);
+    function->call();
+}
+
+void InspectorFrontend::didGetProfile(int callId, const ScriptValue& profile)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetProfile"));
+    function->appendArgument(callId);
+    function->appendArgument(profile);
+    function->call();
+}
+
 void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
@@ -343,6 +366,14 @@ void InspectorFrontend::attributesUpdated(int id, const ScriptArray& attributes)
     function->call();
 }
 
+void InspectorFrontend::didRemoveNode(int callId, int nodeId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveNode"));
+    function->appendArgument(callId);
+    function->appendArgument(nodeId);
+    function->call();
+}
+
 void InspectorFrontend::didGetChildNodes(int callId)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetChildNodes"));
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
index f7055bd..3cb9b8c 100644
--- a/WebCore/inspector/InspectorFrontend.h
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -63,7 +63,8 @@ namespace WebCore {
         ScriptObject newScriptObject();
 
         void didCommitLoad();
-        void addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        void addConsoleMessage(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        void updateConsoleMessageRepeatCount(const int count);
         void clearConsoleMessages();
 
         bool addResource(long long identifier, const ScriptObject& resourceObj);
@@ -89,8 +90,10 @@ namespace WebCore {
         void profilerWasDisabled();
         void parsedScriptSource(const JSC::SourceCode&);
         void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
-        void addProfile(const JSC::JSValue& profile);
+        void addProfileHeader(const ScriptValue& profile);
         void setRecordingProfile(bool isProfiling);
+        void didGetProfileHeaders(int callId, const ScriptArray& headers);
+        void didGetProfile(int callId, const ScriptValue& profile);
         void pausedScript(const ScriptValue& callFrames);
         void resumedScript();
 #endif
@@ -120,10 +123,11 @@ namespace WebCore {
         void didGetChildNodes(int callId);
         void didApplyDomChange(int callId, bool success);
         void didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray);
+        void didRemoveNode(int callId, int nodeId);
 
-        void timelineWasEnabled();
-        void timelineWasDisabled();
-        void addItemToTimeline(const ScriptObject& itemObj);
+        void timelineProfilerWasStarted();
+        void timelineProfilerWasStopped();
+        void addRecordToTimeline(const ScriptObject&);
 
         void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
         void didDispatchOnInjectedScript(int callId, const String& result, bool isException);
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index 69ab39b..b8bb22b 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -33,6 +33,7 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "Cache.h"
 #include "CachedResource.h"
 #include "DocLoader.h"
 #include "DocumentLoader.h"
@@ -227,6 +228,18 @@ void InspectorResource::releaseScriptObject(InspectorFrontend* frontend, bool ca
     frontend->removeResource(m_identifier);
 }
 
+CachedResource* InspectorResource::cachedResource() const
+{
+    // Try hard to find a corresponding CachedResource. During preloading, DocLoader may not have the resource in document resources set yet,
+    // but Inspector will already try to fetch data that is only available via CachedResource (and it won't update once the resource is added,
+    // because m_changes will not have the appropriate bits set).
+    const String& url = requestURL();
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(url);
+    if (!cachedResource)
+        cachedResource = cache()->resourceForURL(url);
+    return cachedResource;
+}
+
 InspectorResource::Type InspectorResource::type() const
 {
     if (!m_xmlHttpResponseText.isNull())
@@ -238,7 +251,7 @@ InspectorResource::Type InspectorResource::type() const
     if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
         return Image;
 
-    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    CachedResource* cachedResource = this->cachedResource();
     if (!cachedResource)
         return Other;
 
@@ -281,13 +294,14 @@ String InspectorResource::sourceString() const
     return encoding.decode(buffer->data(), buffer->size());
 }
 
-PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const {
+PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const
+{
     if (m_requestURL == m_loader->requestURL()) {
         *textEncodingName = m_frame->document()->inputEncoding();
         return m_loader->mainResourceData();
     }
 
-    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    CachedResource* cachedResource = this->cachedResource();
     if (!cachedResource)
         return 0;
 
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 880eab7..0335586 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -145,6 +145,8 @@ namespace WebCore {
         InspectorResource(long long identifier, DocumentLoader*);
         Type type() const;
 
+        CachedResource* cachedResource() const;
+
         long long m_identifier;
         RefPtr<DocumentLoader> m_loader;
         RefPtr<Frame> m_frame;
diff --git a/WebCore/inspector/InspectorTimelineAgent.cpp b/WebCore/inspector/InspectorTimelineAgent.cpp
index c3ad075..4f7b736 100644
--- a/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -33,19 +33,16 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "DOMDispatchTimelineItem.h"
 #include "Event.h"
 #include "InspectorFrontend.h"
-#include "TimelineItem.h"
+#include "TimelineRecordFactory.h"
 
 #include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
 InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
-    : m_sessionStartTime(currentTimeInMilliseconds())
-    , m_frontend(frontend)
-    , m_currentTimelineItem(0)
+    : m_frontend(frontend)
 {
     ASSERT(m_frontend);
 }
@@ -56,75 +53,140 @@ InspectorTimelineAgent::~InspectorTimelineAgent()
 
 void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
 {
-    m_currentTimelineItem = new DOMDispatchTimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), event);
+    pushCurrentRecord(TimelineRecordFactory::createDOMDispatchRecord(m_frontend, currentTimeInMilliseconds(), event), DOMDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didDispatchDOMEvent()
 {
-    ASSERT(m_currentTimelineItem->type() == DOMDispatchTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(DOMDispatchTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willLayout()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), LayoutTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), LayoutTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didLayout()
 {
-    ASSERT(m_currentTimelineItem->type() == LayoutTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(LayoutTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willRecalculateStyle()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), RecalculateStylesTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), RecalculateStylesTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didRecalculateStyle()
 {
-    ASSERT(m_currentTimelineItem->type() == RecalculateStylesTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willPaint()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), PaintTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didPaint()
 {
-    ASSERT(m_currentTimelineItem->type() == PaintTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(PaintTimelineRecordType);
 }
 
 void InspectorTimelineAgent::willWriteHTML()
 {
-    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), ParseHTMLTimelineItemType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericRecord(m_frontend, currentTimeInMilliseconds()), ParseHTMLTimelineRecordType);
 }
 
 void InspectorTimelineAgent::didWriteHTML()
 {
-    ASSERT(m_currentTimelineItem->type() == ParseHTMLTimelineItemType);
-    didCompleteCurrentRecord();
+    didCompleteCurrentRecord(ParseHTMLTimelineRecordType);
+}
+   
+void InspectorTimelineAgent::didInstallTimer(int timerId, int timeout, bool singleShot)
+{
+    addRecordToTimeline(TimelineRecordFactory::createTimerInstallRecord(m_frontend, currentTimeInMilliseconds(), timerId,
+        timeout, singleShot), TimerInstallTimelineRecordType);
+}
+
+void InspectorTimelineAgent::didRemoveTimer(int timerId)
+{
+    addRecordToTimeline(TimelineRecordFactory::createGenericTimerRecord(m_frontend, currentTimeInMilliseconds(), timerId),
+        TimerRemoveTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willFireTimer(int timerId)
+{
+    pushCurrentRecord(TimelineRecordFactory::createGenericTimerRecord(m_frontend, currentTimeInMilliseconds(), timerId),
+        TimerFireTimelineRecordType); 
+}
+
+void InspectorTimelineAgent::didFireTimer()
+{
+    didCompleteCurrentRecord(TimerFireTimelineRecordType);
+}
+
+void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
+{
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, readyState),
+        XHRReadyStateChangeRecordType);
+}
+
+void InspectorTimelineAgent::didChangeXHRReadyState()
+{
+    didCompleteCurrentRecord(XHRReadyStateChangeRecordType);
+}
+
+void InspectorTimelineAgent::willLoadXHR(const String& url) 
+{
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadTimelineRecord(m_frontend, currentTimeInMilliseconds(), url), XHRLoadRecordType);
+}
+
+void InspectorTimelineAgent::didLoadXHR()
+{
+    didCompleteCurrentRecord(XHRLoadRecordType);
+}
+
+void InspectorTimelineAgent::willEvaluateScriptTag(const String& url, int lineNumber)
+{
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(m_frontend, currentTimeInMilliseconds(), url, lineNumber), EvaluateScriptTagTimelineRecordType);
+}
+    
+void InspectorTimelineAgent::didEvaluateScriptTag()
+{
+    didCompleteCurrentRecord(EvaluateScriptTagTimelineRecordType);
 }
 
 void InspectorTimelineAgent::reset()
 {
-    m_sessionStartTime = currentTimeInMilliseconds();
-    m_currentTimelineItem.set(0);
+    m_recordStack.clear();
+}
+
+void InspectorTimelineAgent::resetFrontendProxyObject(InspectorFrontend* frontend)
+{
+    ASSERT(frontend);
+    reset();
+    m_frontend = frontend;
 }
 
-void InspectorTimelineAgent::didCompleteCurrentRecord()
+void InspectorTimelineAgent::addRecordToTimeline(ScriptObject record, TimelineRecordType type)
 {
-    OwnPtr<TimelineItem> item(m_currentTimelineItem.release());
-    m_currentTimelineItem = item->releasePrevious();
+    record.set("type", type);
+    if (m_recordStack.isEmpty())
+        m_frontend->addRecordToTimeline(record);
+    else {
+        TimelineRecordEntry parent = m_recordStack.last();
+        parent.children.set(parent.children.length(), record);
+    }
+}
 
-    item->setEndTime(sessionTimeInMilliseconds());
-    if (m_currentTimelineItem.get())
-        m_currentTimelineItem->addChildItem(item.release());
-    else
-        item->addToTimeline(m_frontend);
+void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
+{
+    ASSERT(!m_recordStack.isEmpty());
+    TimelineRecordEntry entry = m_recordStack.last();
+    m_recordStack.removeLast();
+    ASSERT(entry.type == type);
+    entry.record.set("children", entry.children);
+    entry.record.set("endTime", currentTimeInMilliseconds());
+    addRecordToTimeline(entry.record, type);
 }
 
 double InspectorTimelineAgent::currentTimeInMilliseconds()
@@ -132,9 +194,9 @@ double InspectorTimelineAgent::currentTimeInMilliseconds()
     return currentTime() * 1000.0;
 }
 
-double InspectorTimelineAgent::sessionTimeInMilliseconds()
+void InspectorTimelineAgent::pushCurrentRecord(ScriptObject record, TimelineRecordType type)
 {
-    return currentTimeInMilliseconds() - m_sessionStartTime;
+    m_recordStack.append(TimelineRecordEntry(record, m_frontend->newScriptArray(), type));
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorTimelineAgent.h b/WebCore/inspector/InspectorTimelineAgent.h
index 4095fed..0401977 100644
--- a/WebCore/inspector/InspectorTimelineAgent.h
+++ b/WebCore/inspector/InspectorTimelineAgent.h
@@ -31,16 +31,30 @@
 #ifndef InspectorTimelineAgent_h
 #define InspectorTimelineAgent_h
 
+#include "Document.h"
+#include "ScriptExecutionContext.h"
 #include "ScriptObject.h"
 #include "ScriptArray.h"
-
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
     class Event;
     class InspectorFrontend;
-    class TimelineItem;
+
+    // Must be kept in sync with TimelineAgent.js
+    enum TimelineRecordType {
+        DOMDispatchTimelineRecordType = 0,
+        LayoutTimelineRecordType = 1,
+        RecalculateStylesTimelineRecordType = 2,
+        PaintTimelineRecordType = 3,
+        ParseHTMLTimelineRecordType = 4,
+        TimerInstallTimelineRecordType = 5,
+        TimerRemoveTimelineRecordType = 6,
+        TimerFireTimelineRecordType = 7,
+        XHRReadyStateChangeRecordType = 8,
+        XHRLoadRecordType = 9,
+        EvaluateScriptTagTimelineRecordType = 10,
+    };
 
     class InspectorTimelineAgent {
     public:
@@ -48,30 +62,66 @@ namespace WebCore {
         ~InspectorTimelineAgent();
 
         void reset();
+        void resetFrontendProxyObject(InspectorFrontend*);
 
         // Methods called from WebCore.
         void willDispatchDOMEvent(const Event&);
         void didDispatchDOMEvent();
+
         void willLayout();
         void didLayout();
+
         void willRecalculateStyle();
         void didRecalculateStyle();
+
         void willPaint();
         void didPaint();
-        void didWriteHTML();
+
         void willWriteHTML();
-    private:
-        double sessionTimeInMilliseconds();
+        void didWriteHTML();
+        
+        void didInstallTimer(int timerId, int timeout, bool singleShot);
+        void didRemoveTimer(int timerId);
+        void willFireTimer(int timerId);
+        void didFireTimer();
+
+        void willChangeXHRReadyState(const String&, int);
+        void didChangeXHRReadyState();
+        void willLoadXHR(const String&);
+        void didLoadXHR();
 
+        void willEvaluateScriptTag(const String&, int);
+        void didEvaluateScriptTag();
+
+        static InspectorTimelineAgent* retrieve(ScriptExecutionContext*);
+    private:
+        struct TimelineRecordEntry {
+            TimelineRecordEntry(ScriptObject record, ScriptArray children, TimelineRecordType type) : record(record), children(children), type(type) { }
+            ScriptObject record;
+            ScriptArray children;
+            TimelineRecordType type;
+        };
+        
+        void pushCurrentRecord(ScriptObject, TimelineRecordType);
+        
         static double currentTimeInMilliseconds();
 
-        void didCompleteCurrentRecord();
+        void didCompleteCurrentRecord(TimelineRecordType);
+        
+        void addRecordToTimeline(ScriptObject, TimelineRecordType);
 
-        double m_sessionStartTime;
         InspectorFrontend* m_frontend;
-        OwnPtr<TimelineItem> m_currentTimelineItem;
+        
+        Vector< TimelineRecordEntry > m_recordStack;
     };
 
+inline InspectorTimelineAgent* InspectorTimelineAgent::retrieve(ScriptExecutionContext* context)
+{
+    if (context->isDocument())
+        return static_cast<Document*>(context)->inspectorTimelineAgent();
+    return 0;
+}
+
 } // namespace WebCore
 
 #endif // !defined(InspectorTimelineAgent_h)
diff --git a/WebCore/inspector/JavaScriptCallFrame.cpp b/WebCore/inspector/JavaScriptCallFrame.cpp
index 9225a03..1559d82 100644
--- a/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "JavaScriptCallFrame.h"
+#include "JSDOMBinding.h"
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
@@ -105,7 +106,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
         return jsNull();
 
     JSLock lock(SilenceAssertionsOnly);
-    return m_debuggerCallFrame.evaluate(script, exception);
+    return DebuggerCallFrame_evaluateInWorld(m_debuggerCallFrame, script, exception);
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/JavaScriptCallFrame.h b/WebCore/inspector/JavaScriptCallFrame.h
index e86b0eb..47cdac2 100644
--- a/WebCore/inspector/JavaScriptCallFrame.h
+++ b/WebCore/inspector/JavaScriptCallFrame.h
@@ -44,7 +44,12 @@ namespace WebCore {
             return adoptRef(new JavaScriptCallFrame(debuggerCallFrame, caller, sourceID, line));
         }
 
-        void invalidate() { m_isValid = false; }
+        void invalidate()
+        {
+            m_isValid = false;
+            m_debuggerCallFrame = 0;
+        }
+
         bool isValid() const { return m_isValid; }
 
         JavaScriptCallFrame* caller();
@@ -56,6 +61,7 @@ namespace WebCore {
             m_debuggerCallFrame = debuggerCallFrame;
             m_line = line;
             m_sourceID = sourceID;
+            m_isValid = true;
         }
 
         String functionName() const;
diff --git a/WebCore/inspector/JavaScriptProfileNode.cpp b/WebCore/inspector/JavaScriptProfileNode.cpp
index 3c3e279..2d462f6 100644
--- a/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/WebCore/inspector/JavaScriptProfileNode.cpp
@@ -104,28 +104,6 @@ static JSValueRef getSelfTime(JSContextRef ctx, JSObjectRef thisObject, JSString
     return JSValueMakeNumber(ctx, profileNode->selfTime());
 }
 
-static JSValueRef getTotalPercent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeNumber(ctx, profileNode->totalPercent());
-}
-
-static JSValueRef getSelfPercent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeNumber(ctx, profileNode->selfPercent());
-}
-
 static JSValueRef getNumberOfCalls(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -184,30 +162,6 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     return result;
 }
 
-static JSValueRef getParent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    ExecState* exec = toJS(ctx);
-    return toRef(exec, toJS(exec, profileNode->parent()));
-}
-
-static JSValueRef getHead(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    JSC::JSLock lock(SilenceAssertionsOnly);
-
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
-        return JSValueMakeUndefined(ctx);
-
-    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
-    ExecState* exec = toJS(ctx);
-    return toRef(exec, toJS(exec, profileNode->head()));
-}
-
 static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(SilenceAssertionsOnly);
@@ -245,12 +199,8 @@ JSClassRef ProfileNodeClass()
         { "lineNumber", getLineNumber, 0, kJSPropertyAttributeNone },
         { "totalTime", getTotalTime, 0, kJSPropertyAttributeNone },
         { "selfTime", getSelfTime, 0, kJSPropertyAttributeNone },
-        { "totalPercent", getTotalPercent, 0, kJSPropertyAttributeNone },
-        { "selfPercent", getSelfPercent, 0, kJSPropertyAttributeNone },
         { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
         { "children", getChildren, 0, kJSPropertyAttributeNone },
-        { "parent", getParent, 0, kJSPropertyAttributeNone },
-        { "head", getHead, 0, kJSClassAttributeNone },
         { "visible", getVisible, 0, kJSPropertyAttributeNone },
         { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
diff --git a/WebCore/inspector/TimelineItem.cpp b/WebCore/inspector/TimelineItem.cpp
deleted file mode 100644
index b368c49..0000000
--- a/WebCore/inspector/TimelineItem.cpp
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#include "config.h"
-#include "TimelineItem.h"
-
-#if ENABLE(INSPECTOR)
-
-#include "InspectorFrontend.h"
-#include "ScriptArray.h"
-#include "ScriptObject.h"
-
-namespace WebCore {
-
-TimelineItem::TimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, TimelineItemType itemType)
-    : m_startTime(startTime)
-    , m_endTime(0.0)
-    , m_itemType(itemType)
-    , m_previous(previous)
-{
-}
-
-void TimelineItem::addToTimeline(InspectorFrontend* frontend)
-{
-    frontend->addItemToTimeline(convertToScriptObject(frontend));
-}
-
-ScriptObject TimelineItem::convertToScriptObject(InspectorFrontend* frontend)
-{
-    ScriptObject selfObj = frontend->newScriptObject();
-    selfObj.set("time", m_startTime);
-    selfObj.set("type", static_cast<int>(m_itemType));
-    selfObj.set("duration", m_endTime - m_startTime);
-    ScriptArray children = convertChildrenToScriptArray(frontend);
-    selfObj.set("children", children);
-    return selfObj;
-}
-
-ScriptArray TimelineItem::convertChildrenToScriptArray(InspectorFrontend* frontend)
-{
-    ScriptArray children = frontend->newScriptArray();
-    for (unsigned i = 0; i < m_children.size(); ++i)
-        children.set(i, m_children[i]->convertToScriptObject(frontend));
-    return children;
-}
-
-void TimelineItem::addChildItem(PassOwnPtr<TimelineItem> timelineItem)
-{
-    m_children.append(timelineItem);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/TimelineItem.h b/WebCore/inspector/TimelineItem.h
deleted file mode 100644
index 1909230..0000000
--- a/WebCore/inspector/TimelineItem.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
-* Copyright (C) 2009 Google Inc. All rights reserved.
-*
-* Redistribution and use in source and binary forms, with or without
-* modification, are permitted provided that the following conditions are
-* met:
-*
-*     * Redistributions of source code must retain the above copyright
-* notice, this list of conditions and the following disclaimer.
-*     * Redistributions in binary form must reproduce the above
-* copyright notice, this list of conditions and the following disclaimer
-* in the documentation and/or other materials provided with the
-* distribution.
-*     * Neither the name of Google Inc. nor the names of its
-* contributors may be used to endorse or promote products derived from
-* this software without specific prior written permission.
-*
-* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
-
-#ifndef TimelineItem_h
-#define TimelineItem_h
-
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-    class InspectorFrontend;
-    class TimelineItem;
-    class ScriptArray;
-    class ScriptObject;
-
-    typedef Vector<OwnPtr<TimelineItem> > TimelineItems;
-
-    // Must be kept in sync with TimelineAgent.js
-    enum TimelineItemType {
-        DOMDispatchTimelineItemType = 0,
-        LayoutTimelineItemType = 1,
-        RecalculateStylesTimelineItemType = 2,
-        PaintTimelineItemType = 3,
-        ParseHTMLTimelineItemType = 4,
-    };
-
-    class TimelineItem {
-    public:
-        TimelineItem(PassOwnPtr<TimelineItem>, double startTime, TimelineItemType);
-
-        virtual ~TimelineItem() { }
-
-        TimelineItem* previous() const { return m_previous.get(); }
-
-        PassOwnPtr<TimelineItem*> releasePrevious() { return m_previous.release(); }
-
-        void addToTimeline(InspectorFrontend*);
-
-        void addChildItem(PassOwnPtr<TimelineItem>);
-
-        void setEndTime(double endTime) { m_endTime = endTime; }
-
-        TimelineItemType type() { return m_itemType; }
-    protected:
-        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
-
-        ScriptArray convertChildrenToScriptArray(InspectorFrontend*);
-      
-    private:
-        double m_startTime;
-        double m_endTime;
-        TimelineItemType m_itemType;
-        OwnPtr<TimelineItem> m_previous;
-        TimelineItems m_children;
-    };
-
-} // namespace WebCore
-
-#endif // !defined(TimelineItem_h)
diff --git a/WebCore/inspector/TimelineRecordFactory.cpp b/WebCore/inspector/TimelineRecordFactory.cpp
new file mode 100644
index 0000000..085bcd9
--- /dev/null
+++ b/WebCore/inspector/TimelineRecordFactory.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TimelineRecordFactory.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Event.h"
+#include "InspectorFrontend.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
+namespace WebCore {
+
+// static
+ScriptObject TimelineRecordFactory::createGenericRecord(InspectorFrontend* frontend, double startTime)
+{
+    ScriptObject record = frontend->newScriptObject();
+    record.set("startTime", startTime);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createDOMDispatchRecord(InspectorFrontend* frontend, double startTime, const Event& event)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("type", event.type().string());
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createGenericTimerRecord(InspectorFrontend* frontend, double startTime, int timerId)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("timerId", timerId);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createTimerInstallRecord(InspectorFrontend* frontend, double startTime, int timerId, int timeout, bool singleShot)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("timerId", timerId);
+    data.set("timeout", timeout);
+    data.set("singleShot", singleShot);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createXHRReadyStateChangeTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, int readyState)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("url", url);
+    data.set("readyState", readyState);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createXHRLoadTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url)
+{
+    ScriptObject record = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("url", url);
+    record.set("data", data);
+    return record;
+}
+
+// static
+ScriptObject TimelineRecordFactory::createEvaluateScriptTagTimelineRecord(InspectorFrontend* frontend, double startTime, const String& url, double lineNumber) 
+{
+    ScriptObject item = createGenericRecord(frontend, startTime);
+    ScriptObject data = frontend->newScriptObject();
+    data.set("url", url);
+    data.set("lineNumber", lineNumber);
+    item.set("data", data);
+    return item;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/TimelineRecordFactory.h b/WebCore/inspector/TimelineRecordFactory.h
new file mode 100644
index 0000000..3d36649
--- /dev/null
+++ b/WebCore/inspector/TimelineRecordFactory.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef TimelineRecordFactory_h
+#define TimelineRecordFactory_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Event;
+    class InspectorFrontend;
+    class ScriptObject;
+
+    class TimelineRecordFactory {
+    public:
+        static ScriptObject createGenericRecord(InspectorFrontend*, double startTime);
+
+        static ScriptObject createDOMDispatchRecord(InspectorFrontend*, double startTime, const Event&);
+
+        static ScriptObject createGenericTimerRecord(InspectorFrontend*, double startTime, int timerId);
+
+        static ScriptObject createTimerInstallRecord(InspectorFrontend*, double startTime, int timerId, int timeout, bool singleShot);
+
+        static ScriptObject createXHRReadyStateChangeTimelineRecord(InspectorFrontend*, double startTime, const String& url, int readyState);
+        static ScriptObject createXHRLoadTimelineRecord(InspectorFrontend*, double startTime, const String& url);
+        
+        static ScriptObject createEvaluateScriptTagTimelineRecord(InspectorFrontend*, double startTime, const String&, double lineNumber);
+
+    private:
+        TimelineRecordFactory() { }
+    };
+
+} // namespace WebCore
+
+#endif // !defined(TimelineRecordFactory_h)
diff --git a/WebCore/inspector/front-end/AbstractTimelinePanel.js b/WebCore/inspector/front-end/AbstractTimelinePanel.js
new file mode 100644
index 0000000..75e4062
--- /dev/null
+++ b/WebCore/inspector/front-end/AbstractTimelinePanel.js
@@ -0,0 +1,548 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.AbstractTimelinePanel = function()
+{
+    WebInspector.Panel.call(this);
+    this._items = [];
+    this._staleItems = [];
+}
+
+WebInspector.AbstractTimelinePanel.prototype = {
+    get categories()
+    {
+        // Should be implemented by the concrete subclasses.
+        return {};
+    },
+
+    populateSidebar: function()
+    {
+        // Should be implemented by the concrete subclasses.
+    },
+
+    createItemTreeElement: function(item)
+    {
+        // Should be implemented by the concrete subclasses.
+    },
+
+    createItemGraph: function(item)
+    {
+        // Should be implemented by the concrete subclasses.
+    },
+
+    createInterface: function()
+    {
+        this._createFilterPanel();
+
+        this.containerElement = document.createElement("div");
+        this.containerElement.id = "resources-container";
+        this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
+        this.element.appendChild(this.containerElement);
+
+        this.createSidebar(this.containerElement, this.element);
+        this.sidebarElement.id = "resources-sidebar";
+        this.populateSidebar();
+
+        this._createGraph();
+    },
+
+    _createFilterPanel: function()
+    {
+        this.filterBarElement = document.createElement("div");
+        this.filterBarElement.id = "resources-filter";
+        this.filterBarElement.className = "scope-bar";
+        this.element.appendChild(this.filterBarElement);
+
+        function createFilterElement(category)
+        {
+            if (category === "all")
+                var label = WebInspector.UIString("All");
+            else if (this.categories[category])
+                var label = this.categories[category].title;
+
+            var categoryElement = document.createElement("li");
+            categoryElement.category = category;
+            categoryElement.addStyleClass(category);
+            categoryElement.appendChild(document.createTextNode(label));
+            categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+            this.filterBarElement.appendChild(categoryElement);
+
+            return categoryElement;
+        }
+
+        this.filterAllElement = createFilterElement.call(this, "all");
+
+        // Add a divider
+        var dividerElement = document.createElement("div");
+        dividerElement.addStyleClass("divider");
+        this.filterBarElement.appendChild(dividerElement);
+
+        for (var category in this.categories)
+            createFilterElement.call(this, category);
+    },
+
+    _showCategory: function(category)
+    {
+        var filterClass = "filter-" + category.toLowerCase();
+        this.itemsGraphsElement.addStyleClass(filterClass);
+        this.itemsTreeElement.childrenListElement.addStyleClass(filterClass);
+    },
+
+    _hideCategory: function(category)
+    {
+        var filterClass = "filter-" + category.toLowerCase();
+        this.itemsGraphsElement.removeStyleClass(filterClass);
+        this.itemsTreeElement.childrenListElement.removeStyleClass(filterClass);
+    },
+
+    filter: function(target, selectMultiple)
+    {
+        function unselectAll()
+        {
+            for (var i = 0; i < this.filterBarElement.childNodes.length; ++i) {
+                var child = this.filterBarElement.childNodes[i];
+                if (!child.category)
+                    continue;
+
+                child.removeStyleClass("selected");
+                this._hideCategory(child.category);
+            }
+        }
+
+        if (target === this.filterAllElement) {
+            if (target.hasStyleClass("selected")) {
+                // We can't unselect All, so we break early here
+                return;
+            }
+
+            // If All wasn't selected, and now is, unselect everything else.
+            unselectAll.call(this);
+        } else {
+            // Something other than All is being selected, so we want to unselect All.
+            if (this.filterAllElement.hasStyleClass("selected")) {
+                this.filterAllElement.removeStyleClass("selected");
+                this._hideCategory("all");
+            }
+        }
+
+        if (!selectMultiple) {
+            // If multiple selection is off, we want to unselect everything else
+            // and just select ourselves.
+            unselectAll.call(this);
+
+            target.addStyleClass("selected");
+            this._showCategory(target.category);
+            return;
+        }
+
+        if (target.hasStyleClass("selected")) {
+            // If selectMultiple is turned on, and we were selected, we just
+            // want to unselect ourselves.
+            target.removeStyleClass("selected");
+            this._hideCategory(target.category);
+        } else {
+            // If selectMultiple is turned on, and we weren't selected, we just
+            // want to select ourselves.
+            target.addStyleClass("selected");
+            this._showCategory(target.category);
+        }
+    },
+
+    _updateFilter: function(e)
+    {
+        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var selectMultiple = false;
+        if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+        if (!isMac && e.ctrlKey && !e.metaKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+
+        this.filter(e.target, selectMultiple);
+
+        // When we are updating our filtering, scroll to the top so we don't end up
+        // in blank graph under all the resources.
+        this.containerElement.scrollTop = 0;
+    },
+
+    _createGraph: function()
+    {
+        this._containerContentElement = document.createElement("div");
+        this._containerContentElement.id = "resources-container-content";
+        this.containerElement.appendChild(this._containerContentElement);
+
+        this.summaryBar = new WebInspector.SummaryBar(this.categories);
+        this.summaryBar.element.id = "resources-summary";
+        this._containerContentElement.appendChild(this.summaryBar.element);
+
+        this.itemsGraphsElement = document.createElement("div");
+        this.itemsGraphsElement.id = "resources-graphs";
+        this._containerContentElement.appendChild(this.itemsGraphsElement);
+
+        this.dividersElement = document.createElement("div");
+        this.dividersElement.id = "resources-dividers";
+        this._containerContentElement.appendChild(this.dividersElement);
+
+        this.eventDividersElement = document.createElement("div");
+        this.eventDividersElement.id = "resources-event-dividers";
+        this._containerContentElement.appendChild(this.eventDividersElement);
+
+        this.dividersLabelBarElement = document.createElement("div");
+        this.dividersLabelBarElement.id = "resources-dividers-label-bar";
+        this._containerContentElement.appendChild(this.dividersLabelBarElement);
+    },
+
+    updateGraphDividersIfNeeded: function(force)
+    {
+        if (!this.visible) {
+            this.needsRefresh = true;
+            return false;
+        }
+
+        if (document.body.offsetWidth <= 0) {
+            // The stylesheet hasn't loaded yet or the window is closed,
+            // so we can't calculate what is need. Return early.
+            return false;
+        }
+
+        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
+        var slice = this.calculator.boundarySpan / dividerCount;
+        if (!force && this._currentDividerSlice === slice)
+            return false;
+
+        this._currentDividerSlice = slice;
+
+        this.dividersElement.removeChildren();
+        this.eventDividersElement.removeChildren();
+        this.dividersLabelBarElement.removeChildren();
+
+        for (var i = 1; i <= dividerCount; ++i) {
+            var divider = document.createElement("div");
+            divider.className = "resources-divider";
+            if (i === dividerCount)
+                divider.addStyleClass("last");
+            divider.style.left = ((i / dividerCount) * 100) + "%";
+
+            this.dividersElement.appendChild(divider.cloneNode());
+
+            var label = document.createElement("div");
+            label.className = "resources-divider-label";
+            if (!isNaN(slice))
+                label.textContent = this.calculator.formatValue(slice * i);
+            divider.appendChild(label);
+
+            this.dividersLabelBarElement.appendChild(divider);
+        }
+    },
+
+    _updateDividersLabelBarPosition: function()
+    {
+        var scrollTop = this.containerElement.scrollTop;
+        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
+        this.dividersElement.style.top = scrollTop + "px";
+        this.eventDividersElement.style.top = scrollTop + "px";
+        this.dividersLabelBarElement.style.top = dividersTop + "px";
+    },
+
+    get needsRefresh()
+    {
+        return this._needsRefresh;
+    },
+
+    set needsRefresh(x)
+    {
+        if (this._needsRefresh === x)
+            return;
+
+        this._needsRefresh = x;
+
+        if (x) {
+            if (this.visible && !("_refreshTimeout" in this))
+                this._refreshTimeout = setTimeout(this.refresh.bind(this), 500);
+        } else {
+            if ("_refreshTimeout" in this) {
+                clearTimeout(this._refreshTimeout);
+                delete this._refreshTimeout;
+            }
+        }
+    },
+
+    refreshIfNeeded: function()
+    {
+        if (this.needsRefresh)
+            this.refresh();
+    },
+
+    show: function()
+    {
+        WebInspector.Panel.prototype.show.call(this);
+
+        this._updateDividersLabelBarPosition();
+        this.refreshIfNeeded();
+    },
+
+    resize: function()
+    {
+        this.updateGraphDividersIfNeeded();
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._containerContentElement.style.left = width + "px";
+        this.updateGraphDividersIfNeeded();
+    },
+
+    refresh: function()
+    {
+        this.needsRefresh = false;
+
+        var staleItemsLength = this._staleItems.length;
+        var boundariesChanged = false;
+
+        for (var i = 0; i < staleItemsLength; ++i) {
+            var item = this._staleItems[i];
+            if (!item._itemTreeElement) {
+                // Create the timeline tree element and graph.
+                item._itemTreeElement = this.createItemTreeElement(item);
+                item._itemTreeElement._itemGraph = this.createItemGraph(item);
+
+                this.itemsTreeElement.appendChild(item._itemTreeElement);
+                this.itemsGraphsElement.appendChild(item._itemTreeElement._itemGraph.graphElement);
+            }
+
+            if (item._itemTreeElement.refresh)
+                item._itemTreeElement.refresh();
+
+            if (this.calculator.updateBoundaries(item))
+                boundariesChanged = true;
+        }
+
+        if (boundariesChanged) {
+            // The boundaries changed, so all item graphs are stale.
+            this._staleItems = this._items;
+            staleItemsLength = this._staleItems.length;
+        }
+
+        for (var i = 0; i < staleItemsLength; ++i)
+            this._staleItems[i]._itemTreeElement._itemGraph.refresh(this.calculator);
+
+        this._staleItems = [];
+
+        this.updateGraphDividersIfNeeded();
+    },
+
+    reset: function()
+    {
+        this.containerElement.scrollTop = 0;
+
+        if (this._calculator)
+            this._calculator.reset();
+
+        if (this._items) {
+            var itemsLength = this._items.length;
+            for (var i = 0; i < itemsLength; ++i) {
+                var item = this._items[i];
+                delete item._itemsTreeElement;
+            }
+        }
+
+        this._items = [];
+        this._staleItems = [];
+
+        this.itemsTreeElement.removeChildren();
+        this.itemsGraphsElement.removeChildren();
+
+        this.updateGraphDividersIfNeeded(true);
+    },
+
+    get calculator()
+    {
+        return this._calculator;
+    },
+
+    set calculator(x)
+    {
+        if (!x || this._calculator === x)
+            return;
+
+        this._calculator = x;
+        this._calculator.reset();
+
+        this._staleItems = this._items;
+        this.refresh();
+    },
+
+    addItem: function(item)
+    {
+        this._items.push(item);
+        this.refreshItem(item);
+    },
+
+    removeItem: function(item)
+    {
+        this._items.remove(item, true);
+
+        if (item._itemTreeElement) {
+            this.itemsTreeElement.removeChild(resource._itemTreeElement);
+            this.itemsGraphsElement.removeChild(resource._itemTreeElement._itemGraph.graphElement);
+        }
+
+        delete item._itemTreeElement;
+        this.adjustScrollPosition();
+    },
+
+    refreshItem: function(item)
+    {
+        this._staleItems.push(item);
+        this.needsRefresh = true;
+    },
+
+    revealAndSelectItem: function(item)
+    {
+        if (item._itemsTreeElement) {
+            item._itemsTreeElement.reveal();
+            item._itemsTreeElement.select(true);
+        }
+    },
+
+    sortItems: function(sortingFunction)
+    {
+        var sortedElements = [].concat(this.itemsTreeElement.children);
+        sortedElements.sort(sortingFunction);
+
+        var sortedElementsLength = sortedElements.length;
+        for (var i = 0; i < sortedElementsLength; ++i) {
+            var treeElement = sortedElements[i];
+            if (treeElement === this.itemsTreeElement.children[i])
+                continue;
+
+            var wasSelected = treeElement.selected;
+            this.itemsTreeElement.removeChild(treeElement);
+            this.itemsTreeElement.insertChild(treeElement, i);
+            if (wasSelected)
+                treeElement.select(true);
+
+            var graphElement = treeElement._itemGraph.graphElement;
+            this.itemsGraphsElement.insertBefore(graphElement, this.itemsGraphsElement.children[i]);
+        }
+    },
+
+    adjustScrollPosition: function()
+    {
+        // Prevent the container from being scrolled off the end.
+        if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
+            this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
+    }
+}
+
+WebInspector.AbstractTimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
+
+WebInspector.AbstractTimelineCalculator = function()
+{
+}
+
+WebInspector.AbstractTimelineCalculator.prototype = {
+    computeSummaryValues: function(items)
+    {
+        var total = 0;
+        var categoryValues = {};
+
+        var itemsLength = items.length;
+        for (var i = 0; i < itemsLength; ++i) {
+            var item = items[i];
+            var value = this._value(item);
+            if (typeof value === "undefined")
+                continue;
+            if (!(item.category.name in categoryValues))
+                categoryValues[item.category.name] = 0;
+            categoryValues[item.category.name] += value;
+            total += value;
+        }
+
+        return {categoryValues: categoryValues, total: total};
+    },
+
+    computeBarGraphPercentages: function(item)
+    {
+        return {start: 0, middle: 0, end: (this._value(item) / this.boundarySpan) * 100};
+    },
+
+    computeBarGraphLabels: function(item)
+    {
+        const label = this.formatValue(this._value(item));
+        return {left: label, right: label, tooltip: label};
+    },
+
+    get boundarySpan()
+    {
+        return this.maximumBoundary - this.minimumBoundary;
+    },
+
+    updateBoundaries: function(item)
+    {
+        this.minimumBoundary = 0;
+
+        var value = this._value(item);
+        if (typeof this.maximumBoundary === "undefined" || value > this.maximumBoundary) {
+            this.maximumBoundary = value;
+            return true;
+        }
+        return false;
+    },
+
+    reset: function()
+    {
+        delete this.minimumBoundary;
+        delete this.maximumBoundary;
+    },
+
+    _value: function(item)
+    {
+        return 0;
+    },
+
+    formatValue: function(value)
+    {
+        return value.toString();
+    }
+}
+
+WebInspector.AbstractTimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+}
+
+WebInspector.AbstractTimelineCategory.prototype = {
+    toString: function()
+    {
+        return this.title;
+    }
+}
diff --git a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
index 89b4ddc..41a8a3a 100644
--- a/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -29,6 +29,110 @@
 // each child still represent the root node. We have to be particularly careful of recursion with this mode
 // because a root node can represent itself AND an ancestor.
 
+WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
+{
+    // In bottom up mode, our parents are our children since we display an inverted tree.
+    // However, we don't want to show the very top parent since it is redundant.
+    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingNodeInfos = [];
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype = {
+    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        this._save();
+
+        this.selfTime = profileDataGridNode.selfTime;
+        this.totalTime = profileDataGridNode.totalTime;
+        this.numberOfCalls = profileDataGridNode.numberOfCalls;
+    },
+
+    // When focusing, we keep just the members of the callstack.
+    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
+    {
+        this._save();
+
+        this.removeChildren();
+        this.appendChild(child);
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingNodeInfos)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    },
+
+    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
+    {
+        this.selfTime -= child.selfTime;
+
+        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
+    },
+
+    _sharedPopulate: function()
+    {
+        var remainingNodeInfos = this._remainingNodeInfos;
+        var count = remainingNodeInfos.length;
+
+        for (var index = 0; index < count; ++index) {
+            var nodeInfo = remainingNodeInfos[index];
+            var ancestor = nodeInfo.ancestor;
+            var focusNode = nodeInfo.focusNode;
+            var child = this.findChild(ancestor);
+
+            // If we already have this child, then merge the data together.
+            if (child) {
+                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
+
+                child.selfTime += focusNode.selfTime;
+                child.numberOfCalls += focusNode.numberOfCalls;
+
+                if (!totalTimeAccountedFor)
+                    child.totalTime += focusNode.totalTime;
+            } else {
+                // If not, add it as a true ancestor.
+                // In heavy mode, we take our visual identity from ancestor node...
+                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
+
+                if (ancestor !== focusNode) {
+                    // but the actual statistics from the "root" node (bottom of the callstack).
+                    child.selfTime = focusNode.selfTime;
+                    child.totalTime = focusNode.totalTime;
+                    child.numberOfCalls = focusNode.numberOfCalls;
+                }
+
+                this.appendChild(child);
+            }
+
+            var parent = ancestor.parent;
+            if (parent && parent.parent) {
+                nodeInfo.ancestor = parent;
+                child._remainingNodeInfos.push(nodeInfo);
+            }
+        }
+
+        delete this._remainingNodeInfos;
+    }
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+
 WebInspector.BottomUpProfileDataGridTree = function(/*ProfileView*/ aProfileView, /*ProfileNode*/ aProfileNode)
 {
     WebInspector.ProfileDataGridTree.call(this, aProfileView, aProfileNode);
@@ -139,114 +243,10 @@ WebInspector.BottomUpProfileDataGridTree.prototype = {
 
         if (this.lastComparator)
             this.sort(this.lastComparator, true);
-    }
-}
-
-WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
-
-WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
-{
-    // In bottom up mode, our parents are our children since we display an inverted tree.
-    // However, we don't want to show the very top parent since it is redundant.
-    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
-
-    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
-
-    this._remainingNodeInfos = [];
-}
-
-WebInspector.BottomUpProfileDataGridNode.prototype = {
-    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
-    {
-        this._save();
-
-        this.selfTime = profileDataGridNode.selfTime;
-        this.totalTime = profileDataGridNode.totalTime;
-        this.numberOfCalls = profileDataGridNode.numberOfCalls;
-    },
-
-    // When focusing, we keep just the members of the callstack.
-    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
-    {
-        this._save();
-
-        this.removeChildren();
-        this.appendChild(child);
-    },
-
-    _exclude: function(aCallUID)
-    {
-        if (this._remainingNodeInfos)
-            this._populate();
-
-        this._save();
-
-        var children = this.children;
-        var index = this.children.length;
-
-        while (index--)
-            children[index]._exclude(aCallUID);
-
-        var child = this.childrenByCallUID[aCallUID];
-
-        if (child)
-            this._merge(child, true);
-    },
-
-    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
-    {
-        this.selfTime -= child.selfTime;
-
-        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
     },
 
-    _populate: function(event)
-    {
-        var remainingNodeInfos = this._remainingNodeInfos;
-        var count = remainingNodeInfos.length;
-
-        for (var index = 0; index < count; ++index) {
-            var nodeInfo = remainingNodeInfos[index];
-            var ancestor = nodeInfo.ancestor;
-            var focusNode = nodeInfo.focusNode;
-            var child = this.findChild(ancestor);
-
-            // If we already have this child, then merge the data together.
-            if (child) {
-                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
-
-                child.selfTime += focusNode.selfTime;
-                child.numberOfCalls += focusNode.numberOfCalls;
-
-                if (!totalTimeAccountedFor)
-                    child.totalTime += focusNode.totalTime;
-            } else {
-                // If not, add it as a true ancestor.
-                // In heavy mode, we take our visual identity from ancestor node...
-                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
-
-                if (ancestor !== focusNode) {
-                    // but the actual statistics from the "root" node (bottom of the callstack).
-                    child.selfTime = focusNode.selfTime;
-                    child.totalTime = focusNode.totalTime;
-                    child.numberOfCalls = focusNode.numberOfCalls;
-                }
-
-                this.appendChild(child);
-            }
-
-            var parent = ancestor.parent;
-            if (parent && parent.parent) {
-                nodeInfo.ancestor = parent;
-                child._remainingNodeInfos.push(nodeInfo);
-            }
-        }
-
-        delete this._remainingNodeInfos;
-
-        if (this.removeEventListener)
-            this.removeEventListener("populate", this._populate, this);
-    }
+    _sharedPopulate: WebInspector.BottomUpProfileDataGridNode.prototype._sharedPopulate
 }
 
-WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
+
diff --git a/WebCore/inspector/front-end/ConsoleView.js b/WebCore/inspector/front-end/ConsoleView.js
index 3782d32..9317824 100644
--- a/WebCore/inspector/front-end/ConsoleView.js
+++ b/WebCore/inspector/front-end/ConsoleView.js
@@ -27,6 +27,8 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+const ExpressionStopCharacters = " =:[({;,!+-*/&|^<>";
+
 WebInspector.ConsoleView = function(drawer)
 {
     WebInspector.View.call(this, document.getElementById("console-view"));
@@ -44,7 +46,7 @@ WebInspector.ConsoleView = function(drawer)
 
     this.promptElement = document.getElementById("console-prompt");
     this.promptElement.handleKeyEvent = this._promptKeyDown.bind(this);
-    this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), " .=:[({;");
+    this.prompt = new WebInspector.TextPrompt(this.promptElement, this.completions.bind(this), ExpressionStopCharacters + ".");
 
     this.topGroup = new WebInspector.ConsoleGroup(null, 0);
     this.messagesElement.insertBefore(this.topGroup.element, this.promptElement);
@@ -92,49 +94,76 @@ WebInspector.ConsoleView = function(drawer)
     this.warningElement = createFilterElement.call(this, "Warnings");
     this.logElement = createFilterElement.call(this, "Logs");
 
-    this.filter(this.allElement);
+    this.filter(this.allElement, false);
 }
 
 WebInspector.ConsoleView.prototype = {
     
     _updateFilter: function(e)
     {
-        this.filter(e.target);
+        var isMac = InspectorController.platform().indexOf("mac-") === 0;
+        var selectMultiple = false;
+        if (isMac && e.metaKey && !e.ctrlKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+        if (!isMac && e.ctrlKey && !e.metaKey && !e.altKey && !e.shiftKey)
+            selectMultiple = true;
+
+        this.filter(e.target, selectMultiple);
     },
     
-    filter: function(target)
+    filter: function(target, selectMultiple)
     {
+        function unselectAll()
+        {
+            this.allElement.removeStyleClass("selected");
+            this.errorElement.removeStyleClass("selected");
+            this.warningElement.removeStyleClass("selected");
+            this.logElement.removeStyleClass("selected");
+            
+            this.messagesElement.removeStyleClass("filter-all");
+            this.messagesElement.removeStyleClass("filter-errors");
+            this.messagesElement.removeStyleClass("filter-warnings");
+            this.messagesElement.removeStyleClass("filter-logs");
+        }
+        
+        var targetFilterClass = "filter-" + target.category.toLowerCase();
+
         if (target.category == "All") {
             if (target.hasStyleClass("selected")) {
                 // We can't unselect all, so we break early here
                 return;
             }
-            
-            this.errorElement.removeStyleClass("selected");
-            this.warningElement.removeStyleClass("selected");
-            this.logElement.removeStyleClass("selected");
-            
-            document.getElementById("console-messages").removeStyleClass("filter-errors");
-            document.getElementById("console-messages").removeStyleClass("filter-warnings");
-            document.getElementById("console-messages").removeStyleClass("filter-logs");
+
+            unselectAll.call(this);
         } else {
             // Something other than all is being selected, so we want to unselect all
             if (this.allElement.hasStyleClass("selected")) {
                 this.allElement.removeStyleClass("selected");
-                document.getElementById("console-messages").removeStyleClass("filter-all");
+                this.messagesElement.removeStyleClass("filter-all");
             }
         }
         
+        if (!selectMultiple) {
+            // If multiple selection is off, we want to unselect everything else
+            // and just select ourselves.
+            unselectAll.call(this);
+            
+            target.addStyleClass("selected");
+            this.messagesElement.addStyleClass(targetFilterClass);
+            
+            return;
+        }
+        
         if (target.hasStyleClass("selected")) {
+            // If selectMultiple is turned on, and we were selected, we just
+            // want to unselect ourselves.
             target.removeStyleClass("selected");
-            var newClass = "filter-" + target.category.toLowerCase();
-            var filterElement = document.getElementById("console-messages");
-            filterElement.removeStyleClass(newClass);
+            this.messagesElement.removeStyleClass(targetFilterClass);
         } else {
+            // If selectMultiple is turned on, and we weren't selected, we just
+            // want to select ourselves.
             target.addStyleClass("selected");
-            var newClass = "filter-" + target.category.toLowerCase();
-            var filterElement = document.getElementById("console-messages");
-            filterElement.addStyleClass(newClass);
+            this.messagesElement.addStyleClass(targetFilterClass);
         }
     },
     
@@ -172,40 +201,7 @@ WebInspector.ConsoleView.prototype = {
     addMessage: function(msg)
     {
         if (msg instanceof WebInspector.ConsoleMessage && !(msg instanceof WebInspector.ConsoleCommandResult)) {
-            msg.totalRepeatCount = msg.repeatCount;
-            msg.repeatDelta = msg.repeatCount;
-
-            var messageRepeated = false;
-
-            if (msg.isEqual && msg.isEqual(this.previousMessage)) {
-                // Because sometimes we get a large number of repeated messages and sometimes
-                // we get them one at a time, we need to know the difference between how many
-                // repeats we used to have and how many we have now.
-                msg.repeatDelta -= this.previousMessage.totalRepeatCount;
-
-                if (!isNaN(this.repeatCountBeforeCommand))
-                    msg.repeatCount -= this.repeatCountBeforeCommand;
-
-                if (!this.commandSincePreviousMessage) {
-                    // Recreate the previous message element to reset the repeat count.
-                    var messagesElement = this.currentGroup.messagesElement;
-                    messagesElement.removeChild(messagesElement.lastChild);
-                    messagesElement.appendChild(msg.toMessageElement());
-
-                    messageRepeated = true;
-                }
-            } else
-                delete this.repeatCountBeforeCommand;
-
-            // Increment the error or warning count
-            switch (msg.level) {
-            case WebInspector.ConsoleMessage.MessageLevel.Warning:
-                WebInspector.warnings += msg.repeatDelta;
-                break;
-            case WebInspector.ConsoleMessage.MessageLevel.Error:
-                WebInspector.errors += msg.repeatDelta;
-                break;
-            }
+            this._incrementErrorWarningCount(msg);
 
             // Add message to the resource panel
             if (msg.url in WebInspector.resourceURLMap) {
@@ -216,13 +212,9 @@ WebInspector.ConsoleView.prototype = {
 
             this.commandSincePreviousMessage = false;
             this.previousMessage = msg;
-
-            if (messageRepeated)
-                return;
         } else if (msg instanceof WebInspector.ConsoleCommand) {
             if (this.previousMessage) {
                 this.commandSincePreviousMessage = true;
-                this.repeatCountBeforeCommand = this.previousMessage.totalRepeatCount;
             }
         }
 
@@ -250,6 +242,35 @@ WebInspector.ConsoleView.prototype = {
         this.promptElement.scrollIntoView(false);
     },
 
+    updateMessageRepeatCount: function(count) {
+        var msg = this.previousMessage;
+        var prevRepeatCount = msg.totalRepeatCount;
+        
+        if (!this.commandSincePreviousMessage) {
+            msg.repeatDelta = count - prevRepeatCount;
+            msg.repeatCount = msg.repeatCount + msg.repeatDelta;
+            msg.totalRepeatCount = count;
+            msg._updateRepeatCount();
+            this._incrementErrorWarningCount(msg);
+        } else {
+            msgCopy = new WebInspector.ConsoleMessage(msg.source, msg.type, msg.level, msg.line, msg.url, msg.groupLevel, count - prevRepeatCount);
+            msgCopy.totalRepeatCount = count;
+            msgCopy.setMessageBody(msg.args);
+            this.addMessage(msgCopy);
+        }
+    },
+
+    _incrementErrorWarningCount: function(msg) {
+        switch (msg.level) {
+            case WebInspector.ConsoleMessage.MessageLevel.Warning:
+                WebInspector.warnings += msg.repeatDelta;
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.Error:
+                WebInspector.errors += msg.repeatDelta;
+                break;
+        }
+    },
+
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
@@ -267,15 +288,13 @@ WebInspector.ConsoleView.prototype = {
         WebInspector.warnings = 0;
 
         delete this.commandSincePreviousMessage;
-        delete this.repeatCountBeforeCommand;
         delete this.previousMessage;
     },
 
     completions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         // Pass less stop characters to rangeOfWord so the range will be a more complete expression.
-        const expressionStopCharacters = " =:{;";
-        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, expressionStopCharacters, this.promptElement, "backward");
+        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, this.promptElement, "backward");
         var expressionString = expressionRange.toString();
         var lastIndex = expressionString.length - 1;
 
@@ -292,16 +311,6 @@ WebInspector.ConsoleView.prototype = {
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
         // Collect comma separated object properties for the completion.
 
-        if (!expressionString) {
-            if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-                // Evaluate into properties in scope of the selected call frame.
-                reportCompletions(WebInspector.panels.scripts.variablesInSelectedCallFrame());
-                return;
-            } else {
-                expressionString = "this";
-            }
-        }
-
         var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
             var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
@@ -343,7 +352,7 @@ WebInspector.ConsoleView.prototype = {
             if (bestMatchOnly)
                 break;
         }
-        setTimeout(completionsReadyCallback, 0, results);
+        completionsReadyCallback(results);
     },
 
     _clearButtonClicked: function()
@@ -382,10 +391,9 @@ WebInspector.ConsoleView.prototype = {
 
     _promptKeyDown: function(event)
     {
-        switch (event.keyIdentifier) {
-            case "Enter":
-                this._enterKeyPressed(event);
-                return;
+        if (isEnterKey(event)) {
+            this._enterKeyPressed(event);
+            return;
         }
 
         this.prompt.handleKeyEvent(event);
@@ -514,21 +522,31 @@ WebInspector.ConsoleView.prototype = {
 
     _formatarray: function(arr, elem)
     {
-        var self = this;
-        function printResult(properties)
-        {
-            if (!properties)
-                return;
-            elem.appendChild(document.createTextNode("["));
-            for (var i = 0; i < properties.length; ++i) {
-                var property = properties[i].value;
-                elem.appendChild(self._format(property));
-                if (i < properties.length - 1)
-                    elem.appendChild(document.createTextNode(", "));
-            }
-            elem.appendChild(document.createTextNode("]"));
+        InjectedScriptAccess.getProperties(arr, false, this._printArray.bind(this, elem));
+    },
+
+    _printArray: function(elem, properties)
+    {
+        if (!properties)
+            return;
+        var elements = [];
+        for (var i = 0; i < properties.length; ++i) {
+            var name = properties[i].name;
+            if (name == parseInt(name))
+                elements[name] = this._format(properties[i].value);
         }
-        InjectedScriptAccess.getProperties(arr, false, printResult);
+
+        elem.appendChild(document.createTextNode("["));
+        for (var i = 0; i < elements.length; ++i) {
+            var element = elements[i];
+            if (element)
+                elem.appendChild(element);
+            else
+                elem.appendChild(document.createTextNode("undefined"))
+            if (i < elements.length - 1)
+                elem.appendChild(document.createTextNode(", "));
+        }
+        elem.appendChild(document.createTextNode("]"));
     },
 
     _formatnode: function(object, elem)
@@ -538,6 +556,7 @@ WebInspector.ConsoleView.prototype = {
             if (!nodeId)
                 return;
             var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.showInElementsPanelEnabled = true;
             treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
             treeOutline.element.addStyleClass("outline-disclosure");
             if (!treeOutline.children[0].hasChildren)
@@ -589,6 +608,8 @@ WebInspector.ConsoleMessage = function(source, type, level, line, url, groupLeve
     this.url = url;
     this.groupLevel = groupLevel;
     this.repeatCount = repeatCount;
+    this.repeatDelta = repeatCount;
+    this.totalRepeatCount = repeatCount;
     if (arguments.length > 7)
         this.setMessageBody(Array.prototype.slice.call(arguments, 7));
 }
@@ -596,6 +617,7 @@ WebInspector.ConsoleMessage = function(source, type, level, line, url, groupLeve
 WebInspector.ConsoleMessage.prototype = {
     setMessageBody: function(args)
     {
+        this.args = args;
         switch (this.type) {
             case WebInspector.ConsoleMessage.MessageType.Trace:
                 var span = document.createElement("span");
@@ -691,13 +713,15 @@ WebInspector.ConsoleMessage.prototype = {
 
     toMessageElement: function()
     {
-        if (this.propertiesSection)
-            return this.propertiesSection.element;
+        if (this._element)
+            return this._element;
 
         var element = document.createElement("div");
         element.message = this;
         element.className = "console-message";
 
+        this._element = element;
+
         switch (this.source) {
             case WebInspector.ConsoleMessage.MessageSource.HTML:
                 element.addStyleClass("console-html-source");
@@ -737,9 +761,8 @@ WebInspector.ConsoleMessage.prototype = {
                 break;
         }
         
-        if (this.type === WebInspector.ConsoleMessage.MessageType.StartGroup) {
+        if (this.type === WebInspector.ConsoleMessage.MessageType.StartGroup)
             element.addStyleClass("console-group-title");
-        }
 
         if (this.elementsTreeOutline) {
             element.addStyleClass("outline-disclosure");
@@ -747,15 +770,6 @@ WebInspector.ConsoleMessage.prototype = {
             return element;
         }
 
-        if (this.repeatCount > 1) {
-            var messageRepeatCountElement = document.createElement("span");
-            messageRepeatCountElement.className = "bubble";
-            messageRepeatCountElement.textContent = this.repeatCount;
-
-            element.appendChild(messageRepeatCountElement);
-            element.addStyleClass("repeated-message");
-        }
-
         if (this.url && this.url !== "undefined") {
             var urlElement = document.createElement("a");
             urlElement.className = "console-message-url webkit-html-resource-link";
@@ -775,12 +789,28 @@ WebInspector.ConsoleMessage.prototype = {
 
         var messageTextElement = document.createElement("span");
         messageTextElement.className = "console-message-text";
+        if (this.type === WebInspector.ConsoleMessage.MessageType.Assert)
+            messageTextElement.appendChild(document.createTextNode(WebInspector.UIString("Assertion failed: ")));
         messageTextElement.appendChild(this.formattedMessage);
         element.appendChild(messageTextElement);
 
+        if (this.repeatCount > 1)
+            this._updateRepeatCount();
+
         return element;
     },
 
+    _updateRepeatCount: function() {
+        if (!this.repeatCountElement) {
+            this.repeatCountElement = document.createElement("span");
+            this.repeatCountElement.className = "bubble";
+    
+            this._element.insertBefore(this.repeatCountElement, this._element.firstChild);
+            this._element.addStyleClass("repeated-message");
+        }
+        this.repeatCountElement.textContent = this.repeatCount;
+    },
+
     toString: function()
     {
         var sourceString;
@@ -822,6 +852,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageType.EndGroup:
                 typeString = "End Group";
                 break;
+            case WebInspector.ConsoleMessage.MessageType.Assert:
+                typeString = "Assert";
+                break;
         }
         
         var levelString;
@@ -877,7 +910,8 @@ WebInspector.ConsoleMessage.MessageType = {
     Object: 1,
     Trace: 2,
     StartGroup: 3,
-    EndGroup: 4
+    EndGroup: 4,
+    Assert: 5
 }
 
 WebInspector.ConsoleMessage.MessageLevel = {
diff --git a/WebCore/inspector/front-end/CookieItemsView.js b/WebCore/inspector/front-end/CookieItemsView.js
index 9397e7c..9f9845c 100644
--- a/WebCore/inspector/front-end/CookieItemsView.js
+++ b/WebCore/inspector/front-end/CookieItemsView.js
@@ -252,7 +252,7 @@ WebInspector.CookieItemsView.prototype = {
     
     resize: function()
     {
-        if (this._datagrid)
+        if (this._dataGrid)
             this._dataGrid.updateWidths();
     },
 
diff --git a/WebCore/inspector/front-end/DatabaseQueryView.js b/WebCore/inspector/front-end/DatabaseQueryView.js
index 6c5fa02..e85af66 100644
--- a/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -94,10 +94,9 @@ WebInspector.DatabaseQueryView.prototype = {
 
     _promptKeyDown: function(event)
     {
-        switch (event.keyIdentifier) {
-            case "Enter":
-                this._enterKeyPressed(event);
-                return;
+        if (isEnterKey(event)) {
+            this._enterKeyPressed(event);
+            return;
         }
 
         this.prompt.handleKeyEvent(event);
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index fd0874a..aa6319c 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -268,7 +268,12 @@ WebInspector.ElementsPanel.prototype = {
 
             if (!this._searchResults.length) {
                 this._currentSearchResultIndex = 0;
-                this.focusedDOMNode = node;
+
+                // Only change the focusedDOMNode if the search was manually performed, because
+                // the search may have been performed programmatically and we wouldn't want to
+                // change the current focusedDOMNode.
+                if (WebInspector.currentFocusElement === document.getElementById("search"))
+                    this.focusedDOMNode = node;
             }
 
             this._searchResults.push(node);
@@ -479,7 +484,7 @@ WebInspector.ElementsPanel.prototype = {
                 updatedParentTreeElements.push(parentNodeItem);
             }
 
-            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestor(this.focusedDOMNode, parent)))
+            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestorNode(this.focusedDOMNode, parent)))
                 updateBreadcrumbs = true;
         }
 
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index 9e13773..be01647 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -38,6 +38,7 @@ WebInspector.ElementsTreeOutline = function() {
 
     this.includeRootDOMNode = true;
     this.selectEnabled = false;
+    this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
 }
@@ -184,6 +185,34 @@ WebInspector.ElementsTreeOutline.prototype = {
 
         return element;
     },
+    
+    handleKeyEvent: function(event)
+    {
+        var selectedElement = this.selectedTreeElement;
+        if (!selectedElement)
+            return;
+
+        // Delete or backspace pressed, delete the node.
+        if (event.keyCode === 8 || event.keyCode === 46) {
+            selectedElement.remove();
+            return;
+        }
+
+        // On Enter or Return start editing the first attribute
+        // or create a new attribute on the selected element.
+        if (event.keyIdentifier === "Enter") {
+            if (this._editing)
+                return;
+
+            selectedElement._startEditing();
+
+            // prevent a newline from being immediately inserted
+            event.preventDefault();
+            return;
+        }
+
+        TreeOutline.prototype.handleKeyEvent.call(this, event);
+    },
 
     _onmousedown: function(event)
     {
@@ -197,12 +226,15 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     _onmousemove: function(event)
     {
+        var element = this._treeElementFromEvent(event);
+        if (element && this._previousHoveredElement === element)
+            return;
+
         if (this._previousHoveredElement) {
             this._previousHoveredElement.hovered = false;
             delete this._previousHoveredElement;
         }
 
-        var element = this._treeElementFromEvent(event);
         if (element && !element.elementCloseTag) {
             element.hovered = true;
             this._previousHoveredElement = element;
@@ -276,38 +308,43 @@ WebInspector.ElementsTreeElement.prototype = {
             if (x) {
                 this.updateSelection();
                 this.listItemElement.addStyleClass("hovered");
-            } else
+                if (this._canAddAttributes)
+                    this._pendingToggleNewAttribute = setTimeout(this.toggleNewAttributeButton.bind(this, true), 500);
+            } else {
                 this.listItemElement.removeStyleClass("hovered");
-            if (this._canAddAttributes)
-                this.toggleNewAttributeButton();
+                if (this._pendingToggleNewAttribute) {
+                    clearTimeout(this._pendingToggleNewAttribute);
+                    delete this._pendingToggleNewAttribute;
+                }
+                this.toggleNewAttributeButton(false);
+            }
         }
     },
 
-    toggleNewAttributeButton: function()
+    toggleNewAttributeButton: function(visible)
     {
-        function removeWhenEditing(event)
+        function removeAddAttributeSpan()
         {
             if (this._addAttributeElement && this._addAttributeElement.parentNode)
                 this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
             delete this._addAttributeElement;
+
+            this.updateSelection();
         }
 
-        if (!this._addAttributeElement && this._hovered && !this._editing) {
+        if (!this._addAttributeElement && visible && !this._editing) {
             var span = document.createElement("span");
-            span.className = "add-attribute";
-            span.textContent = "\u2026";
-            span.addEventListener("dblclick", removeWhenEditing.bind(this), false);
+            span.className = "add-attribute webkit-html-attribute-name";
+            span.textContent = " ?=\"\"";
+            span.addEventListener("dblclick", removeAddAttributeSpan.bind(this), false);
             this._addAttributeElement = span;
 
             var tag = this.listItemElement.getElementsByClassName("webkit-html-tag")[0];
             this._insertInLastAttributePosition(tag, span);
-        } else if (!this._hovered && this._addAttributeElement) {
-            if (this._addAttributeElement.parentNode)
-                this._addAttributeElement.parentNode.removeChild(this._addAttributeElement);
-            delete this._addAttributeElement;
-        }
+        } else if (!visible && this._addAttributeElement)
+            removeAddAttributeSpan.call(this);
     },
-    
+
     updateSelection: function()
     {
         var listItemElement = this.listItemElement;
@@ -475,6 +512,14 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this._editing)
             return;
 
+        if (this.isEventWithinDisclosureTriangle(event))
+            return;
+
+        if (this.treeOutline.showInElementsPanelEnabled) {    
+            WebInspector.showElementsPanel();
+            WebInspector.panels.elements.focusedDOMNode = this.representedObject;
+        }
+
         // Prevent selecting the nearest word on double click.
         if (event.detail >= 2)
             event.preventDefault();
@@ -485,14 +530,9 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this._editing)
             return;
 
-        if (this._startEditing(event, treeElement))
+        if (this._startEditingFromEvent(event, treeElement))
             return;
 
-        if (this.treeOutline.panel) {
-            this.treeOutline.rootDOMNode = this.representedObject.parentNode;
-            this.treeOutline.focusedDOMNode = this.representedObject;
-        }
-
         if (this.hasChildren && !this.expanded)
             this.expand();
     },
@@ -508,9 +548,11 @@ WebInspector.ElementsTreeElement.prototype = {
             tag.appendChild(node);
             tag.appendChild(document.createTextNode('>'));
         }
+
+        this.updateSelection();
     },
 
-    _startEditing: function(event, treeElement)
+    _startEditingFromEvent: function(event, treeElement)
     {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
@@ -533,6 +575,30 @@ WebInspector.ElementsTreeElement.prototype = {
         return false;
     },
 
+    _startEditing: function()
+    {
+        if (this.treeOutline.focusedDOMNode !== this.representedObject)
+            return;
+
+        var listItem = this._listItemNode;
+
+        if (this._canAddAttributes) {
+            this.toggleNewAttributeButton(false);
+            var attribute = listItem.getElementsByClassName("webkit-html-attribute")[0];
+            if (attribute)
+                return this._startEditingAttribute(attribute, attribute.getElementsByClassName("webkit-html-attribute-value")[0]);
+
+            return this._addNewAttribute(listItem);
+        }
+
+        if (this.representedObject.nodeType === Node.TEXT_NODE) {
+            var textNode = listItem.getElementsByClassName("webkit-html-text-node")[0];
+            if (textNode)
+                return this._startEditingTextNode(textNode);
+            return;
+        }
+    },
+
     _addNewAttribute: function(listItemElement)
     {
         var attr = document.createElement("span");
@@ -640,7 +706,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 }
             }
 
-            if (!found && moveDirection === "backward")
+            if (!found && moveDirection === "backward" && attributes.length > 0)
                 moveToAttribute = attributes[attributes.length - 1].name;
             else if (!found && moveDirection === "forward" && !/^\s*$/.test(newText))
                 newAttribute = true;
@@ -772,9 +838,9 @@ WebInspector.ElementsTreeElement.prototype = {
                     if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "script") {
                         var newNode = document.createElement("span");
                         newNode.textContent = node.textContent;
-                        
+
                         var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
-                        javascriptSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        javascriptSyntaxHighlighter.syntaxHighlightNode(newNode);
                         
                         info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "style") {
@@ -822,7 +888,30 @@ WebInspector.ElementsTreeElement.prototype = {
                 return true;
         }
         return false;
+    },
+    
+    remove: function()
+    {
+        var parentElement = this.parent;
+        if (!parentElement)
+            return;
+
+        var self = this;
+        function removeNodeCallback(removedNodeId)
+        {
+            // -1 is an error code, which means removing the node from the DOM failed,
+            // so we shouldn't remove it from the tree.
+            if (removedNodeId === -1)
+                return;
+
+            parentElement.removeChild(self);
+        }
+
+        var callId = WebInspector.Callback.wrap(removeNodeCallback);
+        InspectorController.removeNode(callId, this.representedObject.id);
     }
 }
 
 WebInspector.ElementsTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+WebInspector.didRemoveNode = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/EventListenersSidebarPane.js b/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 55b8e55..2938196 100644
--- a/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -71,6 +71,8 @@ WebInspector.EventListenersSidebarPane.prototype = {
                 var eventListener = eventListeners[i];
                 eventListener.node = WebInspector.domAgent.nodeForId(eventListener.nodeId);
                 delete eventListener.nodeId; // no longer needed
+                if (/^function _inspectorCommandLineAPI_logEvent\(/.test(eventListener.listener.toString()))
+                    continue; // ignore event listeners generated by monitorEvent
                 var type = eventListener.type;
                 var section = sectionMap[type];
                 if (!section) {
@@ -201,18 +203,13 @@ WebInspector.EventListenerBar.prototype = {
 
         if (node.nodeType === Node.DOCUMENT_NODE)
             return "document";
-        
+
         return appropriateSelectorForNode(node);
     },
 
     _getFunctionDisplayName: function()
     {
-        // TODO: v8 does not yet provide the raw function, this handles such a case with a placeholder
-        // I didn't make this a UIString because it should be implemented eventually.
-        if (!this.eventListener.listener)
-            return "(listener)";
-
-        // Requires that Function.toString() return at least the function's signature
+        // Requires that Function.toString() return at least the function's signature.
         var match = this.eventListener.listener.toString().match(/function ([^\(]+?)\(/);
         return (match ? match[1] : WebInspector.UIString("(anonymous function)"));
     }
diff --git a/WebCore/inspector/front-end/Images/timelineBarBlue.png b/WebCore/inspector/front-end/Images/timelineBarBlue.png
new file mode 100644
index 0000000..22641b5
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarBlue.png
diff --git a/WebCore/inspector/front-end/Images/timelineBarGray.png b/WebCore/inspector/front-end/Images/timelineBarGray.png
new file mode 100644
index 0000000..f66cf43
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarGray.png
diff --git a/WebCore/inspector/front-end/Images/timelineBarGreen.png b/WebCore/inspector/front-end/Images/timelineBarGreen.png
new file mode 100644
index 0000000..cc59082
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarGreen.png
diff --git a/WebCore/inspector/front-end/Images/timelineBarOrange.png b/WebCore/inspector/front-end/Images/timelineBarOrange.png
new file mode 100644
index 0000000..e5ae6f5
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarOrange.png
diff --git a/WebCore/inspector/front-end/Images/timelineBarPurple.png b/WebCore/inspector/front-end/Images/timelineBarPurple.png
new file mode 100644
index 0000000..f891252
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarPurple.png
diff --git a/WebCore/inspector/front-end/Images/timelineBarRed.png b/WebCore/inspector/front-end/Images/timelineBarRed.png
new file mode 100644
index 0000000..b850037
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarRed.png
diff --git a/WebCore/inspector/front-end/Images/timelineBarYellow.png b/WebCore/inspector/front-end/Images/timelineBarYellow.png
new file mode 100644
index 0000000..2b3e9a7
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineBarYellow.png
diff --git a/WebCore/inspector/front-end/Images/timelineCheckmarks.png b/WebCore/inspector/front-end/Images/timelineCheckmarks.png
new file mode 100644
index 0000000..9afa9bb
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineCheckmarks.png
diff --git a/WebCore/inspector/front-end/Images/timelineDots.png b/WebCore/inspector/front-end/Images/timelineDots.png
new file mode 100644
index 0000000..e9ba4d3
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineDots.png
diff --git a/WebCore/inspector/front-end/Images/timelineIcon.png b/WebCore/inspector/front-end/Images/timelineIcon.png
new file mode 100644
index 0000000..09bcf30
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/timelineIcon.png
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 75c8ced..3bed8da 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -517,14 +517,30 @@ InjectedScript.getCompletions = function(expression, includeInspectorCommandLine
             var callFrame = InjectedScript._callFrameForId(callFrameId);
             if (!callFrame)
                 return props;
-            expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+            if (expression)
+                expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+            else {
+                // Evaluate into properties in scope of the selected call frame.
+                var scopeChain = callFrame.scopeChain;
+                for (var i = 0; i < scopeChain.length; ++i) {
+                    var scopeObject = scopeChain[i];
+                    try {
+                        for (var propertyName in scopeObject)
+                            props[propertyName] = true;
+                    } catch (e) {
+                    }
+                }
+            }
         } else {
+            if (!expression)
+                expression = "this";
             expressionResult = InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
         }
-        for (var prop in expressionResult)
-            props[prop] = true;
+        if (expressionResult)
+            for (var prop in expressionResult)
+                props[prop] = true;
         if (includeInspectorCommandLineAPI)
-            for (var prop in InjectedScript._window()._inspectorCommandLineAPI)
+            for (var prop in InjectedScript._window().console._inspectorCommandLineAPI)
                 if (prop.charAt(0) !== '_')
                     props[prop] = true;
     } catch(e) {
@@ -559,7 +575,7 @@ InjectedScript._evaluateOn = function(evalFunction, object, expression)
     InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
     // Surround the expression in with statements to inject our command line API so that
     // the window object properties still take more precedent than our API functions.
-    expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    expression = "with (window.console._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
     var value = evalFunction.call(object, expression);
 
     // When evaluating on call frame error is not thrown, but returned as a value.
@@ -576,7 +592,7 @@ InjectedScript.addInspectedNode = function(nodeId)
         return false;
 
     InjectedScript._ensureCommandLineAPIInstalled(InjectedScript._window().eval, InjectedScript._window());
-    var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
+    var inspectedNodes = InjectedScript._window().console._inspectorCommandLineAPI._inspectedNodes;
     inspectedNodes.unshift(node);
     if (inspectedNodes.length >= 5)
         inspectedNodes.pop();
@@ -885,9 +901,9 @@ InjectedScript._inspectObject = function(o)
 
 InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
 {
-    if (evalFunction.call(evalObject, "window._inspectorCommandLineAPI"))
+    if (evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI"))
         return;
-    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window._inspectorCommandLineAPI = { \
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window.console._inspectorCommandLineAPI = { \
         $: function() { return document.getElementById.apply(document, arguments) }, \
         $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
         $x: function(xpath, context) { \
@@ -906,12 +922,50 @@ InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObjec
         values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
         profile: function() { return console.profile.apply(console, arguments) }, \
         profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
+        _logEvent: function _inspectorCommandLineAPI_logEvent(e) { console.log(e.type, e); }, \
+        _allEventTypes: [\"mouse\", \"key\", \"load\", \"unload\", \"abort\", \"error\", \
+            \"select\", \"change\", \"submit\", \"reset\", \"focus\", \"blur\", \
+            \"resize\", \"scroll\"], \
+        _normalizeEventTypes: function(t) { \
+            if (typeof t === \"undefined\") \
+                t = _inspectorCommandLineAPI._allEventTypes; \
+            else if (typeof t === \"string\") \
+                t = [t]; \
+            var i, te = []; \
+            for (i = 0; i < t.length; i++) { \
+                if (t[i] === \"mouse\") \
+                    te.splice(0, 0, \"mousedown\", \"mouseup\", \"click\", \"dblclick\", \
+                        \"mousemove\", \"mouseover\", \"mouseout\"); \
+                else if (t[i] === \"key\") \
+                    te.splice(0, 0, \"keydown\", \"keyup\", \"keypress\"); \
+                else \
+                    te.push(t[i]); \
+            } \
+            return te; \
+        }, \
+        monitorEvent: function(o, t) { \
+            if (!o || !o.addEventListener || !o.removeEventListener) \
+                return; \
+            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
+            for (i = 0; i < t.length; i++) { \
+                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
+                o.addEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
+            } \
+        }, \
+        unmonitorEvent: function(o, t) { \
+            if (!o || !o.removeEventListener) \
+                return; \
+            t = _inspectorCommandLineAPI._normalizeEventTypes(t); \
+            for (i = 0; i < t.length; i++) { \
+                o.removeEventListener(t[i], _inspectorCommandLineAPI._logEvent, false); \
+            } \
+        }, \
         _inspectedNodes: [], \
-        get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
-        get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
-        get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
-        get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
-        get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
+        get $0() { return console._inspectorCommandLineAPI._inspectedNodes[0] }, \
+        get $1() { return console._inspectorCommandLineAPI._inspectedNodes[1] }, \
+        get $2() { return console._inspectorCommandLineAPI._inspectedNodes[2] }, \
+        get $3() { return console._inspectorCommandLineAPI._inspectedNodes[3] }, \
+        get $4() { return console._inspectorCommandLineAPI._inspectedNodes[4] } \
     };");
 
     inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
@@ -1032,12 +1086,6 @@ InjectedScript.CallFrameProxy.prototype = {
                 scopeObjectProxy.isDocument = true;
             else if (!foundLocalScope)
                 scopeObjectProxy.isWithBlock = true;
-            scopeObjectProxy.properties = [];
-            try {
-                for (var propertyName in scopeObject)
-                    scopeObjectProxy.properties.push(propertyName);
-            } catch (e) {
-            }
             scopeChainProxy.push(scopeObjectProxy);
         }
         return scopeChainProxy;
@@ -1110,6 +1158,8 @@ Object.type = function(obj)
         return "regexp";
     if (obj instanceof win.NodeList)
         return "array";
+    if (obj instanceof win.HTMLCollection || obj instanceof win.HTMLAllCollection)
+        return "array";
     if (obj instanceof win.Error)
         return "error";
     return type;
@@ -1132,9 +1182,8 @@ Object.describe = function(obj, abbreviated)
     switch (type1) {
     case "object":
     case "node":
-        return type2;
     case "array":
-        return "[" + obj.toString() + "]";
+        return type2;
     case "string":
         if (!abbreviated)
             return obj;
diff --git a/WebCore/inspector/front-end/InspectorControllerStub.js b/WebCore/inspector/front-end/InspectorControllerStub.js
new file mode 100644
index 0000000..6fb5a1b
--- /dev/null
+++ b/WebCore/inspector/front-end/InspectorControllerStub.js
@@ -0,0 +1,291 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+if (!window.InspectorController) {
+
+WebInspector.InspectorControllerStub = function()
+{
+    this._searchingForNode = false;
+    this._windowVisible = true;
+    this._attachedWindowHeight = 0;
+    this._debuggerEnabled = true;
+    this._profilerEnabled = true;
+    this._resourceTrackingEnabled = false;
+    this._timelineEnabled = false;
+    this._settings = {};
+}
+
+WebInspector.InspectorControllerStub.prototype = {
+    wrapCallback: function(func)
+    {
+        return func;
+    },
+
+    isWindowVisible: function()
+    {
+        return this._windowVisible;
+    },
+
+    platform: function()
+    {
+        return "mac-leopard";
+    },
+
+
+    closeWindow: function()
+    {
+        this._windowVisible = false;
+    },
+
+    attach: function()
+    {
+    },
+
+    detach: function()
+    {
+    },
+
+    storeLastActivePanel: function(panel)
+    {
+    },
+
+    clearMessages: function()
+    {
+    },
+
+    searchingForNode: function()
+    {
+        return this._searchingForNode;
+    },
+
+    search: function(sourceRow, query)
+    {
+    },
+
+    toggleNodeSearch: function()
+    {
+        this._searchingForNode = !this._searchingForNode;
+    },
+
+    setAttachedWindowHeight: function(height)
+    {
+    },
+
+    moveByUnrestricted: function(x, y)
+    {
+    },
+
+
+    addResourceSourceToFrame: function(identifier, element)
+    {
+    },
+
+    addSourceToFrame: function(mimeType, source, element)
+    {
+        return false;
+    },
+
+    getResourceDocumentNode: function(identifier)
+    {
+        return undefined;
+    },
+
+    highlightDOMNode: function(node)
+    {
+    },
+
+    hideDOMNodeHighlight: function()
+    {
+    },
+
+    inspectedWindow: function()
+    {
+        return window;
+    },
+
+    loaded: function()
+    {
+    },
+
+    localizedStringsURL: function()
+    {
+        return undefined;
+    },
+
+    windowUnloading: function()
+    {
+        return false;
+    },
+
+    hiddenPanels: function()
+    {
+        return "";
+    },
+
+    debuggerEnabled: function()
+    {
+        return this._debuggerEnabled;
+    },
+
+    enableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = true;
+        WebInspector.resourceTrackingWasEnabled();
+    },
+
+    disableResourceTracking: function()
+    {
+        this._resourceTrackingEnabled = false;
+        WebInspector.resourceTrackingWasDisabled();
+    },
+
+    resourceTrackingEnabled: function()
+    {
+        return this._resourceTrackingEnabled;
+    },
+
+    enableDebugger: function()
+    {
+        this._debuggerEnabled = true;
+    },
+
+    disableDebugger: function()
+    {
+        this._debuggerEnabled = false;
+    },
+
+    addBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    removeBreakpoint: function(sourceID, line)
+    {
+    },
+
+    updateBreakpoint: function(sourceID, line, condition)
+    {
+    },
+
+    pauseInDebugger: function()
+    {
+    },
+
+    pauseOnExceptions: function()
+    {
+        return false;
+    },
+
+    setPauseOnExceptions: function(value)
+    {
+    },
+
+    resumeDebugger: function()
+    {
+    },
+
+    profilerEnabled: function()
+    {
+        return true;
+    },
+
+    enableProfiler: function()
+    {
+        this._profilerEnabled = true;
+    },
+
+    disableProfiler: function()
+    {
+        this._profilerEnabled = false;
+    },
+
+    startProfiling: function()
+    {
+    },
+
+    stopProfiling: function()
+    {
+    },
+
+    getProfileHeaders: function(callId)
+    {
+        WebInspector.didGetProfileHeaders(callId, []);
+    },
+
+    getProfile: function(callId, uid)
+    {
+        if (WebInspector.__fullProfiles && (uid in WebInspector.__fullProfiles))
+        {
+            WebInspector.didGetProfile(callId, WebInspector.__fullProfiles[uid]);
+        }
+    },
+
+    takeHeapSnapshot: function()
+    {
+    },
+
+    databaseTableNames: function(database)
+    {
+        return [];
+    },
+
+    stepIntoStatementInDebugger: function()
+    {
+    },
+
+    stepOutOfFunctionInDebugger: function()
+    {
+    },
+
+    stepOverStatementInDebugger: function()
+    {
+    },
+
+    setSetting: function(setting, value)
+    {
+        this._settings[setting] = value;
+    },
+
+    dispatchOnInjectedScript: function()
+    {
+    },
+
+    releaseWrapperObjectGroup: function()
+    {
+    },
+
+    setting: function(setting)
+    {
+        return this._settings[setting];
+    }
+}
+
+window.InspectorController = new WebInspector.InspectorControllerStub();
+
+}
diff --git a/WebCore/inspector/front-end/Panel.js b/WebCore/inspector/front-end/Panel.js
index 5046f6b..6cd200b 100644
--- a/WebCore/inspector/front-end/Panel.js
+++ b/WebCore/inspector/front-end/Panel.js
@@ -82,6 +82,8 @@ WebInspector.Panel.prototype = {
             this._toolbarItem.addStyleClass("toggled-on");
 
         WebInspector.currentFocusElement = document.getElementById("main-panels");
+
+        this.updateSidebarWidth();
     },
 
     hide: function()
@@ -267,6 +269,103 @@ WebInspector.Panel.prototype = {
             currentView.jumpToLastSearchResult();
         else
             currentView.jumpToPreviousSearchResult();
+    },
+
+    handleKeyEvent: function(event)
+    {
+        this.handleSidebarKeyEvent(event);
+    },
+
+    handleSidebarKeyEvent: function(event)
+    {
+        if (this.hasSidebar && this.sidebarTree)
+            this.sidebarTree.handleKeyEvent(event);
+    },
+
+    createSidebar: function(parentElement, resizerParentElement)
+    {
+        if (this.hasSidebar)
+            return;
+
+        if (!parentElement)
+            parentElement = this.element;
+
+        if (!resizerParentElement)
+            resizerParentElement = parentElement;
+
+        this.hasSidebar = true;
+
+        this.sidebarElement = document.createElement("div");
+        this.sidebarElement.className = "sidebar";
+        parentElement.appendChild(this.sidebarElement);
+
+        this.sidebarResizeElement = document.createElement("div");
+        this.sidebarResizeElement.className = "sidebar-resizer-vertical";
+        this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
+        resizerParentElement.appendChild(this.sidebarResizeElement);
+
+        this.sidebarTreeElement = document.createElement("ol");
+        this.sidebarTreeElement.className = "sidebar-tree";
+        this.sidebarElement.appendChild(this.sidebarTreeElement);
+
+        this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
+    },
+
+    _startSidebarDragging: function(event)
+    {
+        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
+    },
+
+    _sidebarDragging: function(event)
+    {
+        this.updateSidebarWidth(event.pageX);
+
+        event.preventDefault();
+    },
+
+    _endSidebarDragging: function(event)
+    {
+        WebInspector.elementDragEnd(event);
+    },
+
+    updateSidebarWidth: function(width)
+    {
+        if (!this.hasSidebar)
+            return;
+
+        if (this.sidebarElement.offsetWidth <= 0) {
+            // The stylesheet hasn't loaded yet or the window is closed,
+            // so we can't calculate what is need. Return early.
+            return;
+        }
+
+        if (!("_currentSidebarWidth" in this))
+            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
+
+        if (typeof width === "undefined")
+            width = this._currentSidebarWidth;
+
+        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
+
+        this._currentSidebarWidth = width;
+        this.setSidebarWidth(width);
+
+        this.updateMainViewWidth(width);
+
+        var visibleView = this.visibleView;
+        if (visibleView && "resize" in visibleView)
+            visibleView.resize();
+    },
+
+    setSidebarWidth: function(width)
+    {
+        this.sidebarElement.style.width = width + "px";
+        this.sidebarResizeElement.style.left = (width - 3) + "px";
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        // Should be implemented by ancestors.
     }
 }
 
diff --git a/WebCore/inspector/front-end/ProfileDataGridTree.js b/WebCore/inspector/front-end/ProfileDataGridTree.js
index 3fb0e00..9a7c741 100644
--- a/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -126,20 +126,6 @@ WebInspector.ProfileDataGridNode.prototype = {
         this.profileView._dataGridNodeDeselected(this);
     },
 
-    expand: function()
-    {
-        if (!this.parent) {
-            var currentComparator = this.parent.lastComparator;
-
-            if (!currentComparator || (currentComparator === this.lastComparator))
-                return;
-
-            this.sort(currentComparator);
-        }
-
-        WebInspector.DataGridNode.prototype.expand.call(this);
-    },
-
     sort: function(/*Function*/ comparator, /*Boolean*/ force)
     {
         var gridNodeGroups = [[this]];
@@ -153,7 +139,7 @@ WebInspector.ProfileDataGridNode.prototype = {
 
                 // If the grid node is collapsed, then don't sort children (save operation for later).
                 // If the grid node has the same sorting as previously, then there is no point in sorting it again.
-                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator) {
+                if (!force && (!gridNode.expanded || gridNode.lastComparator === comparator)) {
                     if (gridNode.children.length)
                         gridNode.shouldRefreshChildren = true;
                     continue;
@@ -224,6 +210,26 @@ WebInspector.ProfileDataGridNode.prototype = {
         return this.totalTime / this.tree.totalTime * 100.0;
     },
 
+    get _parent()
+    {
+        return this.parent !== this.dataGrid ? this.parent : this.tree;
+    },
+
+    _populate: function(event)
+    {
+        this._sharedPopulate();
+
+        if (this._parent) {
+            var currentComparator = this._parent.lastComparator;
+
+            if (currentComparator)
+                this.sort(currentComparator, true);
+        }
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+    },
+
     // When focusing and collapsing we modify lots of nodes in the tree.
     // This allows us to restore them all to their original state when we revert.
     _save: function()
diff --git a/WebCore/inspector/front-end/ProfileView.js b/WebCore/inspector/front-end/ProfileView.js
index 2b8c6ce..afced41 100644
--- a/WebCore/inspector/front-end/ProfileView.js
+++ b/WebCore/inspector/front-end/ProfileView.js
@@ -23,7 +23,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ProfileView = function(profile)
+// FIXME: Rename the file.
+
+WebInspector.CPUProfileView = function(profile)
 {
     WebInspector.View.call(this);
 
@@ -78,15 +80,25 @@ WebInspector.ProfileView = function(profile)
 
     this.profile = profile;
 
-    this.profileDataGridTree = this.bottomUpProfileDataGridTree;
-    this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
-
-    this.refresh();
+    var self = this;
+    function profileCallback(profile)
+    {
+        self.profile.representedObject = profile;
+        self._assignParentsInProfile();
+      
+        self.profileDataGridTree = self.bottomUpProfileDataGridTree;
+        self.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
+     
+        self.refresh();
+     
+        self._updatePercentButton();
+    }
 
-    this._updatePercentButton();
+    var callId = WebInspector.Callback.wrap(profileCallback);
+    InspectorController.getProfile(callId, this.profile.uid);
 }
 
-WebInspector.ProfileView.prototype = {
+WebInspector.CPUProfileView.prototype = {
     get statusBarItems()
     {
         return [this.viewSelectElement, this.percentButton.element, this.focusButton.element, this.excludeButton.element, this.resetButton.element];
@@ -158,7 +170,7 @@ WebInspector.ProfileView.prototype = {
         WebInspector.View.prototype.hide.call(this);
         this._currentSearchResultIndex = -1;
     },
-    
+
     resize: function()
     {
         if (this.dataGrid)
@@ -493,7 +505,7 @@ WebInspector.ProfileView.prototype = {
 
     _sortData: function(event)
     {
-        this._sortProfile(this.profile);
+        this._sortProfile(this.profile.representedObject);
     },
 
     _sortProfile: function()
@@ -533,7 +545,97 @@ WebInspector.ProfileView.prototype = {
 
         event.preventDefault();
         event.stopPropagation();
+    },
+
+    _assignParentsInProfile: function()
+    {
+        var head = this.profile.head;
+        head.parent = null;
+        head.head = null;
+        var nodesToTraverse = [ { parent: head, children: head.children } ];
+        while (nodesToTraverse.length > 0) {
+            var pair = nodesToTraverse.shift();
+            var parent = pair.parent;
+            var children = pair.children;
+            var length = children.length;
+            for (var i = 0; i < length; ++i) {
+                children[i].head = head;
+                children[i].parent = parent;
+                if (children[i].children.length > 0)
+                    nodesToTraverse.push({ parent: children[i], children: children[i].children });
+            }
+        }
+    }
+}
+
+WebInspector.CPUProfileView.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.CPUProfileType = function()
+{
+    WebInspector.ProfileType.call(this, WebInspector.CPUProfileType.TypeId, WebInspector.UIString("CPU PROFILES"));
+    this._recording = false;
+}
+
+WebInspector.CPUProfileType.TypeId = "CPU";
+
+WebInspector.CPUProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return this._recording ? WebInspector.UIString("Stop profiling.") : WebInspector.UIString("Start profiling.");
+    },
+
+    get buttonStyle()
+    {
+        return this._recording ? "record-profile-status-bar-item status-bar-item toggled-on" : "record-profile-status-bar-item status-bar-item";
+    },
+
+    buttonClicked: function()
+    {
+        this._recording = !this._recording;
+
+        if (this._recording)
+            InspectorController.startProfiling();
+        else
+            InspectorController.stopProfiling();
+    },
+
+    setRecordingProfile: function(isProfiling)
+    {
+        this._recording = isProfiling;
+    },
+
+    createSidebarTreeElementForProfile: function(profile)
+    {
+        return new WebInspector.ProfileSidebarTreeElement(profile);
+    },
+
+    createView: function(profile)
+    {
+        return new WebInspector.CPUProfileView(profile);
     }
 }
 
-WebInspector.ProfileView.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.CPUProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
+
+WebInspector.CPUProfile = function(profile)
+{
+    this.representedObject = profile;
+    this.typeId = WebInspector.CPUProfileType.TypeId;
+}
+
+WebInspector.CPUProfile.prototype = {
+    get title()
+    {
+        return this.representedObject.title;
+    },
+
+    get uid()
+    {
+        return this.representedObject.uid;
+    },
+
+    get head()
+    {
+        return this.representedObject.head;
+    }
+}
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index 3bd4464..74c2bb6 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -25,11 +25,73 @@
 
 const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
 
+WebInspector.ProfileType = function(id, name)
+{
+    this._id = id;
+    this._name = name;
+}
+
+WebInspector.ProfileType.URLRegExp = /webkit-profile:\/\/(.+)\/(.+)#([0-9]+)/;
+
+WebInspector.ProfileType.prototype = {
+    get buttonTooltip()
+    {
+        return "";
+    },
+
+    get buttonStyle()
+    {
+        return undefined;
+    },
+
+    get buttonCaption()
+    {
+        return this.name;
+    },
+
+    get id()
+    {
+        return this._id;
+    },
+
+    get name()
+    {
+        return this._name;
+    },
+
+    buttonClicked: function()
+    {
+    },
+
+    viewForProfile: function(profile)
+    {
+        if (!profile._profileView)
+            profile._profileView = this.createView(profile);
+        return profile._profileView;
+    },
+
+    // Must be implemented by subclasses.
+    createView: function(profile)
+    {
+        throw new Error("Needs implemented.");
+    },
+
+    // Must be implemented by subclasses.
+    createSidebarTreeElementForProfile: function(profile)
+    {
+        throw new Error("Needs implemented.");
+    }
+}
+
 WebInspector.ProfilesPanel = function()
 {
     WebInspector.Panel.call(this);
 
+    this.createSidebar();
+
     this.element.addStyleClass("profiles");
+    this._profileTypesByIdMap = {};
+    this._profileTypeButtonsByIdMap = {};
 
     var panelEnablerHeading = WebInspector.UIString("You need to enable profiling before you can use the Profiles panel.");
     var panelEnablerDisclaimer = WebInspector.UIString("Enabling profiling will make scripts run slower.");
@@ -39,32 +101,6 @@ WebInspector.ProfilesPanel = function()
 
     this.element.appendChild(this.panelEnablerView.element);
 
-    this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "profiles-sidebar";
-    this.sidebarElement.className = "sidebar";
-    this.element.appendChild(this.sidebarElement);
-
-    this.sidebarResizeElement = document.createElement("div");
-    this.sidebarResizeElement.className = "sidebar-resizer-vertical";
-    this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
-    this.element.appendChild(this.sidebarResizeElement);
-
-    this.sidebarTreeElement = document.createElement("ol");
-    this.sidebarTreeElement.className = "sidebar-tree";
-    this.sidebarElement.appendChild(this.sidebarTreeElement);
-
-    this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
-
-    this.profilesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("CPU PROFILES"), null, true);
-    this.sidebarTree.appendChild(this.profilesListTreeElement);
-    this.profilesListTreeElement.expand();
-
-    this.snapshotsListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("HEAP SNAPSHOTS"), null, true);
-    if (Preferences.heapProfilerPresent) {
-        this.sidebarTree.appendChild(this.snapshotsListTreeElement);
-        this.snapshotsListTreeElement.expand();
-    }
-
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
@@ -72,18 +108,10 @@ WebInspector.ProfilesPanel = function()
     this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.recordButton = new WebInspector.StatusBarButton(WebInspector.UIString("Start profiling."), "record-profile-status-bar-item");
-    this.recordButton.addEventListener("click", this._recordClicked.bind(this), false);
-
-    this.recording = false;
-
-    this.snapshotButton = new WebInspector.StatusBarButton(WebInspector.UIString("Take heap snapshot."), "heap-snapshot-status-bar-item");
-    this.snapshotButton.visible = Preferences.heapProfilerPresent;
-    this.snapshotButton.addEventListener("click", this._snapshotClicked.bind(this), false);
-
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
+    this._profiles = [];
     this.reset();
 }
 
@@ -97,13 +125,30 @@ WebInspector.ProfilesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton.element, this.recordButton.element, this.snapshotButton.element, this.profileViewStatusBarItemsContainer];
+        function clickHandler(profileType, buttonElement)
+        {
+            profileType.buttonClicked.call(profileType);
+            this.updateProfileTypeButtons();
+        }
+
+        var items = [this.enableToggleButton.element];
+        // FIXME: Generate a single "combo-button".
+        for (var typeId in this._profileTypesByIdMap) {
+            var profileType = this.getProfileType(typeId);
+            if (profileType.buttonStyle) {
+                var button = new WebInspector.StatusBarButton(profileType.buttonTooltip, profileType.buttonStyle, profileType.buttonCaption);
+                this._profileTypeButtonsByIdMap[typeId] = button.element;
+                button.element.addEventListener("click", clickHandler.bind(this, profileType, button.element), false);
+                items.push(button.element);
+            }
+        }
+        items.push(this.profileViewStatusBarItemsContainer);
+        return items;
     },
 
     show: function()
     {
         WebInspector.Panel.prototype.show.call(this);
-        this._updateSidebarWidth();
         if (this._shouldPopulateProfiles)
             this._populateProfiles();
     },
@@ -129,13 +174,8 @@ WebInspector.ProfilesPanel.prototype = {
 
     reset: function()
     {
-        if (this._profiles) {
-            var profiledLength = this._profiles.length;
-            for (var i = 0; i < profiledLength; ++i) {
-                var profile = this._profiles[i];
-                delete profile._profileView;
-            }
-        }
+        for (var i = 0; i < this._profiles.length; ++i)
+            delete this._profiles[i]._profileView;
 
         delete this.currentQuery;
         this.searchCanceled();
@@ -147,8 +187,9 @@ WebInspector.ProfilesPanel.prototype = {
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
 
-        this.profilesListTreeElement.removeChildren();
-        this.snapshotsListTreeElement.removeChildren();
+        for (var typeId in this._profileTypesByIdMap)
+            this.getProfileType(typeId).treeElement.removeChildren();
+
         this.profileViews.removeChildren();
 
         this.profileViewStatusBarItemsContainer.removeChildren();
@@ -156,25 +197,36 @@ WebInspector.ProfilesPanel.prototype = {
         this._updateInterface();
     },
 
-    handleKeyEvent: function(event)
+    registerProfileType: function(profileType)
     {
-        this.sidebarTree.handleKeyEvent(event);
+        this._profileTypesByIdMap[profileType.id] = profileType;
+        profileType.treeElement = new WebInspector.SidebarSectionTreeElement(profileType.name, null, true);
+        this.sidebarTree.appendChild(profileType.treeElement);
+        profileType.treeElement.expand();
     },
 
-    addProfile: function(profile)
+    _makeKey: function(text, profileTypeId)
     {
-        this._profiles.push(profile);
-        this._profilesIdMap[profile.uid] = profile;
+        return escape(text) + '/' + escape(profileTypeId);
+    },
 
-        var sidebarParent = this.profilesListTreeElement;
+    addProfileHeader: function(typeId, profile)
+    {
+        var profileType = this.getProfileType(typeId);
+        var sidebarParent = profileType.treeElement;
         var small = false;
         var alternateTitle;
 
+        profile.__profilesPanelProfileType = profileType;
+        this._profiles.push(profile);
+        this._profilesIdMap[this._makeKey(profile.uid, typeId)] = profile;
+
         if (profile.title.indexOf(UserInitiatedProfileName) !== 0) {
-            if (!(profile.title in this._profileGroups))
-                this._profileGroups[profile.title] = [];
+            var profileTitleKey = this._makeKey(profile.title, typeId);
+            if (!(profileTitleKey in this._profileGroups))
+                this._profileGroups[profileTitleKey] = [];
 
-            var group = this._profileGroups[profile.title];
+            var group = this._profileGroups[profileTitleKey];
             group.push(profile);
 
             if (group.length === 2) {
@@ -182,12 +234,12 @@ WebInspector.ProfilesPanel.prototype = {
                 group._profilesTreeElement = new WebInspector.ProfileGroupSidebarTreeElement(profile.title);
 
                 // Insert at the same index for the first profile of the group.
-                var index = this.sidebarTree.children.indexOf(group[0]._profilesTreeElement);
-                this.sidebarTree.insertChild(group._profilesTreeElement, index);
+                var index = sidebarParent.children.indexOf(group[0]._profilesTreeElement);
+                sidebarParent.insertChild(group._profilesTreeElement, index);
 
                 // Move the first profile to the group.
                 var selected = group[0]._profilesTreeElement.selected;
-                this.sidebarTree.removeChild(group[0]._profilesTreeElement);
+                sidebarParent.removeChild(group[0]._profilesTreeElement);
                 group._profilesTreeElement.appendChild(group[0]._profilesTreeElement);
                 if (selected) {
                     group[0]._profilesTreeElement.select();
@@ -207,13 +259,15 @@ WebInspector.ProfilesPanel.prototype = {
             }
         }
 
-        var profileTreeElement = new WebInspector.ProfileSidebarTreeElement(profile);
+        var profileTreeElement = profileType.createSidebarTreeElementForProfile(profile);
         profileTreeElement.small = small;
         if (alternateTitle)
             profileTreeElement.mainTitle = alternateTitle;
         profile._profilesTreeElement = profileTreeElement;
 
         sidebarParent.appendChild(profileTreeElement);
+        if (!this.visibleView)
+            this.showProfile(profile);
     },
 
     showProfile: function(profile)
@@ -224,7 +278,7 @@ WebInspector.ProfilesPanel.prototype = {
         if (this.visibleView)
             this.visibleView.hide();
 
-        var view = this.profileViewForProfile(profile);
+        var view = profile.__profilesPanelProfileType.viewForProfile(profile);
 
         view.show(this.profileViews);
 
@@ -245,18 +299,28 @@ WebInspector.ProfilesPanel.prototype = {
         this.showProfile(view.profile);
     },
 
-    profileViewForProfile: function(profile)
+    getProfileType: function(typeId)
     {
-        if (!profile)
-            return null;
-        if (!profile._profileView)
-            profile._profileView = new WebInspector.ProfileView(profile);
-        return profile._profileView;
+        return this._profileTypesByIdMap[typeId];
     },
 
-    showProfileById: function(uid)
+    showProfileForURL: function(url)
     {
-        this.showProfile(this._profilesIdMap[uid]);
+        var match = url.match(WebInspector.ProfileType.URLRegExp);
+        if (!match)
+            return;
+        this.showProfile(this._profilesIdMap[this._makeKey(match[3], match[1])]);
+    },
+
+    updateProfileTypeButtons: function()
+    {
+        for (var typeId in this._profileTypeButtonsByIdMap) {
+            var buttonElement = this._profileTypeButtonsByIdMap[typeId];
+            var profileType = this.getProfileType(typeId);
+            buttonElement.className = profileType.buttonStyle;
+            buttonElement.title = profileType.buttonTooltip;
+            // FIXME: Apply profileType.buttonCaption once captions are added to button controls.
+        }
     },
 
     closeVisibleView: function()
@@ -266,16 +330,17 @@ WebInspector.ProfilesPanel.prototype = {
         delete this.visibleView;
     },
 
-    displayTitleForProfileLink: function(title)
+    displayTitleForProfileLink: function(title, typeId)
     {
         title = unescape(title);
         if (title.indexOf(UserInitiatedProfileName) === 0) {
             title = WebInspector.UIString("Profile %d", title.substring(UserInitiatedProfileName.length + 1));
         } else {
-            if (!(title in this._profileGroupsForLinks))
-                this._profileGroupsForLinks[title] = 0;
+            var titleKey = this._makeKey(title, typeId);
+            if (!(titleKey in this._profileGroupsForLinks))
+                this._profileGroupsForLinks[titleKey] = 0;
 
-            groupNumber = ++this._profileGroupsForLinks[title];
+            groupNumber = ++this._profileGroupsForLinks[titleKey];
 
             if (groupNumber > 2)
                 // The title is used in the console message announcing that a profile has started so it gets
@@ -296,7 +361,7 @@ WebInspector.ProfilesPanel.prototype = {
 
         var profilesLength = this._profiles.length;
         for (var i = 0; i < profilesLength; ++i) {
-            var view = this.profileViewForProfile(this._profiles[i]);
+            var view = this._profiles[i].viewForProfile();
             if (!view.performSearch || view === visibleView)
                 continue;
             views.push(view);
@@ -323,19 +388,6 @@ WebInspector.ProfilesPanel.prototype = {
         }
     },
 
-    setRecordingProfile: function(isProfiling)
-    {
-        this.recording = isProfiling;
-
-        if (isProfiling) {
-            this.recordButton.toggled = true;
-            this.recordButton.title = WebInspector.UIString("Stop profiling.");
-        } else {
-            this.recordButton.toggled = false;
-            this.recordButton.title = WebInspector.UIString("Start profiling.");
-        }
-    },
-    
     resize: function()
     {
         var visibleView = this.visibleView;
@@ -345,39 +397,24 @@ WebInspector.ProfilesPanel.prototype = {
 
     _updateInterface: function()
     {
+        // FIXME: Replace ProfileType-specific button visibility changes by a single ProfileType-agnostic "combo-button" visibility change.
         if (InspectorController.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
             this.enableToggleButton.toggled = true;
-            this.recordButton.visible = true;
-            if (Preferences.heapProfilerPresent)
-                this.snapshotButton.visible = true;
+            for (var typeId in this._profileTypeButtonsByIdMap)
+                this._profileTypeButtonsByIdMap[typeId].removeStyleClass("hidden");
             this.profileViewStatusBarItemsContainer.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Profiling disabled. Click to enable.");
             this.enableToggleButton.toggled = false;
-            this.recordButton.visible = false;
-            this.snapshotButton.visible = false;
+            for (var typeId in this._profileTypeButtonsByIdMap)
+                this._profileTypeButtonsByIdMap[typeId].addStyleClass("hidden");
             this.profileViewStatusBarItemsContainer.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
     },
 
-    _recordClicked: function()
-    {
-        this.recording = !this.recording;
-
-        if (this.recording)
-            InspectorController.startProfiling();
-        else
-            InspectorController.stopProfiling();
-    },
-
-    _snapshotClicked: function()
-    {
-        InspectorController.takeHeapSnapshot();
-    },
-
     _enableProfiling: function()
     {
         if (InspectorController.profilerEnabled())
@@ -397,66 +434,27 @@ WebInspector.ProfilesPanel.prototype = {
     {
         // FIXME: This code needs to be adjusted when more profiling types are added.
         // Currently defaults to CPU profiles.
-        var cpuProfiles = this.sidebarTree.children[0];
+        var cpuProfiles = this.getProfileType(WebInspector.CPUProfileType.TypeId).treeElement;
         if (cpuProfiles.children.length)
             return;
 
-        var profiles = InspectorController.profiles();
-        var profilesLength = profiles.length;
-        for (var i = 0; i < profilesLength; ++i) {
-            var profile = profiles[i];
-            this.addProfile(profile);
+        function populateCallback(profileHeaders) {
+            profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
+            var profileHeadersLength = profileHeaders.length;
+            for (var i = 0; i < profileHeadersLength; ++i)
+                WebInspector.addProfileHeader(profileHeaders[i]);
         }
 
-        if (cpuProfiles.children[0])
-            cpuProfiles.children[0].select();
+        var callId = WebInspector.Callback.wrap(populateCallback);
+        InspectorController.getProfileHeaders(callId);
 
         delete this._shouldPopulateProfiles;
     },
 
-    _startSidebarDragging: function(event)
-    {
-        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
-    },
-
-    _sidebarDragging: function(event)
-    {
-        this._updateSidebarWidth(event.pageX);
-
-        event.preventDefault();
-    },
-
-    _endSidebarDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-    },
-
-    _updateSidebarWidth: function(width)
+    updateMainViewWidth: function(width)
     {
-        if (this.sidebarElement.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        if (!("_currentSidebarWidth" in this))
-            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
-
-        if (typeof width === "undefined")
-            width = this._currentSidebarWidth;
-
-        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
-
-        this._currentSidebarWidth = width;
-
-        this.sidebarElement.style.width = width + "px";
         this.profileViews.style.left = width + "px";
         this.profileViewStatusBarItemsContainer.style.left = width + "px";
-        this.sidebarResizeElement.style.left = (width - 3) + "px";
-        
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
     }
 }
 
@@ -535,3 +533,6 @@ WebInspector.ProfileGroupSidebarTreeElement.prototype = {
 }
 
 WebInspector.ProfileGroupSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.didGetProfileHeaders = WebInspector.Callback.processCallback;
+WebInspector.didGetProfile = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/ResourceCategory.js b/WebCore/inspector/front-end/ResourceCategory.js
index fc508d0..6e94265 100644
--- a/WebCore/inspector/front-end/ResourceCategory.js
+++ b/WebCore/inspector/front-end/ResourceCategory.js
@@ -26,18 +26,13 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ResourceCategory = function(title, name)
+WebInspector.ResourceCategory = function(name, title, color)
 {
-    this.name = name;
-    this.title = title;
+    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
     this.resources = [];
 }
 
 WebInspector.ResourceCategory.prototype = {
-    toString: function()
-    {
-        return this.title;
-    },
 
     addResource: function(resource)
     {
@@ -66,3 +61,5 @@ WebInspector.ResourceCategory.prototype = {
         this.resources = [];
     }
 }
+
+WebInspector.ResourceCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
diff --git a/WebCore/inspector/front-end/ResourceView.js b/WebCore/inspector/front-end/ResourceView.js
index 28586f6..2ea7fdb 100644
--- a/WebCore/inspector/front-end/ResourceView.js
+++ b/WebCore/inspector/front-end/ResourceView.js
@@ -178,7 +178,7 @@ WebInspector.ResourceView.prototype = {
 
         var isFormEncoded = false;
         var requestContentType = this._getHeaderValue(this.resource.requestHeaders, "Content-Type");
-        if (requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
+        if (requestContentType && requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
             isFormEncoded = true;
 
         if (isFormEncoded) {
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index b575fc3..940570f 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -29,186 +29,129 @@
 
 WebInspector.ResourcesPanel = function()
 {
-    WebInspector.Panel.call(this);
+    WebInspector.AbstractTimelinePanel.call(this);
 
     this.element.addStyleClass("resources");
 
-    this.filterBarElement = document.createElement("div");
-    this.filterBarElement.id = "resources-filter";
-    this.element.appendChild(this.filterBarElement);
+    this._createPanelEnabler();
 
     this.viewsContainerElement = document.createElement("div");
     this.viewsContainerElement.id = "resource-views";
     this.element.appendChild(this.viewsContainerElement);
 
-    this.containerElement = document.createElement("div");
-    this.containerElement.id = "resources-container";
-    this.containerElement.addEventListener("scroll", this._updateDividersLabelBarPosition.bind(this), false);
-    this.element.appendChild(this.containerElement);
+    this.createInterface();
 
-    this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "resources-sidebar";
-    this.sidebarElement.className = "sidebar";
-    this.containerElement.appendChild(this.sidebarElement);
+    this._createStatusbarButtons();
 
-    this.sidebarResizeElement = document.createElement("div");
-    this.sidebarResizeElement.className = "sidebar-resizer-vertical";
-    this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
-    this.element.appendChild(this.sidebarResizeElement);
-
-    this.containerContentElement = document.createElement("div");
-    this.containerContentElement.id = "resources-container-content";
-    this.containerElement.appendChild(this.containerContentElement);
-
-    this.summaryBar = new WebInspector.SummaryBar(this.categories);
-    this.summaryBar.element.id = "resources-summary";
-    this.containerContentElement.appendChild(this.summaryBar.element);
-
-    this.resourcesGraphsElement = document.createElement("div");
-    this.resourcesGraphsElement.id = "resources-graphs";
-    this.containerContentElement.appendChild(this.resourcesGraphsElement);
-
-    this.dividersElement = document.createElement("div");
-    this.dividersElement.id = "resources-dividers";
-    this.containerContentElement.appendChild(this.dividersElement);
-
-    this.dividersLabelBarElement = document.createElement("div");
-    this.dividersLabelBarElement.id = "resources-dividers-label-bar";
-    this.containerContentElement.appendChild(this.dividersLabelBarElement);
-
-    this.sidebarTreeElement = document.createElement("ol");
-    this.sidebarTreeElement.className = "sidebar-tree";
-    this.sidebarElement.appendChild(this.sidebarTreeElement);
+    this.reset();
+    this.filter(this.filterAllElement, false);
+    this.graphsTreeElement.children[0].select();
+}
 
-    this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
+WebInspector.ResourcesPanel.prototype = {
+    toolbarItemClass: "resources",
 
-    var timeGraphItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Time"));
-    timeGraphItem.onselect = this._graphSelected.bind(this);
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Resources");
+    },
 
-    var transferTimeCalculator = new WebInspector.ResourceTransferTimeCalculator();
-    var transferDurationCalculator = new WebInspector.ResourceTransferDurationCalculator();
+    get statusBarItems()
+    {
+        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
+    },
 
-    timeGraphItem.sortingOptions = [
-        { name: WebInspector.UIString("Sort by Start Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingStartTime, calculator: transferTimeCalculator },
-        { name: WebInspector.UIString("Sort by Response Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingResponseReceivedTime, calculator: transferTimeCalculator },
-        { name: WebInspector.UIString("Sort by End Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingEndTime, calculator: transferTimeCalculator },
-        { name: WebInspector.UIString("Sort by Duration"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingDuration, calculator: transferDurationCalculator },
-        { name: WebInspector.UIString("Sort by Latency"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingLatency, calculator: transferDurationCalculator },
-    ];
+    get categories()
+    {
+        return WebInspector.resourceCategories;
+    },
 
-    timeGraphItem.selectedSortingOptionIndex = 1;
+    createItemTreeElement: function(item)
+    {
+        return new WebInspector.ResourceSidebarTreeElement(item);
+    },
 
-    var sizeGraphItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Size"));
-    sizeGraphItem.onselect = this._graphSelected.bind(this);
+    createItemGraph: function(item)
+    {
+        return new WebInspector.ResourceGraph(item);
+    },
 
-    var transferSizeCalculator = new WebInspector.ResourceTransferSizeCalculator();
-    sizeGraphItem.sortingOptions = [
-        { name: WebInspector.UIString("Sort by Size"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingSize, calculator: transferSizeCalculator },
-    ];
+    isCategoryVisible: function(categoryName)
+    {
+        return (this.itemsGraphsElement.hasStyleClass("filter-all") || this.itemsGraphsElement.hasStyleClass("filter-" + categoryName.toLowerCase()));
+    },
 
-    sizeGraphItem.selectedSortingOptionIndex = 0;
+    populateSidebar: function()
+    {
+        var timeGraphItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Time"));
+        timeGraphItem.onselect = this._graphSelected.bind(this);
 
-    this.graphsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("GRAPHS"), {}, true);
-    this.sidebarTree.appendChild(this.graphsTreeElement);
+        var transferTimeCalculator = new WebInspector.ResourceTransferTimeCalculator();
+        var transferDurationCalculator = new WebInspector.ResourceTransferDurationCalculator();
 
-    this.graphsTreeElement.appendChild(timeGraphItem);
-    this.graphsTreeElement.appendChild(sizeGraphItem);
-    this.graphsTreeElement.expand();
+        timeGraphItem.sortingOptions = [
+            { name: WebInspector.UIString("Sort by Start Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingStartTime, calculator: transferTimeCalculator },
+            { name: WebInspector.UIString("Sort by Response Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingResponseReceivedTime, calculator: transferTimeCalculator },
+            { name: WebInspector.UIString("Sort by End Time"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByAscendingEndTime, calculator: transferTimeCalculator },
+            { name: WebInspector.UIString("Sort by Duration"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingDuration, calculator: transferDurationCalculator },
+            { name: WebInspector.UIString("Sort by Latency"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingLatency, calculator: transferDurationCalculator },
+        ];
 
-    this.resourcesTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RESOURCES"), {}, true);
-    this.sidebarTree.appendChild(this.resourcesTreeElement);
+        timeGraphItem.selectedSortingOptionIndex = 1;
 
-    this.resourcesTreeElement.expand();
+        var sizeGraphItem = new WebInspector.SidebarTreeElement("resources-size-graph-sidebar-item", WebInspector.UIString("Size"));
+        sizeGraphItem.onselect = this._graphSelected.bind(this);
 
-    var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use this panel.");
-    var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
-    var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
+        var transferSizeCalculator = new WebInspector.ResourceTransferSizeCalculator();
+        sizeGraphItem.sortingOptions = [
+            { name: WebInspector.UIString("Sort by Size"), sortingFunction: WebInspector.ResourceSidebarTreeElement.CompareByDescendingSize, calculator: transferSizeCalculator },
+        ];
 
-    this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
-    this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
+        sizeGraphItem.selectedSortingOptionIndex = 0;
 
-    this.element.appendChild(this.panelEnablerView.element);
+        this.graphsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("GRAPHS"), {}, true);
+        this.sidebarTree.appendChild(this.graphsTreeElement);
 
-    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
-    this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
+        this.graphsTreeElement.appendChild(timeGraphItem);
+        this.graphsTreeElement.appendChild(sizeGraphItem);
+        this.graphsTreeElement.expand();
 
-    this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
-    this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
-    this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
-    if (!Preferences.resourcesLargeRows) {
-        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
-        this._toggleLargerResources(); // this will toggle the preference back to the original
-    }
+        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RESOURCES"), {}, true);
+        this.sidebarTree.appendChild(this.itemsTreeElement);
 
-    this.sortingSelectElement = document.createElement("select");
-    this.sortingSelectElement.className = "status-bar-item";
-    this.sortingSelectElement.addEventListener("change", this._changeSortingFunction.bind(this), false);
-
-    var createFilterElement = function (category) {
-        var categoryElement = document.createElement("li");
-        categoryElement.category = category;
-        categoryElement.addStyleClass(category);
-        var label = WebInspector.UIString("All");
-        if (WebInspector.resourceCategories[category])
-            label = WebInspector.resourceCategories[category].title;
-        categoryElement.appendChild(document.createTextNode(label));
-        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
-        this.filterBarElement.appendChild(categoryElement);
-        return categoryElement;
-    };
-
-    var allElement = createFilterElement.call(this, "all");
-    this.filter(allElement.category);
-    for (var category in this.categories)
-        createFilterElement.call(this, category);
+        this.itemsTreeElement.expand();
+    },
 
-    this.reset();
+    _createPanelEnabler: function()
+    {
+        var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use this panel.");
+        var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
+        var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
 
-    timeGraphItem.select();
-}
+        this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
+        this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
 
-WebInspector.ResourcesPanel.prototype = {
-    toolbarItemClass: "resources",
+        this.element.appendChild(this.panelEnablerView.element);
 
-    get categories()
-    {
-        if (!this._categories) {
-            this._categories = {documents: {color: {r: 47, g: 102, b: 236}}, stylesheets: {color: {r: 157, g: 231, b: 119}}, images: {color: {r: 164, g: 60, b: 255}}, scripts: {color: {r: 255, g: 121, b: 0}}, xhr: {color: {r: 231, g: 231, b: 10}}, fonts: {color: {r: 255, g: 82, b: 62}}, other: {color: {r: 186, g: 186, b: 186}}};
-            for (var category in this._categories) {
-                this._categories[category].title = WebInspector.resourceCategories[category].title;
-            }
-        }
-        return this._categories; 
+        this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
+        this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
     },
 
-    filter: function (category) {
-        if (this._filterCategory && this._filterCategory === category)
-            return;
-
-        if (this._filterCategory) {
-            var filterElement = this.filterBarElement.getElementsByClassName(this._filterCategory)[0];
-            filterElement.removeStyleClass("selected");
-            var oldClass = "filter-" + this._filterCategory;
-            this.resourcesTreeElement.childrenListElement.removeStyleClass(oldClass);
-            this.resourcesGraphsElement.removeStyleClass(oldClass);
+    _createStatusbarButtons: function()
+    {
+        this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
+        this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
+        this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
+        if (!Preferences.resourcesLargeRows) {
+            Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+            this._toggleLargerResources(); // this will toggle the preference back to the original
         }
-        this._filterCategory = category;
-        var filterElement = this.filterBarElement.getElementsByClassName(this._filterCategory)[0];
-        filterElement.addStyleClass("selected");
-        var newClass = "filter-" + this._filterCategory;
-        this.resourcesTreeElement.childrenListElement.addStyleClass(newClass);
-        this.resourcesGraphsElement.addStyleClass(newClass);
-    },
 
-    _updateFilter: function (e) {
-        this.filter(e.target.category);
+        this.sortingSelectElement = document.createElement("select");
+        this.sortingSelectElement.className = "status-bar-item";
+        this.sortingSelectElement.addEventListener("change", this._changeSortingFunction.bind(this), false);
     },
 
-    get toolbarItemLabel()
-    {
-        return WebInspector.UIString("Resources");
-    },
-    
     get mainResourceLoadTime()
     {
         return this._mainResourceLoadTime || -1;
@@ -222,7 +165,7 @@ WebInspector.ResourcesPanel.prototype = {
         this._mainResourceLoadTime = x;
         
         // Update the dividers to draw the new line
-        this._updateGraphDividersIfNeeded(true);
+        this.updateGraphDividersIfNeeded(true);
     },
     
     get mainResourceDOMContentTime()
@@ -237,21 +180,12 @@ WebInspector.ResourcesPanel.prototype = {
         
         this._mainResourceDOMContentTime = x;
         
-        this._updateGraphDividersIfNeeded(true);
-    },
-
-    get statusBarItems()
-    {
-        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
+        this.updateGraphDividersIfNeeded(true);
     },
 
     show: function()
     {
-        WebInspector.Panel.prototype.show.call(this);
-
-        this._updateDividersLabelBarPosition();
-        this._updateSidebarWidth();
-        this.refreshIfNeeded();
+        WebInspector.AbstractTimelinePanel.prototype.show.call(this);
 
         var visibleView = this.visibleView;
         if (visibleView) {
@@ -274,7 +208,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     resize: function()
     {
-        this._updateGraphDividersIfNeeded();
+        WebInspector.AbstractTimelinePanel.prototype.resize.call(this);
 
         var visibleView = this.visibleView;
         if (visibleView && "resize" in visibleView)
@@ -292,7 +226,7 @@ WebInspector.ResourcesPanel.prototype = {
         var resourcesLength = this._resources.length;
         for (var i = 0; i < resourcesLength; ++i) {
             var resource = this._resources[i];
-            if (!resource._resourcesTreeElement)
+            if (!resource._itemsTreeElement)
                 continue;
             var resourceView = this.resourceViewForResource(resource);
             if (!resourceView.performSearch || resourceView === visibleView)
@@ -309,7 +243,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         function sortFuction(a, b)
         {
-            return resourceTreeElementSortFunction(a.resource._resourcesTreeElement, b.resource._resourcesTreeElement);
+            return resourceTreeElementSortFunction(a.resource._itemsTreeElement, b.resource._itemsTreeElement);
         }
 
         return sortFuction;
@@ -317,7 +251,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     searchMatchFound: function(view, matches)
     {
-        view.resource._resourcesTreeElement.searchMatches = matches;
+        view.resource._itemsTreeElement.searchMatches = matches;
     },
 
     searchCanceled: function(startingNewSearch)
@@ -329,8 +263,8 @@ WebInspector.ResourcesPanel.prototype = {
 
         for (var i = 0; i < this._resources.length; ++i) {
             var resource = this._resources[i];
-            if (resource._resourcesTreeElement)
-                resource._resourcesTreeElement.updateErrorsAndWarnings();
+            if (resource._itemsTreeElement)
+                resource._itemsTreeElement.updateErrorsAndWarnings();
         }
     },
 
@@ -338,8 +272,8 @@ WebInspector.ResourcesPanel.prototype = {
     {
         for (var i = 0; i < this._resources.length; ++i) {
             var resource = this._resources[i];
-            if (resource._resourcesTreeElement)
-                resource._resourcesTreeElement.resetBubble();
+            if (resource._itemsTreeElement)
+                resource._itemsTreeElement.resetBubble();
         }
 
         WebInspector.Panel.prototype.performSearch.call(this, query);
@@ -352,23 +286,6 @@ WebInspector.ResourcesPanel.prototype = {
         return null;
     },
 
-    get calculator()
-    {
-        return this._calculator;
-    },
-
-    set calculator(x)
-    {
-        if (!x || this._calculator === x)
-            return;
-
-        this._calculator = x;
-        this._calculator.reset();
-
-        this._staleResources = this._resources;
-        this.refresh();
-    },
-
     get sortingFunction()
     {
         return this._sortingFunction;
@@ -380,75 +297,19 @@ WebInspector.ResourcesPanel.prototype = {
         this._sortResourcesIfNeeded();
     },
 
-    get needsRefresh()
-    {
-        return this._needsRefresh;
-    },
-
-    set needsRefresh(x)
-    {
-        if (this._needsRefresh === x)
-            return;
-
-        this._needsRefresh = x;
-
-        if (x) {
-            if (this.visible && !("_refreshTimeout" in this))
-                this._refreshTimeout = setTimeout(this.refresh.bind(this), 500);
-        } else {
-            if ("_refreshTimeout" in this) {
-                clearTimeout(this._refreshTimeout);
-                delete this._refreshTimeout;
-            }
-        }
-    },
-
-    refreshIfNeeded: function()
-    {
-        if (this.needsRefresh)
-            this.refresh();
-    },
-
     refresh: function()
     {
-        this.needsRefresh = false;
-
-        var staleResourcesLength = this._staleResources.length;
-        var boundariesChanged = false;
-
-        for (var i = 0; i < staleResourcesLength; ++i) {
-            var resource = this._staleResources[i];
-            if (!resource._resourcesTreeElement) {
-                // Create the resource tree element and graph.
-                resource._resourcesTreeElement = new WebInspector.ResourceSidebarTreeElement(resource);
-                resource._resourcesTreeElement._resourceGraph = new WebInspector.ResourceGraph(resource);
-
-                this.resourcesTreeElement.appendChild(resource._resourcesTreeElement);
-                this.resourcesGraphsElement.appendChild(resource._resourcesTreeElement._resourceGraph.graphElement);
-            }
-
-            resource._resourcesTreeElement.refresh();
-
-            if (this.calculator.updateBoundaries(resource))
-                boundariesChanged = true;
-        }
+        WebInspector.AbstractTimelinePanel.prototype.refresh.call(this);
 
-        if (boundariesChanged) {
-            // The boundaries changed, so all resource graphs are stale.
-            this._staleResources = this._resources;
-            staleResourcesLength = this._staleResources.length;
-        }
-
-        for (var i = 0; i < staleResourcesLength; ++i)
-            this._staleResources[i]._resourcesTreeElement._resourceGraph.refresh(this.calculator);
-
-        this._staleResources = [];
-
-        this._updateGraphDividersIfNeeded();
         this._sortResourcesIfNeeded();
         this._updateSummaryGraph();
     },
 
+    _updateSummaryGraph: function()
+    {
+        this.summaryBar.update(this._resources);
+    },
+
     resourceTrackingWasEnabled: function()
     {
         this.reset();
@@ -463,14 +324,9 @@ WebInspector.ResourcesPanel.prototype = {
     {
         this.closeVisibleResource();
 
-        this.containerElement.scrollTop = 0;
-
         delete this.currentQuery;
         this.searchCanceled();
 
-        if (this._calculator)
-            this._calculator.reset();
-
         if (this._resources) {
             var resourcesLength = this._resources.length;
             for (var i = 0; i < resourcesLength; ++i) {
@@ -479,23 +335,18 @@ WebInspector.ResourcesPanel.prototype = {
                 resource.warnings = 0;
                 resource.errors = 0;
 
-                delete resource._resourcesTreeElement;
                 delete resource._resourcesView;
             }
         }
 
-        this._resources = [];
-        this._staleResources = [];
+        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
         
         this.mainResourceLoadTime = -1;
         this.mainResourceDOMContentTime = -1;
-
-        this.resourcesTreeElement.removeChildren();
+ 
         this.viewsContainerElement.removeChildren();
-        this.resourcesGraphsElement.removeChildren();
-        this.summaryBar.reset();
 
-        this._updateGraphDividersIfNeeded(true);
+        this.summaryBar.reset();
 
         if (InspectorController.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
@@ -523,20 +374,12 @@ WebInspector.ResourcesPanel.prototype = {
         if (this.visibleView === resource._resourcesView)
             this.closeVisibleResource();
 
-        this._resources.remove(resource, true);
-
-        if (resource._resourcesTreeElement) {
-            this.resourcesTreeElement.removeChild(resource._resourcesTreeElement);
-            this.resourcesGraphsElement.removeChild(resource._resourcesTreeElement._resourceGraph.graphElement);
-        }
+        this.removeItem(resource);
 
         resource.warnings = 0;
         resource.errors = 0;
 
-        delete resource._resourcesTreeElement;
         delete resource._resourcesView;
-
-        this._adjustScrollPosition();
     },
 
     addMessageToResource: function(resource, msg)
@@ -553,8 +396,8 @@ WebInspector.ResourcesPanel.prototype = {
             break;
         }
 
-        if (!this.currentQuery && resource._resourcesTreeElement)
-            resource._resourcesTreeElement.updateErrorsAndWarnings();
+        if (!this.currentQuery && resource._itemsTreeElement)
+            resource._itemsTreeElement.updateErrorsAndWarnings();
 
         var view = this.resourceViewForResource(resource);
         if (view.addMessage)
@@ -569,8 +412,8 @@ WebInspector.ResourcesPanel.prototype = {
             resource.warnings = 0;
             resource.errors = 0;
 
-            if (!this.currentQuery && resource._resourcesTreeElement)
-                resource._resourcesTreeElement.updateErrorsAndWarnings();
+            if (!this.currentQuery && resource._itemsTreeElement)
+                resource._itemsTreeElement.updateErrorsAndWarnings();
 
             var view = resource._resourcesView;
             if (!view || !view.clearMessages)
@@ -581,8 +424,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     refreshResource: function(resource)
     {
-        this._staleResources.push(resource);
-        this.needsRefresh = true;
+        this.refreshItem(resource);
     },
 
     recreateViewForResourceIfNeeded: function(resource)
@@ -597,8 +439,8 @@ WebInspector.ResourcesPanel.prototype = {
         resource.warnings = 0;
         resource.errors = 0;
 
-        if (!this.currentQuery && resource._resourcesTreeElement)
-            resource._resourcesTreeElement.updateErrorsAndWarnings();
+        if (!this.currentQuery && resource._itemsTreeElement)
+            resource._itemsTreeElement.updateErrorsAndWarnings();
 
         var oldView = resource._resourcesView;
 
@@ -634,14 +476,11 @@ WebInspector.ResourcesPanel.prototype = {
                 view.highlightLine(line);
         }
 
-        if (resource._resourcesTreeElement) {
-            resource._resourcesTreeElement.reveal();
-            resource._resourcesTreeElement.select(true);
-        }
+        this.revealAndSelectItem(resource);
 
         this.visibleResource = resource;
 
-        this._updateSidebarWidth();
+        this.updateSidebarWidth();
     },
 
     showView: function(view)
@@ -663,7 +502,7 @@ WebInspector.ResourcesPanel.prototype = {
         if (this._lastSelectedGraphTreeElement)
             this._lastSelectedGraphTreeElement.select(true);
 
-        this._updateSidebarWidth();
+        this.updateSidebarWidth();
     },
 
     resourceViewForResource: function(resource)
@@ -692,113 +531,59 @@ WebInspector.ResourcesPanel.prototype = {
         return view.sourceFrame;
     },
 
-    handleKeyEvent: function(event)
-    {
-        this.sidebarTree.handleKeyEvent(event);
-    },
-
     _sortResourcesIfNeeded: function()
     {
-        var sortedElements = [].concat(this.resourcesTreeElement.children);
-        sortedElements.sort(this.sortingFunction);
-
-        var sortedElementsLength = sortedElements.length;
-        for (var i = 0; i < sortedElementsLength; ++i) {
-            var treeElement = sortedElements[i];
-            if (treeElement === this.resourcesTreeElement.children[i])
-                continue;
-
-            var wasSelected = treeElement.selected;
-            this.resourcesTreeElement.removeChild(treeElement);
-            this.resourcesTreeElement.insertChild(treeElement, i);
-            if (wasSelected)
-                treeElement.select(true);
-
-            var graphElement = treeElement._resourceGraph.graphElement;
-            this.resourcesGraphsElement.insertBefore(graphElement, this.resourcesGraphsElement.children[i]);
-        }
+        this.sortItems(this.sortingFunction);
     },
 
-    _updateGraphDividersIfNeeded: function(force)
+    updateGraphDividersIfNeeded: function(force)
     {
-        if (!this.visible) {
-            this.needsRefresh = true;
-            return;
-        }
-
-        if (document.body.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        var dividerCount = Math.round(this.dividersElement.offsetWidth / 64);
-        var slice = this.calculator.boundarySpan / dividerCount;
-        if (!force && this._currentDividerSlice === slice)
+        var proceed = WebInspector.AbstractTimelinePanel.prototype.updateGraphDividersIfNeeded.call(this, force);
+        
+        if (!proceed)
             return;
 
-        this._currentDividerSlice = slice;
-
-        this.dividersElement.removeChildren();
-        this.dividersLabelBarElement.removeChildren();
-
-        for (var i = 1; i <= dividerCount; ++i) {
-            var divider = document.createElement("div");
-            divider.className = "resources-divider";
-            if (i === dividerCount)
-                divider.addStyleClass("last");
-            divider.style.left = ((i / dividerCount) * 100) + "%";
-
-            this.dividersElement.appendChild(divider.cloneNode());
-
-            var label = document.createElement("div");
-            label.className = "resources-divider-label";
-            if (!isNaN(slice))
-                label.textContent = this.calculator.formatValue(slice * i);
-            divider.appendChild(label);
-
-            this.dividersLabelBarElement.appendChild(divider);
-        }
-
-        if (this.calculator.startAtZero) {
+        if (this.calculator.startAtZero || !this.calculator.computePercentageFromEventTime) {
             // If our current sorting method starts at zero, that means it shows all
             // resources starting at the same point, and so onLoad event and DOMContent
             // event lines really wouldn't make much sense here, so don't render them.
+            // Additionally, if the calculator doesn't have the computePercentageFromEventTime
+            // function defined, we are probably sorting by size, and event times aren't relevant
+            // in this case.
             return;
         }
 
         if (this.mainResourceLoadTime !== -1) {
             var percent = this.calculator.computePercentageFromEventTime(this.mainResourceLoadTime);
+
             var loadDivider = document.createElement("div");
             loadDivider.className = "resources-onload-divider";
-            loadDivider.style.left = percent + "%";
-            loadDivider.title = WebInspector.UIString("Load event fired");
-            this.dividersElement.appendChild(loadDivider);
+
+            var loadDividerPadding = document.createElement("div");
+            loadDividerPadding.className = "resources-event-divider-padding";
+            loadDividerPadding.style.left = percent + "%";
+            loadDividerPadding.title = WebInspector.UIString("Load event fired");
+            loadDividerPadding.appendChild(loadDivider);
+            
+            this.eventDividersElement.appendChild(loadDividerPadding);
         }
         
         if (this.mainResourceDOMContentTime !== -1) {
             var percent = this.calculator.computePercentageFromEventTime(this.mainResourceDOMContentTime);
+
             var domContentDivider = document.createElement("div");
             domContentDivider.className = "resources-ondomcontent-divider";
-            domContentDivider.title = WebInspector.UIString("DOMContent event fired");
-            domContentDivider.style.left = percent + "%";
-            this.dividersElement.appendChild(domContentDivider);
+            
+            var domContentDividerPadding = document.createElement("div");
+            domContentDividerPadding.className = "resources-event-divider-padding";
+            domContentDividerPadding.style.left = percent + "%";
+            domContentDividerPadding.title = WebInspector.UIString("DOMContent event fired");
+            domContentDividerPadding.appendChild(domContentDivider);
+            
+            this.eventDividersElement.appendChild(domContentDividerPadding);
         }
     },
 
-    _updateSummaryGraph: function()
-    {
-        this.summaryBar.update(this._resources);
-    },
-
-    _updateDividersLabelBarPosition: function()
-    {
-        var scrollTop = this.containerElement.scrollTop;
-        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
-        this.dividersElement.style.top = scrollTop + "px";
-        this.dividersLabelBarElement.style.top = dividersTop + "px";
-    },
-
     _graphSelected: function(treeElement)
     {
         if (this._lastSelectedGraphTreeElement)
@@ -825,32 +610,25 @@ WebInspector.ResourcesPanel.prototype = {
 
     _toggleLargerResources: function()
     {
-        if (!this.resourcesTreeElement._childrenListNode)
+        if (!this.itemsTreeElement._childrenListNode)
             return;
 
-        this.resourcesTreeElement.smallChildren = !this.resourcesTreeElement.smallChildren;
+        this.itemsTreeElement.smallChildren = !this.itemsTreeElement.smallChildren;
         Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
         InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
-        if (this.resourcesTreeElement.smallChildren) {
-            this.resourcesGraphsElement.addStyleClass("small");
+        if (this.itemsTreeElement.smallChildren) {
+            this.itemsGraphsElement.addStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
             this.largerResourcesButton.toggled = false;
-            this._adjustScrollPosition();
+            this.adjustScrollPosition();
         } else {
-            this.resourcesGraphsElement.removeStyleClass("small");
+            this.itemsGraphsElement.removeStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
             this.largerResourcesButton.toggled = true;
         }
     },
 
-    _adjustScrollPosition: function()
-    {
-        // Prevent the container from being scrolled off the end.
-        if ((this.containerElement.scrollTop + this.containerElement.offsetHeight) > this.sidebarElement.offsetHeight)
-            this.containerElement.scrollTop = (this.sidebarElement.offsetHeight - this.containerElement.offsetHeight);
-    },
-
     _changeSortingFunction: function()
     {
         var selectedOption = this.sortingSelectElement[this.sortingSelectElement.selectedIndex];
@@ -875,41 +653,8 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    _startSidebarDragging: function(event)
-    {
-        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
-    },
-
-    _sidebarDragging: function(event)
+    setSidebarWidth: function(width)
     {
-        this._updateSidebarWidth(event.pageX);
-
-        event.preventDefault();
-    },
-
-    _endSidebarDragging: function(event)
-    {
-        WebInspector.elementDragEnd(event);
-    },
-
-    _updateSidebarWidth: function(width)
-    {
-        if (this.sidebarElement.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        if (!("_currentSidebarWidth" in this))
-            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
-
-        if (typeof width === "undefined")
-            width = this._currentSidebarWidth;
-
-        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
-
-        this._currentSidebarWidth = width;
-
         if (this.visibleResource) {
             this.containerElement.style.width = width + "px";
             this.sidebarElement.style.removeProperty("width");
@@ -918,15 +663,13 @@ WebInspector.ResourcesPanel.prototype = {
             this.containerElement.style.removeProperty("width");
         }
 
-        this.containerContentElement.style.left = width + "px";
-        this.viewsContainerElement.style.left = width + "px";
         this.sidebarResizeElement.style.left = (width - 3) + "px";
+    },
 
-        this._updateGraphDividersIfNeeded();
-
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
+    updateMainViewWidth: function(width)
+    {
+        WebInspector.AbstractTimelinePanel.prototype.updateMainViewWidth.call(this, width);
+        this.viewsContainerElement.style.left = width + "px";
     },
 
     _enableResourceTracking: function()
@@ -947,88 +690,19 @@ WebInspector.ResourcesPanel.prototype = {
             this.sortingSelectElement.visible = true;
             InspectorController.enableResourceTracking(!!optionalAlways);
         }
-    }
-}
-
-WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
-
-WebInspector.ResourceCalculator = function()
-{
-}
-
-WebInspector.ResourceCalculator.prototype = {
-    computeSummaryValues: function(resources)
-    {
-        var total = 0;
-        var categoryValues = {};
-
-        var resourcesLength = resources.length;
-        for (var i = 0; i < resourcesLength; ++i) {
-            var resource = resources[i];
-            var value = this._value(resource);
-            if (typeof value === "undefined")
-                continue;
-            if (!(resource.category.name in categoryValues))
-                categoryValues[resource.category.name] = 0;
-            categoryValues[resource.category.name] += value;
-            total += value;
-        }
-
-        return {categoryValues: categoryValues, total: total};
-    },
-
-    computeBarGraphPercentages: function(resource)
-    {
-        return {start: 0, middle: 0, end: (this._value(resource) / this.boundarySpan) * 100};
-    },
-
-    computeBarGraphLabels: function(resource)
-    {
-        const label = this.formatValue(this._value(resource));
-        var tooltip = label;
-        if (resource.cached)
-            tooltip = WebInspector.UIString("%s (from cache)", tooltip);
-        return {left: label, right: label, tooltip: tooltip};
-    },
-
-    get boundarySpan()
-    {
-        return this.maximumBoundary - this.minimumBoundary;
-    },
-
-    updateBoundaries: function(resource)
-    {
-        this.minimumBoundary = 0;
-
-        var value = this._value(resource);
-        if (typeof this.maximumBoundary === "undefined" || value > this.maximumBoundary) {
-            this.maximumBoundary = value;
-            return true;
-        }
-
-        return false;
     },
 
-    reset: function()
+    get _resources()
     {
-        delete this.minimumBoundary;
-        delete this.maximumBoundary;
-    },
-
-    _value: function(resource)
-    {
-        return 0;
-    },
-
-    formatValue: function(value)
-    {
-        return value.toString();
+        return this._items;
     }
 }
 
+WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+
 WebInspector.ResourceTimeCalculator = function(startAtZero)
 {
-    WebInspector.ResourceCalculator.call(this);
+    WebInspector.AbstractTimelineCalculator.call(this);
     this.startAtZero = startAtZero;
 }
 
@@ -1186,10 +860,10 @@ WebInspector.ResourceTimeCalculator.prototype = {
     _upperBound: function(resource)
     {
         return 0;
-    },
+    }
 }
 
-WebInspector.ResourceTimeCalculator.prototype.__proto__ = WebInspector.ResourceCalculator.prototype;
+WebInspector.ResourceTimeCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
 
 WebInspector.ResourceTransferTimeCalculator = function()
 {
@@ -1236,10 +910,19 @@ WebInspector.ResourceTransferDurationCalculator.prototype.__proto__ = WebInspect
 
 WebInspector.ResourceTransferSizeCalculator = function()
 {
-    WebInspector.ResourceCalculator.call(this);
+    WebInspector.AbstractTimelineCalculator.call(this);
 }
 
 WebInspector.ResourceTransferSizeCalculator.prototype = {
+    computeBarGraphLabels: function(resource)
+    {
+        const label = this.formatValue(this._value(resource));
+        var tooltip = label;
+        if (resource.cached)
+            tooltip = WebInspector.UIString("%s (from cache)", tooltip);
+        return {left: label, right: label, tooltip: tooltip};
+    },
+
     _value: function(resource)
     {
         return resource.contentLength;
@@ -1251,7 +934,7 @@ WebInspector.ResourceTransferSizeCalculator.prototype = {
     }
 }
 
-WebInspector.ResourceTransferSizeCalculator.prototype.__proto__ = WebInspector.ResourceCalculator.prototype;
+WebInspector.ResourceTransferSizeCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
 
 WebInspector.ResourceSidebarTreeElement = function(resource)
 {
@@ -1269,13 +952,12 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     {
         WebInspector.SidebarTreeElement.prototype.onattach.call(this);
 
-        var link = document.createElement("a");
-        link.href = this.resource.url;
-        link.className = "invisible";
-        while (this._listItemNode.firstChild)
-            link.appendChild(this._listItemNode.firstChild);
-        this._listItemNode.appendChild(link);
         this._listItemNode.addStyleClass("resources-category-" + this.resource.category.name);
+        this._listItemNode.draggable = true;
+        
+        // FIXME: should actually add handler to parent, to be resolved via
+        // https://bugs.webkit.org/show_bug.cgi?id=30227
+        this._listItemNode.addEventListener("dragstart", this.ondragstart.bind(this), false);
     },
 
     onselect: function()
@@ -1288,6 +970,13 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
 
+    ondragstart: function(event) {
+        event.dataTransfer.setData("text/plain", this.resource.url);
+        event.dataTransfer.setData("text/uri-list", this.resource.url + "\r\n");
+        event.dataTransfer.effectAllowed = "copy";
+        return true;
+    },
+
     get mainTitle()
     {
         return this.resource.displayName;
@@ -1318,7 +1007,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
 
     get selectable()
     {
-        return WebInspector.panels.resources._filterCategory == "all" || WebInspector.panels.resources._filterCategory == this.resource.category.name;
+        return WebInspector.panels.resources.isCategoryVisible(this.resource.category.name);
     },
 
     createIconElement: function()
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 05ec197..4aa0ab2 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -388,22 +388,6 @@ WebInspector.ScriptsPanel.prototype = {
         InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
     },
 
-    variablesInSelectedCallFrame: function()
-    {
-        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
-        if (!this._paused || !selectedCallFrame)
-            return {};
-
-        var result = {};
-        var scopeChain = selectedCallFrame.scopeChain;
-        for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObjectProperties = scopeChain[i].properties;
-            for (var j = 0; j < scopeObjectProperties.length; ++j)
-                result[scopeObjectProperties[j]] = true;
-        }
-        return result;
-    },
-
     debuggerPaused: function(callFrames)
     {
         this._paused = true;
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index 790055a..1c11f76 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -425,7 +425,7 @@ WebInspector.SourceFrame.prototype = {
             return;
 
         var expression = selection.getRangeAt(0).toString().trimWhitespace();
-        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, function(result, exception) {
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, "console", function(result, exception) {
             WebInspector.showConsole();
             var commandMessage = new WebInspector.ConsoleCommand(expression);
             WebInspector.console.addMessage(commandMessage);
@@ -980,132 +980,377 @@ WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.Source
 WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
     WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
 
-    this.findNumber = this.generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
-    this.findKeyword = this.generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
-    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
-    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
-    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
-    this.findMultilineSingleQuoteStringStart = this.generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-    this.findMultilineSingleQuoteStringEnd = this.generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
-    this.findMultilineDoubleQuoteStringStart = this.generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-    this.findMultilineDoubleQuoteStringEnd = this.generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
-    this.findMultilineRegExpEnd = this.generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
-    this.findSingleLineComment = this.generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
-}
-
-WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
-    deleteContinueFlags: function(cell)
+    this.LexState = {
+        Initial: 1,
+        DivisionAllowed: 2,
+    };
+    this.ContinueState = {
+        None: 0,
+        Comment: 1,
+        SingleQuoteString: 2,
+        DoubleQuoteString: 3,
+        RegExp: 4
+    };
+    
+    this.nonToken = "";
+    this.cursor = 0;
+    this.lineIndex = -1;
+    this.lineCode = "";
+    this.lineFragment = null;
+    this.lexState = this.LexState.Initial;
+    this.continueState = this.ContinueState.None;
+    
+    this.rules = [{
+            pattern: /^(?:\/\/.*)/,
+            action: singleLineCommentAction
+        }, {
+            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*\*+\/)/,
+            action: multiLineSingleLineCommentAction
+        }, {
+            pattern: /^(?:\/\*(?:[^\*]|\*[^\/])*)/,
+            action: multiLineCommentStartAction
+        }, {
+            pattern: /^(?:(?:[^\*]|\*[^\/])*\*+\/)/,
+            action: multiLineCommentEndAction,
+            continueStateCondition: this.ContinueState.Comment
+        }, {
+            pattern: /^.*/,
+            action: multiLineCommentMiddleAction,
+            continueStateCondition: this.ContinueState.Comment
+        }, {
+            pattern: /^(?:(?:0|[1-9]\d*)\.\d+?(?:[eE](?:\d+|\+\d+|-\d+))?|\.\d+(?:[eE](?:\d+|\+\d+|-\d+))?|(?:0|[1-9]\d*)(?:[eE](?:\d+|\+\d+|-\d+))?|0x[0-9a-fA-F]+|0X[0-9a-fA-F]+)/,
+            action: numericLiteralAction
+        }, {
+            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*"|'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+            action: stringLiteralAction
+        }, {
+            pattern: /^(?:'(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: singleQuoteStringStartAction
+        }, {
+            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*')/,
+            action: singleQuoteStringEndAction,
+            continueStateCondition: this.ContinueState.SingleQuoteString
+        }, {
+            pattern: /^(?:(?:[^'\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: singleQuoteStringMiddleAction,
+            continueStateCondition: this.ContinueState.SingleQuoteString
+        }, {
+            pattern: /^(?:"(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: doubleQuoteStringStartAction
+        }, {
+            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*")/,
+            action: doubleQuoteStringEndAction,
+            continueStateCondition: this.ContinueState.DoubleQuoteString
+        }, {
+            pattern: /^(?:(?:[^"\\]|\\(?:['"\bfnrtv]|[^'"\bfnrtv0-9xu]|0|x[0-9a-fA-F][0-9a-fA-F]|(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])))*)\\$/,
+            action: doubleQuoteStringMiddleAction,
+            continueStateCondition: this.ContinueState.DoubleQuoteString
+        }, {
+            pattern: /^(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+            action: identOrKeywordAction,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^\)/,
+            action: rightParenAction,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^(?:<=|>=|===|==|!=|!==|\+\+|\-\-|<<|>>|>>>|&&|\|\||\+=|\-=|\*=|%=|<<=|>>=|>>>=|&=|\|=|^=|[{}\(\[\]\.;,<>\+\-\*%&\|\^!~\?:=])/,
+            action: punctuatorAction,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^(?:\/=?)/,
+            action: divPunctuatorAction,
+            stateCondition: this.LexState.DivisionAllowed,
+            dontAppendNonToken: true
+        }, {
+            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+            action: regExpLiteralAction
+        }, {
+            pattern: /^(?:\/(?:(?:\\.)|[^\\*\/])(?:(?:\\.)|[^\\/])*)\\$/,
+            action: regExpStartAction
+        }, {
+            pattern: /^(?:(?:(?:\\.)|[^\\/])*\/(?:(?:[a-zA-Z]|[$_]|\\(?:u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]))|[0-9])*)/,
+            action: regExpEndAction,
+            continueStateCondition: this.ContinueState.RegExp
+        }, {
+            pattern: /^(?:(?:(?:\\.)|[^\\/])*)\\$/,
+            action: regExpMiddleAction,
+            continueStateCondition: this.ContinueState.RegExp
+        }];
+    
+    function singleLineCommentAction(token)
     {
-        if (!cell)
-            return;
-        delete cell._commentContinues;
-        delete cell._singleQuoteStringContinues;
-        delete cell._doubleQuoteStringContinues;
-        delete cell._regexpContinues;
-    },
-
-    findMultilineRegExpStart: function(str)
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+    }
+    
+    function multiLineSingleLineCommentAction(token)
     {
-        var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
-        if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
-            return null;
-        this.previousMatchLength = match[0].length;
-        return this.createSpan(match[0], "webkit-javascript-regexp");
-    },
-
-    findSingleLineRegExp: function(str)
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+    }
+    
+    function multiLineCommentStartAction(token)
     {
-        var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
-        if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
-            return null;
-        this.previousMatchLength = match[1].length;
-        return this.createSpan(match[1], "webkit-javascript-regexp");
-    },
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.continueState = this.ContinueState.Comment;
+    }
+    
+    function multiLineCommentEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+        this.continueState = this.ContinueState.None;
+    }
+    
+    function multiLineCommentMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-comment"));
+    }
+    
+    function numericLiteralAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-number"));
+        this.lexState = this.LexState.DivisionAllowed;
+    }
+    
+    function stringLiteralAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function singleQuoteStringStartAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.SingleQuoteString;
+    }
+    
+    function singleQuoteStringEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.None;
+    }
+    
+    function singleQuoteStringMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+    }
+    
+    function doubleQuoteStringStartAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.DoubleQuoteString;
+    }
+    
+    function doubleQuoteStringEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+        this.continueState = this.ContinueState.None;
+    }
+    
+    function doubleQuoteStringMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-string"));
+    }
+    
+    function regExpLiteralAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.lexState = this.LexState.Initial;
+    }
 
-    syntaxHighlightLine: function(line, prevLine)
+    function regExpStartAction(token)
     {
-        var messageBubble = line.lastChild;
-        if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
-            line.removeChild(messageBubble);
-        else
-            messageBubble = null;
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.continueState = this.ContinueState.RegExp;
+    }
 
-        var code = line.textContent;
+    function regExpEndAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+        this.continueState = this.ContinueState.None;
+    }
 
-        while (line.firstChild)
-            line.removeChild(line.firstChild);
+    function regExpMiddleAction(token)
+    {
+        this.cursor += token.length;
+        this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-regexp"));
+    }
+    
+    function identOrKeywordAction(token)
+    {
+        const keywords = ["null", "true", "false", "break", "case", "catch", "const", "default", "finally", "for", "instanceof", "new", "var", "continue", "function", "return", "void", "delete", "if", "this", "do", "while", "else", "in", "switch", "throw", "try", "typeof", "with", "debugger", "class", "enum", "export", "extends", "import", "super", "get", "set"];
+        this.cursor += token.length;
+        if (keywords.indexOf(token) === -1) {
+            this.nonToken += token;
+            this.lexState = this.LexState.DivisionAllowed;
+        } else {
+            this.appendNonToken();
+            this.lineFragment.appendChild(this.createSpan(token, "webkit-javascript-keyword"));
+            this.lexState = this.LexState.Initial;
+        }
+    }
+    
+    function divPunctuatorAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+    
+    function rightParenAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.DivisionAllowed;
+    }
+    
+    function punctuatorAction(token)
+    {
+        this.cursor += token.length;
+        this.nonToken += token;
+        this.lexState = this.LexState.Initial;
+    }
+}
 
-        var token;
-        var tmp = 0;
-        var i = 0;
-        this.previousMatchLength = 0;
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
+    process: function()
+    {
+        // Split up the work into chunks so we don't block the
+        // UI thread while processing.
 
-        if (prevLine) {
-            if (prevLine._commentContinues) {
-                if (!(token = this.findMultilineCommentEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-comment");
-                    line._commentContinues = true;
-                }
-            } else if (prevLine._singleQuoteStringContinues) {
-                if (!(token = this.findMultilineSingleQuoteStringEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-string");
-                    line._singleQuoteStringContinues = true;
+        var rows = this.table.rows;
+        var rowsLength = rows.length;
+        const tokensPerChunk = 100;
+        const lineLengthLimit = 20000;
+        
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+        
+        function processChunk()
+        {
+            for (var i = 0; i < tokensPerChunk; i++) {
+                if (this.cursor >= this.lineCode.length)
+                    moveToNextLine.call(this);
+                if (this.lineIndex >= rowsLength) {
+                    this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                    return;
                 }
-            } else if (prevLine._doubleQuoteStringContinues) {
-                if (!(token = this.findMultilineDoubleQuoteStringEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-string");
-                    line._doubleQuoteStringContinues = true;
+                if (this.cursor > lineLengthLimit) {
+                    var codeFragment = this.lineCode.substring(this.cursor);
+                    this.nonToken += codeFragment;
+                    this.cursor += codeFragment.length;
                 }
-            } else if (prevLine._regexpContinues) {
-                if (!(token = this.findMultilineRegExpEnd(code))) {
-                    token = this.createSpan(code, "webkit-javascript-regexp");
-                    line._regexpContinues = true;
+
+                this.lex();
+            }
+        }
+        
+        function moveToNextLine()
+        {
+            this.appendNonToken();
+            
+            var row = rows[this.lineIndex];
+            var line = row ? row.cells[1] : null;
+            if (line && this.lineFragment) {
+                var messageBubble = null;
+                if (line.lastChild && line.lastChild.nodeType === Node.ELEMENT_NODE && line.lastChild.hasStyleClass("webkit-html-message-bubble")) {
+                    messageBubble = line.lastChild;
+                    line.removeChild(messageBubble);
                 }
+                
+                Element.prototype.removeChildren.call(line);
+                
+                line.appendChild(this.lineFragment);
+                if (messageBubble)
+                    line.appendChild(messageBubble);
+                this.lineFragment = null;
             }
-            if (token) {
-                i += this.previousMatchLength ? this.previousMatchLength : code.length;
-                tmp = i;
-                line.appendChild(token);
+            this.lineIndex++;
+            if (this.lineIndex >= rowsLength && processChunkInterval) {
+                clearInterval(processChunkInterval);
+                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+                return;
             }
+            row = rows[this.lineIndex];
+            line = row ? row.cells[1] : null;
+            this.lineCode = line.textContent;
+            this.lineFragment = document.createDocumentFragment();
+            this.cursor = 0;
+            if (!line)
+                moveToNextLine();
         }
-
-        for ( ; i < code.length; ++i) {
-            var codeFragment = code.substr(i);
-            var prevChar = code[i - 1];
-            token = this.findSingleLineComment(codeFragment);
-            if (!token) {
-                if ((token = this.findMultilineCommentStart(codeFragment)))
-                    line._commentContinues = true;
-                else if (!prevChar || /^\W/.test(prevChar)) {
-                    token = this.findNumber(codeFragment) ||
-                            this.findKeyword(codeFragment) ||
-                            this.findSingleLineString(codeFragment) ||
-                            this.findSingleLineRegExp(codeFragment);
-                    if (!token) {
-                        if (token = this.findMultilineSingleQuoteStringStart(codeFragment))
-                            line._singleQuoteStringContinues = true;
-                        else if (token = this.findMultilineDoubleQuoteStringStart(codeFragment))
-                            line._doubleQuoteStringContinues = true;
-                        else if (token = this.findMultilineRegExpStart(codeFragment))
-                            line._regexpContinues = true;
+    },
+    
+    lex: function()
+    {
+        var token = null;
+        var codeFragment = this.lineCode.substring(this.cursor);
+        
+        for (var i = 0; i < this.rules.length; i++) {
+            var rule = this.rules[i];
+            var ruleContinueStateCondition = typeof rule.continueStateCondition === "undefined" ? this.ContinueState.None : rule.continueStateCondition;
+            if (this.continueState === ruleContinueStateCondition) {
+                if (typeof rule.stateCondition !== "undefined" && this.lexState !== rule.stateCondition)
+                    continue;
+                var match = rule.pattern.exec(codeFragment);
+                if (match) {
+                    token = match[0];
+                    if (token) {
+                        if (!rule.dontAppendNonToken)
+                            this.appendNonToken();
+                        return rule.action.call(this, token);
                     }
                 }
             }
-
-            if (token) {
-                if (tmp !== i)
-                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                line.appendChild(token);
-                i += this.previousMatchLength - 1;
-                tmp = i + 1;
-            }
         }
+        this.nonToken += codeFragment[0];
+        this.cursor++;
+    },
+    
+    appendNonToken: function ()
+    {
+        if (this.nonToken.length > 0) {
+            this.lineFragment.appendChild(document.createTextNode(this.nonToken));
+            this.nonToken = "";
+        }
+    },
+    
+    syntaxHighlightNode: function(node)
+    {
+        this.lineCode = node.textContent;
+        this.lineFragment = document.createDocumentFragment();
+        this.cursor = 0;
+        while (true) {
+            if (this.cursor >= this.lineCode.length) {
+                var codeFragment = this.lineCode.substring(this.cursor);
+                this.nonToken += codeFragment;
+                this.cursor += codeFragment.length;
+                this.appendNonToken();
+                while (node.firstChild)
+                    node.removeChild(node.firstChild);
+                node.appendChild(this.lineFragment);
+                this.lineFragment =null;
+                return;
+            }
 
-        if (tmp < code.length)
-            line.appendChild(document.createTextNode(code.substring(tmp, i)));
-
-        if (messageBubble)
-            line.appendChild(messageBubble);
+            this.lex();
+        }
     }
 }
 
diff --git a/WebCore/inspector/front-end/StoragePanel.js b/WebCore/inspector/front-end/StoragePanel.js
index 089bb98..1aa11ee 100644
--- a/WebCore/inspector/front-end/StoragePanel.js
+++ b/WebCore/inspector/front-end/StoragePanel.js
@@ -31,21 +31,7 @@ WebInspector.StoragePanel = function(database)
 {
     WebInspector.Panel.call(this);
 
-    this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "storage-sidebar";
-    this.sidebarElement.className = "sidebar";
-    this.element.appendChild(this.sidebarElement);
-
-    this.sidebarResizeElement = document.createElement("div");
-    this.sidebarResizeElement.className = "sidebar-resizer-vertical";
-    this.sidebarResizeElement.addEventListener("mousedown", this._startSidebarDragging.bind(this), false);
-    this.element.appendChild(this.sidebarResizeElement);
-
-    this.sidebarTreeElement = document.createElement("ol");
-    this.sidebarTreeElement.className = "sidebar-tree";
-    this.sidebarElement.appendChild(this.sidebarTreeElement);
-
-    this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
+    this.createSidebar();
 
     this.databasesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("DATABASES"), {}, true);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
@@ -86,12 +72,6 @@ WebInspector.StoragePanel.prototype = {
         return [this.storageViewStatusBarItemsContainer];
     },
 
-    show: function()
-    {
-        WebInspector.Panel.prototype.show.call(this);
-        this._updateSidebarWidth();
-    },
-
     reset: function()
     {
         if (this._databases) {
@@ -133,11 +113,6 @@ WebInspector.StoragePanel.prototype = {
             this.sidebarTree.selectedTreeElement.deselect();
     },
 
-    handleKeyEvent: function(event)
-    {
-        this.sidebarTree.handleKeyEvent(event);
-    },
-
     addDatabase: function(database)
     {
         this._databases.push(database);
@@ -416,49 +391,10 @@ WebInspector.StoragePanel.prototype = {
         return null;
     },
 
-    _startSidebarDragging: function(event)
-    {
-        WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
-    },
-
-    _sidebarDragging: function(event)
-    {
-        this._updateSidebarWidth(event.pageX);
-
-        event.preventDefault();
-    },
-
-    _endSidebarDragging: function(event)
+    updateMainViewWidth: function(width)
     {
-        WebInspector.elementDragEnd(event);
-    },
-
-    _updateSidebarWidth: function(width)
-    {
-        if (this.sidebarElement.offsetWidth <= 0) {
-            // The stylesheet hasn't loaded yet or the window is closed,
-            // so we can't calculate what is need. Return early.
-            return;
-        }
-
-        if (!("_currentSidebarWidth" in this))
-            this._currentSidebarWidth = this.sidebarElement.offsetWidth;
-
-        if (typeof width === "undefined")
-            width = this._currentSidebarWidth;
-
-        width = Number.constrain(width, Preferences.minSidebarWidth, window.innerWidth / 2);
-
-        this._currentSidebarWidth = width;
-
-        this.sidebarElement.style.width = width + "px";
         this.storageViews.style.left = width + "px";
         this.storageViewStatusBarItemsContainer.style.left = width + "px";
-        this.sidebarResizeElement.style.left = (width - 3) + "px";
-        
-        var visibleView = this.visibleView;
-        if (visibleView && "resize" in visibleView)
-            visibleView.resize();
     }
 }
 
@@ -558,7 +494,7 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 
     get mainTitle()
     {
-        return this.domStorage.domain;
+        return this.domStorage.domain ? this.domStorage.domain : WebInspector.UIString("Local Files");
     },
 
     set mainTitle(x)
@@ -592,6 +528,16 @@ WebInspector.CookieSidebarTreeElement.prototype = {
     {
         WebInspector.panels.storage.showCookies(this._cookieDomain);
     },
+    
+    get mainTitle()
+    {
+        return this._cookieDomain ? this._cookieDomain : WebInspector.UIString("Local Files");
+    },
+
+    set mainTitle(x)
+    {
+        // Do nothing.
+    },
 
     get subtitle()
     {
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index 3582f96..a95dae3 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -376,7 +376,7 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
 {
     WebInspector.PropertiesSection.call(this, styleRule.selectorText);
 
-    this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
+    this.titleElement.addEventListener("click", this._clickSelector.bind(this), false);
     this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
     this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
 
@@ -591,6 +591,19 @@ WebInspector.StylePropertiesSection.prototype = {
         return item;
     },
 
+    _clickSelector: function(event)
+    {
+        event.stopPropagation();
+
+        // Don't search "Computed Styles", "Style Attribute", or Mapped Attributes.
+        if (this.computedStyle || !this.rule || this.rule.isUser)
+            return;
+
+        var searchElement = document.getElementById("search");
+        searchElement.value = this.styleRule.selectorText;
+        WebInspector.performSearch({ target: searchElement });
+    },
+
     _dblclickEmptySpace: function(event)
     {
         this.expand();
diff --git a/WebCore/inspector/front-end/SummaryBar.js b/WebCore/inspector/front-end/SummaryBar.js
index bbf2b1a..1c31449 100644
--- a/WebCore/inspector/front-end/SummaryBar.js
+++ b/WebCore/inspector/front-end/SummaryBar.js
@@ -74,8 +74,7 @@ WebInspector.SummaryBar.prototype = {
             if (!size)
                 continue;
 
-            var color = this.categories[category].color;
-            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
+            var colorString = this.categories[category].color;
 
             var fillSegment = {color: colorString, value: size};
             fillSegments.push(fillSegment);
diff --git a/WebCore/inspector/front-end/TestController.js b/WebCore/inspector/front-end/TestController.js
new file mode 100644
index 0000000..12e1ac7
--- /dev/null
+++ b/WebCore/inspector/front-end/TestController.js
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TestController = function(callId)
+{
+    this._callId = callId;
+    this._waitUntilDone = false;
+}
+
+WebInspector.TestController.prototype = {
+    waitUntilDone: function()
+    {
+        this._waitUntilDone = true;
+    },
+
+    notifyDone: function(result)
+    {
+        var message = typeof result === "undefined" ? "<undefined>" : JSON.stringify(result);
+        InspectorController.didEvaluateForTestInFrontend(this._callId, message);
+    },
+
+    runAfterPendingDispatches: function(callback)
+    {
+        if (WebInspector.pendingDispatches === 0) {
+            callback();
+            return;
+        }
+
+        setTimeout(this.runAfterPendingDispatches.bind(this), 0, callback);
+    }
+}
+
+WebInspector.evaluateForTestInFrontend = function(callId, script)
+{
+    var controller = new WebInspector.TestController(callId);
+    try {
+        var result;
+        if (window[script] && typeof window[script] === "function")
+            result = window[script].call(this, controller);
+        else
+            result = window.eval(script);
+
+        if (!controller._waitUntilDone)
+            controller.notifyDone(result);
+    } catch (e) {
+        controller.notifyDone(e.toString());
+    }
+}
diff --git a/WebCore/inspector/front-end/TimelineAgent.js b/WebCore/inspector/front-end/TimelineAgent.js
index 6d18732..cbbb736 100644
--- a/WebCore/inspector/front-end/TimelineAgent.js
+++ b/WebCore/inspector/front-end/TimelineAgent.js
@@ -33,22 +33,31 @@ WebInspector.TimelineAgent = function() {
 }
 
 // Must be kept in sync with TimelineItem.h
-WebInspector.TimelineAgent.ItemType = {
-    DOMDispatch       : 0,
-    Layout            : 1,
-    RecalculateStyles : 2,
-    Paint             : 3,
-    ParseHTML         : 4
+WebInspector.TimelineAgent.RecordType = {
+    DOMDispatch         : 0,
+    Layout              : 1,
+    RecalculateStyles   : 2,
+    Paint               : 3,
+    ParseHTML           : 4,
+    TimerInstall        : 5,
+    TimerRemove         : 6,
+    TimerFire           : 7,
+    XHRReadyStateChange : 8,
+    XHRLoad             : 9,
+    EvaluateScriptTag   : 10
 };
 
-WebInspector.addItemToTimeline = function(record) {
-    // Not implemented.
+WebInspector.addRecordToTimeline = function(record) {
+    if (WebInspector.panels.timeline)
+        WebInspector.panels.timeline.addRecordToTimeline(record);
 }
 
-WebInspector.timelineWasEnabled = function() {
-    // Not implemented.
+WebInspector.timelineProfilerWasStarted = function() {
+    if (WebInspector.panels.timeline)
+        WebInspector.panels.timeline.timelineWasStarted();
 }
 
-WebInspector.timelineWasDisabled = function() {
-    // Not implemented.
+WebInspector.timelineProfilerWasStopped = function() {
+    if (WebInspector.panels.timeline)
+        WebInspector.panels.timeline.timelineWasStopped();
 }
diff --git a/WebCore/inspector/front-end/TimelinePanel.js b/WebCore/inspector/front-end/TimelinePanel.js
new file mode 100644
index 0000000..df63a0b
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelinePanel.js
@@ -0,0 +1,362 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelinePanel = function()
+{
+    WebInspector.AbstractTimelinePanel.call(this);
+
+    this.element.addStyleClass("timeline");
+
+    this.createInterface();
+    this.summaryBar.element.id = "timeline-summary";
+    this.itemsGraphsElement.id = "timeline-graphs";
+
+    this._createStatusbarButtons();
+
+    this.calculator = new WebInspector.TimelineCalculator();
+
+    this.filter(this.filterAllElement, false);
+}
+
+WebInspector.TimelinePanel.prototype = {
+    toolbarItemClass: "timeline",
+
+    get toolbarItemLabel()
+    {
+        return WebInspector.UIString("Timeline");
+    },
+
+    get statusBarItems()
+    {
+        return [this.toggleTimelineButton.element, this.clearButton.element];
+    },
+
+    get categories()
+    {
+        if (!this._categories) {
+            this._categories = {
+                loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"),
+                scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"),
+                rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"),
+                other: new WebInspector.TimelineCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
+            };
+        }
+        return this._categories;
+    },
+
+    populateSidebar: function()
+    {
+        this.itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
+        this.itemsTreeElement.expanded = true;
+        this.sidebarTree.appendChild(this.itemsTreeElement);
+    },
+
+    _createStatusbarButtons: function()
+    {
+        this.toggleTimelineButton = new WebInspector.StatusBarButton("", "record-profile-status-bar-item");
+        this.toggleTimelineButton.addEventListener("click", this._toggleTimelineButtonClicked.bind(this), false);
+
+        this.clearButton = new WebInspector.StatusBarButton("", "timeline-clear-status-bar-item");
+        this.clearButton.addEventListener("click", this.reset.bind(this), false);
+    },
+
+    timelineWasStarted: function()
+    {
+        this.toggleTimelineButton.toggled = true;
+    },
+
+    timelineWasStopped: function()
+    {
+        this.toggleTimelineButton.toggled = false;
+    },
+
+    addRecordToTimeline: function(record)
+    {
+        var formattedRecord = this._formatRecord(record);
+        // Glue subsequent records with same category and title together if they are closer than 100ms to each other.
+        if (this._lastRecord && (!record.children || !record.children.length) &&
+                this._lastRecord.category == formattedRecord.category &&
+                this._lastRecord.title == formattedRecord.title &&
+                this._lastRecord.details == formattedRecord.details &&
+                formattedRecord.startTime - this._lastRecord.endTime < 0.1) {
+            this._lastRecord.endTime = formattedRecord.endTime;
+            this._lastRecord.count++;
+            this.refreshItem(this._lastRecord);
+        } else {
+            this.addItem(formattedRecord);
+
+            for (var i = 0; record.children && i < record.children.length; ++i)
+                this.addRecordToTimeline(record.children[i]);
+            this._lastRecord = record.children && record.children.length ? null : formattedRecord;
+        }
+    },
+
+    createItemTreeElement: function(item)
+    {
+        return new WebInspector.TimelineRecordTreeElement(item);
+    },
+
+    createItemGraph: function(item)
+    {
+        return new WebInspector.TimelineGraph(item);
+    },
+
+    _toggleTimelineButtonClicked: function()
+    {
+        if (InspectorController.timelineProfilerEnabled())
+            InspectorController.stopTimelineProfiler();
+        else
+            InspectorController.startTimelineProfiler();
+    },
+
+    _formatRecord: function(record)
+    {
+        if (!this._recordStyles) {
+            this._recordStyles = {};
+            var recordTypes = WebInspector.TimelineAgent.RecordType;
+            this._recordStyles[recordTypes.DOMDispatch] = { title: WebInspector.UIString("DOM Event"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: this.categories.rendering };
+            this._recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: this.categories.rendering };
+            this._recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: this.categories.rendering };
+            this._recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: this.categories.loading };
+            this._recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: this.categories.scripting };
+            this._recordStyles[recordTypes.EvaluateScriptTag] = { title: WebInspector.UIString("Evaluate Script"), category: this.categories.scripting };
+            this._recordStyles["Other"] = { title: WebInspector.UIString("Other"), icon: 0, category: this.categories.other };
+        }
+
+        var style = this._recordStyles[record.type];
+        if (!style)
+            style = this._recordStyles["Other"];
+
+        var formattedRecord = {};
+        formattedRecord.category = style.category;
+        formattedRecord.title = style.title;
+        formattedRecord.startTime = record.startTime / 1000;
+        formattedRecord.data = record.data;
+        formattedRecord.count = 1;
+        formattedRecord.type = record.type;
+        formattedRecord.details = this._getRecordDetails(record);
+        formattedRecord.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : formattedRecord.startTime;
+        return formattedRecord;
+    },
+    
+    _getRecordDetails: function(record)
+    {
+        switch (record.type) {
+        case WebInspector.TimelineAgent.RecordType.DOMDispatch:
+            return record.data.type;
+        case WebInspector.TimelineAgent.RecordType.TimerInstall:
+        case WebInspector.TimelineAgent.RecordType.TimerRemove:
+        case WebInspector.TimelineAgent.RecordType.TimerFire:
+            return record.data.timerId;
+        case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
+        case WebInspector.TimelineAgent.RecordType.XHRLoad:
+        case WebInspector.TimelineAgent.RecordType.EvaluateScriptTag:
+            return record.data.url;
+        default:
+            return "";
+        }
+    },
+
+    reset: function()
+    {
+        WebInspector.AbstractTimelinePanel.prototype.reset.call(this);
+        this._lastRecord = null;
+    }
+}
+
+WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.AbstractTimelinePanel.prototype;
+
+
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    WebInspector.AbstractTimelineCategory.call(this, name, title, color);
+}
+
+WebInspector.TimelineCategory.prototype = {
+}
+
+WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.AbstractTimelineCategory.prototype;
+
+
+WebInspector.TimelineRecordTreeElement = function(record)
+{
+    this._record = record;
+
+    // Pass an empty title, the title gets made later in onattach.
+    TreeElement.call(this, "", null, false);
+}
+
+WebInspector.TimelineRecordTreeElement.prototype = {
+    onattach: function()
+    {
+        this.listItemElement.removeChildren();
+        this.listItemElement.addStyleClass("timeline-tree-item");
+        this.listItemElement.addStyleClass("timeline-category-" + this._record.category.name);
+
+        var iconElement = document.createElement("span");
+        iconElement.className = "timeline-tree-icon";
+        this.listItemElement.appendChild(iconElement);
+
+        this.typeElement = document.createElement("span");
+        this.typeElement.className = "type";
+        this.typeElement.textContent = this._record.title;
+        this.listItemElement.appendChild(this.typeElement);
+
+        if (this._record.details) {
+            var separatorElement = document.createElement("span");
+            separatorElement.className = "separator";
+            separatorElement.textContent = " ";
+
+            var dataElement = document.createElement("span");
+            dataElement.className = "data";
+            dataElement.textContent = "(" + this._record.details + ")";
+            dataElement.addStyleClass("dimmed");
+            this.listItemElement.appendChild(separatorElement);
+            this.listItemElement.appendChild(dataElement);
+        }
+    },
+
+    refresh: function()
+    {
+        if (this._record.count > 1)
+            this.typeElement.textContent = this._record.title + " x " + this._record.count;
+    }
+}
+
+WebInspector.TimelineRecordTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+
+WebInspector.TimelineCalculator = function()
+{
+    WebInspector.AbstractTimelineCalculator.call(this);
+}
+
+WebInspector.TimelineCalculator.prototype = {
+    computeBarGraphPercentages: function(record)
+    {
+        var start = ((record.startTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        var end = ((record.endTime - this.minimumBoundary) / this.boundarySpan) * 100;
+        return {start: start, end: end};
+    },
+
+    computePercentageFromEventTime: function(eventTime)
+    {
+        return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+    },
+
+    computeBarGraphLabels: function(record)
+    {
+        return {tooltip: record.title};
+    },
+
+    updateBoundaries: function(record)
+    {
+        var didChange = false;
+
+        var lowerBound = record.startTime;
+
+        if (typeof this.minimumBoundary === "undefined" || lowerBound < this.minimumBoundary) {
+            this.minimumBoundary = lowerBound;
+            didChange = true;
+        }
+
+        var upperBound = record.endTime;
+        if (typeof this.maximumBoundary === "undefined" || upperBound > this.maximumBoundary) {
+            this.maximumBoundary = upperBound;
+            didChange = true;
+        }
+
+        return didChange;
+    },
+
+    formatValue: function(value)
+    {
+        return Number.secondsToString(value, WebInspector.UIString.bind(WebInspector));
+    },
+
+}
+
+WebInspector.TimelineCalculator.prototype.__proto__ = WebInspector.AbstractTimelineCalculator.prototype;
+
+
+WebInspector.TimelineGraph = function(record)
+{
+    this.record = record;
+
+    this._graphElement = document.createElement("div");
+    this._graphElement.className = "timeline-graph-side";
+
+    this._barAreaElement = document.createElement("div");
+    this._barAreaElement.className = "timeline-graph-bar-area hidden";
+    this._graphElement.appendChild(this._barAreaElement);
+
+    this._barElement = document.createElement("div");
+    this._barElement.className = "timeline-graph-bar";
+    this._barAreaElement.appendChild(this._barElement);
+
+    this._graphElement.addStyleClass("timeline-category-" + record.category.name);
+}
+
+WebInspector.TimelineGraph.prototype = {
+    get graphElement()
+    {
+        return this._graphElement;
+    },
+
+    refreshLabelPositions: function()
+    {
+    },
+
+    refresh: function(calculator)
+    {
+        var percentages = calculator.computeBarGraphPercentages(this.record);
+        var labels = calculator.computeBarGraphLabels(this.record);
+
+        this._percentages = percentages;
+
+        this._barAreaElement.removeStyleClass("hidden");
+
+        if (!this._graphElement.hasStyleClass("timeline-category-" + this.record.category.name)) {
+            this._graphElement.removeMatchingStyleClasses("timeline-category-\\w+");
+            this._graphElement.addStyleClass("timeline-category-" + this.record.category.name);
+        }
+
+        this._barElement.style.setProperty("left", percentages.start + "%");
+        this._barElement.style.setProperty("right", (100 - percentages.end) + "%");
+
+        var tooltip = (labels.tooltip || "");
+        this._barElement.title = tooltip;
+    }
+}
diff --git a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
index b9d8b94..1b07883 100644
--- a/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -33,7 +33,7 @@ WebInspector.TopDownProfileDataGridNode = function(/*ProfileView*/ profileView,
 }
 
 WebInspector.TopDownProfileDataGridNode.prototype = {
-    _populate: function(event)
+    _sharedPopulate: function()
     {
         var children = this._remainingChildren;
         var childrenLength = children.length;
@@ -41,9 +41,6 @@ WebInspector.TopDownProfileDataGridNode.prototype = {
         for (var i = 0; i < childrenLength; ++i)
             this.appendChild(new WebInspector.TopDownProfileDataGridNode(this.profileView, children[i], this.tree));
 
-        if (this.removeEventListener)
-            this.removeEventListener("populate", this._populate, this);
-
         this._remainingChildren = null;
     },
 
@@ -105,7 +102,9 @@ WebInspector.TopDownProfileDataGridTree.prototype = {
             this.sort(this.lastComparator, true);
     },
 
-    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge
+    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge,
+
+    _sharedPopulate: WebInspector.TopDownProfileDataGridNode.prototype._sharedPopulate
 }
 
 WebInspector.TopDownProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index c0f282c..a1d671e 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -1,6 +1,7 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/webkit/inspector">
     <file>inspector.html</file>
+    <file>AbstractTimelinePanel.js</file>
     <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
@@ -57,8 +58,10 @@
     <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
     <file>SummaryBar.js</file>
+    <file>TestController.js</file>
     <file>TextPrompt.js</file>
     <file>TimelineAgent.js</file>
+    <file>TimelinePanel.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 3d7c99a..78ab23d 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -203,6 +203,10 @@ body.attached #search-results-matches {
     background-image: url(Images/scriptsIcon.png);
 }
 
+.toolbar-item.timeline .toolbar-icon {
+    background-image: url(Images/timelineIcon.png);
+}
+
 .toolbar-item.storage .toolbar-icon {
     background-image: url(Images/storageIcon.png);
 }
@@ -548,7 +552,7 @@ body.drawer-visible #drawer {
     margin-right: 4px;
     text-align: left;
     font-size: 11px;
-    font-family: Helvetia, Arial, sans-serif;
+    font-family: Helvetica, Arial, sans-serif;
     font-weight: bold;
     text-shadow: none;
     color: white;
@@ -826,11 +830,6 @@ body.drawer-visible #drawer {
     vertical-align: top;
 }
 
-.invisible {
-    color: inherit;
-    text-decoration: none;
-}
-
 .webkit-line-gutter-backdrop {
     /* Keep this in sync with view-source.css (.webkit-line-gutter-backdrop) */
     width: 31px;
@@ -1164,6 +1163,7 @@ body.drawer-visible #drawer {
 .add-attribute {
     margin-left: 1px;
     margin-right: 1px;
+    white-space: nowrap;
 }
 
 .placard {
@@ -1645,6 +1645,10 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     background-position: -46px 0px;
 }
 
+.pane > .title > select > option, .pane > .title > select > hr {
+    color: black;
+}
+
 .pane > .body {
     position: relative;
     display: none;
@@ -2213,12 +2217,8 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     margin: 0 0 5px 20px;
 }
 
-.panel-enabler-view button {
-    font-size: 13px;
-    margin: 6px 0 0 0;
-    padding: 3px 20px;
+.panel-enabler-view button, .pane button {
     color: rgb(6, 6, 6);
-    height: 24px;
     background-color: transparent;
     border: 1px solid rgb(165, 165, 165);
     background-color: rgb(237, 237, 237);
@@ -2227,12 +2227,24 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     -webkit-appearance: none;
 }
 
-.panel-enabler-view button:active {
+.panel-enabler-view button {
+    font-size: 13px;
+    margin: 6px 0 0 0;
+    padding: 3px 20px;
+    height: 24px;
+}
+
+.pane button {
+    margin: 6px 0 6px 3px;
+    padding: 2px 9px;
+}
+
+.panel-enabler-view button:active, .pane button:active {
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
 
-body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled {
+body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled, body.inactive .pane button, .pane button:disabled {
     color: rgb(130, 130, 130);
     border-color: rgb(212, 212, 212);
     background-color: rgb(239, 239, 239);
@@ -2402,67 +2414,65 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 }
 
 #resources-filter {
-    height: 24px;
-    padding: 2px 10px 0;
-    background: -webkit-gradient(linear, left top, left bottom, from(rgb(233, 233, 233)), to(rgb(207, 207, 207)));
-    border-bottom: 1px solid rgb(177, 177, 177);
-    overflow: hidden;
+    background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
+    border-bottom: 1px solid rgb(64%, 64%, 64%);
 }
 
 #console-filter {
-    height: 24px;
+    margin-top: 1px;
+}
+
+.scope-bar {
+    height: 23px;
     padding: 2px 10px 0;
     overflow: hidden;
 }
 
-#resources-filter li, #console-filter li {
+.scope-bar li {
     display: inline-block;
-    margin: 1px 1px 0 0;
-    padding: 0 6px 3px;
-    font-size: 12px;
+    margin: 1px 2px 0 0;
+    padding: 1px 7px 3px;
+    font-size: 11px;
     line-height: 12px;
     font-weight: bold;
-    color: rgb(40, 40, 40);
-    border: 1px solid transparent;
-    border-bottom: 0;
+    color: rgb(46, 46, 46);
     background: transparent;
+    text-shadow: rgba(255, 255, 255, 0.5) 0 1px 0;
     -webkit-border-radius: 8px;
-    text-shadow: rgba(255, 255, 255, 0.5) 1px 1px 0;
+    vertical-align: middle;
 }
 
-#console-filter div.divider {
-    margin-left: 5px;
-    margin-right: 5px;
-    /* Only want a border-left here because border on both sides
-    made the divider too thick */
-    border-left: 1px solid gray;
-    display: inline;
+.scope-bar .divider {
+    margin: 1px 9px 0 8px;
+    background-color: rgba(0, 0, 0, 0.4);
+    height: 16px;
+    width: 1px;
+    vertical-align: middle;
+    display: inline-block;
 }
 
-#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active,
-#console-filter li.selected, #console-filter li:hover, #console-filter li:active {
+.scope-bar li.selected, .scope-bar li:hover, .scope-bar li:active {
     color: white;
-    text-shadow: rgb(80, 80, 80) 1px 1px 1px;
-    background: rgba(20, 20, 20, 0.4);
-    border-color: rgba(20, 20, 20, 0.2);
-    -webkit-box-shadow: 0 1px 0px rgba(255, 255, 255, 0.5);
+    text-shadow: rgba(0, 0, 0, 0.4) 0 1px 0;
 }
 
-#resources-filter li:hover,
-#console-filter li:hover {
-    background: rgba(20, 20, 20, 0.4);
-    border-color: transparent;
-    -webkit-box-shadow: none;
+.scope-bar li:hover {
+    background: rgba(0, 0, 0, 0.2);
+}
+
+.scope-bar li.selected {
+    background: rgba(0, 0, 0, 0.3);
+    -webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, 0.5) inset, 0 -1px 1px rgba(255, 255, 255, 0.25) inset, 0 1px 0 rgba(255, 255, 255, 0.5);
 }
 
-#resources-filter li:active,
-#console-filter li:active {
-    background: rgba(20, 20, 20, 0.6);
+.scope-bar li:active {
+    background: rgba(0, 0, 0, 0.5);
+    -webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, 0.5) inset, 0 -1px 1px rgba(255, 255, 255, 0.25) inset, 0 1px 0 rgba(255, 255, 255, 0.5);
 }
 
 #resources-container {
     position: absolute;
-    top: 24px;
+    top: 23px;
     left: 0;
     bottom: 0;
     right: 0;
@@ -2520,6 +2530,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-background-size: 1px 6px;
     -webkit-background-origin: padding;
     -webkit-background-clip: padding;
+    z-index: 400;
 }
 
 .summary-graph-legend {
@@ -2566,6 +2577,16 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     z-index: -100;
 }
 
+#resources-event-dividers {
+    position: absolute;
+    left: 0;
+    right: 0;
+    height: 100%;
+    top: 0;
+    z-index: 300;
+    pointer-events: none;
+}
+
 #resources-dividers-label-bar {
     position: absolute;
     top: 93px;
@@ -2586,6 +2607,14 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     background-color: rgba(0, 0, 0, 0.1);
 }
 
+.resources-event-divider-padding {
+    position: absolute;
+    width: 8px;
+    top: 0;
+    bottom: 0;
+    pointer-events: auto;
+}
+
 .resources-onload-divider {
     position: absolute;
     width: 2px;
@@ -2814,7 +2843,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 
 #resource-views {
     position: absolute;
-    top: 24px;
+    top: 23px;
     right: 0;
     left: 200px;
     bottom: 0;
@@ -2835,7 +2864,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 }
 
 .resources .sidebar-resizer-vertical {
-    top: 24px;
+    top: 23px;
 }
 
 .sidebar-tree, .sidebar-tree .children {
@@ -2982,7 +3011,7 @@ body.inactive .sidebar-tree-item .disclosure-button:active {
     padding: 1px 4px;
     text-align: center;
     font-size: 11px;
-    font-family: Helvetia, Arial, sans-serif;
+    font-family: Helvetica, Arial, sans-serif;
     font-weight: bold;
     text-shadow: none;
     color: white;
@@ -3235,6 +3264,125 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     background-image: url(Images/searchSmallGray.png);
 }
 
+/* Timeline Style */
+
+#timeline-summary {
+    position: absolute;
+    top: 0;
+    left: 0;
+    width: 0;
+    height: 0;
+}
+
+.timeline-clear-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/clearConsoleButtonGlyph.png);
+}
+
+.timeline-tree-item {
+    height: 18px;
+    padding-left: 10px;
+    padding-top: 2px;
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+}
+
+.timeline-tree-item .type {
+    padding-left: 14px;
+}
+
+.timeline-tree-item .timeline-tree-icon {
+    background-image: url(Images/timelineDots.png);
+    margin-top: 2px;
+    width: 12px;
+    height: 12px;
+    position: absolute;
+}
+
+.timeline-tree-item:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
+.timeline-tree-item .data.dimmed {
+    color: rgba(0, 0, 0, 0.7);
+}
+
+.timeline-category-loading, .timeline-category-scripting, .timeline-category-rendering {
+    display: none;
+}
+
+.filter-all .timeline-category-loading, .filter-loading .timeline-category-loading,
+.filter-all .timeline-category-scripting, .filter-scripting .timeline-category-scripting,
+.filter-all .timeline-category-rendering, .filter-rendering .timeline-category-rendering {
+    display: list-item;
+}
+
+#timeline-graphs {
+    position: absolute;
+    left: 0;
+    right: 0;
+    max-height: 100%;
+    top: 19px;
+}
+
+.timeline-graph-side {
+    position: relative;
+    height: 18px;
+    padding: 0 5px;
+    white-space: nowrap;
+    margin-top: 0px;
+    border-top: 1px solid transparent;
+    overflow: hidden;
+}
+
+.timeline-graph-bar-area {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    right: 8px;
+    left: 9px;
+}
+
+.timeline-graph-bar {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    margin: auto -5px;
+    border-width: 4px 4px 5px;
+    height: 9px;
+    min-width: 7px;
+    opacity: 0.8;
+    -webkit-border-image: url(Images/timelineBarGray.png) 4 4 5 4;
+}
+
+.timeline-graph-side:nth-of-type(2n) {
+    background-color: rgba(0, 0, 0, 0.05);
+}
+
+.timeline-category-loading .timeline-graph-bar {
+    -webkit-border-image: url(Images/timelineBarBlue.png) 4 4 5 4;
+}
+
+.timeline-category-scripting .timeline-graph-bar {
+    -webkit-border-image: url(Images/timelineBarOrange.png) 4 4 5 4;
+}
+
+.timeline-category-rendering .timeline-graph-bar {
+    -webkit-border-image: url(Images/timelineBarPurple.png) 4 4 5 4;
+}
+
+.timeline-category-loading .timeline-tree-icon {
+    background-position-y: 0px;
+}
+
+.timeline-category-scripting .timeline-tree-icon {
+    background-position-y: 48px;
+}
+
+.timeline-category-rendering .timeline-tree-icon {
+    background-position-y: 72px;
+}
+
 /* Profiler Style */
 
 #profile-views {
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index db9bfd7..04ab07a 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -34,6 +34,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
+    <script type="text/javascript" src="InspectorControllerStub.js"></script>
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
@@ -44,6 +45,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Drawer.js"></script>
     <script type="text/javascript" src="ChangesView.js"></script>
     <script type="text/javascript" src="ConsoleView.js"></script>
+    <script type="text/javascript" src="Panel.js"></script>
+    <script type="text/javascript" src="AbstractTimelinePanel.js"></script>
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="Database.js"></script>
@@ -69,7 +72,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="EventListenersSidebarPane.js"></script>
     <script type="text/javascript" src="Color.js"></script>
     <script type="text/javascript" src="StylesSidebarPane.js"></script>
-    <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="PanelEnablerView.js"></script>
     <script type="text/javascript" src="StatusBarButton.js"></script>
     <script type="text/javascript" src="SummaryBar.js"></script>
@@ -94,6 +96,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="InjectedScript.js"></script>
     <script type="text/javascript" src="InjectedScriptAccess.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
+    <script type="text/javascript" src="TimelinePanel.js"></script>
+    <script type="text/javascript" src="TestController.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
@@ -109,7 +113,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
-        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="status-bar-item"></div></div></div>
+        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="scope-bar status-bar-item"></div></div></div>
     </div>
 </body>
 </html>
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index f090d3a..c24d589 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -139,10 +139,15 @@ var WebInspector = {
             this.panels.resources = new WebInspector.ResourcesPanel();
         if (hiddenPanels.indexOf("scripts") === -1)
             this.panels.scripts = new WebInspector.ScriptsPanel();
-        if (hiddenPanels.indexOf("profiles") === -1)
+        if (hiddenPanels.indexOf("profiles") === -1) {
             this.panels.profiles = new WebInspector.ProfilesPanel();
+            this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
+        }
+        if (hiddenPanels.indexOf("timeline") === -1 && hiddenPanels.indexOf("timeline") === -1)
+            this.panels.timeline = new WebInspector.TimelinePanel();
+
         if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
-            this.panels.storage = new WebInspector.StoragePanel();      
+            this.panels.storage = new WebInspector.StoragePanel();
     },
 
     _loadPreferences: function()
@@ -367,6 +372,7 @@ WebInspector.loaded = function()
     document.body.addStyleClass("platform-" + platform);
 
     this._loadPreferences();
+    this.pendingDispatches = 0;
 
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
@@ -377,13 +383,13 @@ WebInspector.loaded = function()
     this.domAgent = new WebInspector.DOMAgent();
 
     this.resourceCategories = {
-        documents: new WebInspector.ResourceCategory(WebInspector.UIString("Documents"), "documents"),
-        stylesheets: new WebInspector.ResourceCategory(WebInspector.UIString("Stylesheets"), "stylesheets"),
-        images: new WebInspector.ResourceCategory(WebInspector.UIString("Images"), "images"),
-        scripts: new WebInspector.ResourceCategory(WebInspector.UIString("Scripts"), "scripts"),
-        xhr: new WebInspector.ResourceCategory(WebInspector.UIString("XHR"), "xhr"),
-        fonts: new WebInspector.ResourceCategory(WebInspector.UIString("Fonts"), "fonts"),
-        other: new WebInspector.ResourceCategory(WebInspector.UIString("Other"), "other")
+        documents: new WebInspector.ResourceCategory("documents", WebInspector.UIString("Documents"), "rgb(47,102,236)"),
+        stylesheets: new WebInspector.ResourceCategory("stylesheets", WebInspector.UIString("Stylesheets"), "rgb(157,231,119)"),
+        images: new WebInspector.ResourceCategory("images", WebInspector.UIString("Images"), "rgb(164,60,255)"),
+        scripts: new WebInspector.ResourceCategory("scripts", WebInspector.UIString("Scripts"), "rgb(255,121,0)"),
+        xhr: new WebInspector.ResourceCategory("xhr", WebInspector.UIString("XHR"), "rgb(231,231,10)"),
+        fonts: new WebInspector.ResourceCategory("fonts", WebInspector.UIString("Fonts"), "rgb(255,82,62)"),
+        other: new WebInspector.ResourceCategory("other", WebInspector.UIString("Other"), "rgb(186,186,186)")
     };
 
     this.panels = {};
@@ -454,8 +460,6 @@ WebInspector.loaded = function()
     // this._updateErrorAndWarningCounts();
 
     var searchField = document.getElementById("search");
-    searchField.addEventListener("keydown", this.searchKeyDown.bind(this), false);
-    searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
 
     toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
@@ -486,7 +490,16 @@ window.addEventListener("load", windowLoaded, false);
 WebInspector.dispatch = function() {
     var methodName = arguments[0];
     var parameters = Array.prototype.slice.call(arguments, 1);
-    WebInspector[methodName].apply(this, parameters);
+
+    // We'd like to enforce asynchronous interaction between the inspector controller and the frontend.
+    // This is important to LayoutTests.
+    function delayDispatch()
+    {
+        WebInspector[methodName].apply(WebInspector, parameters);
+        WebInspector.pendingDispatches--;
+    }
+    WebInspector.pendingDispatches++;
+    setTimeout(delayDispatch, 0);
 }
 
 WebInspector.windowUnload = function(event)
@@ -502,13 +515,19 @@ WebInspector.windowResize = function(event)
 
 WebInspector.windowFocused = function(event)
 {
-    if (event.target.nodeType === Node.DOCUMENT_NODE)
+    // Fires after blur, so when focusing on either the main inspector
+    // or an <iframe> within the inspector we should always remove the
+    // "inactive" class.
+    if (event.target.document.nodeType === Node.DOCUMENT_NODE)
         document.body.removeStyleClass("inactive");
 }
 
-WebInspector.windowBlured = function(event)
+WebInspector.windowBlurred = function(event)
 {
-    if (event.target.nodeType === Node.DOCUMENT_NODE)
+    // Leaving the main inspector or an <iframe> within the inspector.
+    // We can add "inactive" now, and if we are moving the focus to another
+    // part of the inspector then windowFocused will correct this.
+    if (event.target.document.nodeType === Node.DOCUMENT_NODE)
         document.body.addStyleClass("inactive");
 }
 
@@ -547,10 +566,9 @@ WebInspector.documentClick = function(event)
 
             WebInspector.showResourceForURL(anchor.href, anchor.lineNumber, anchor.preferredPanel);
         } else {
-            var profileStringRegEx = new RegExp("webkit-profile://.+/([0-9]+)");
-            var profileString = profileStringRegEx.exec(anchor.href);
+            var profileString = WebInspector.ProfileType.URLRegExp.exec(anchor.href);
             if (profileString)
-                WebInspector.showProfileById(profileString[1])
+                WebInspector.showProfileForURL(anchor.href);
         }
     }
 
@@ -618,7 +636,9 @@ WebInspector.documentKeyDown = function(event)
 
                 break;
 
-            case "U+005B": // [ key
+            // Windows and Mac have two different definitions of [, so accept both.
+            case "U+005B":
+            case "U+00DB": // [ key
                 if (isMac)
                     var isRotateLeft = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
                 else
@@ -633,7 +653,9 @@ WebInspector.documentKeyDown = function(event)
 
                 break;
 
-            case "U+005D": // ] key
+            // Windows and Mac have two different definitions of ], so accept both.
+            case "U+005D":
+            case "U+00DD":  // ] key
                 if (isMac)
                     var isRotateRight = event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey;
                 else
@@ -1043,7 +1065,8 @@ WebInspector.addDatabase = function(payload)
 
 WebInspector.addCookieDomain = function(domain)
 {
-    this.panels.storage.addCookieDomain(domain);
+    if (this.panels.storage)
+        this.panels.storage.addCookieDomain(domain);
 }
 
 WebInspector.addDOMStorage = function(payload)
@@ -1156,7 +1179,7 @@ WebInspector.didCommitLoad = function()
     WebInspector.setDocument(null);
 }
 
-WebInspector.addMessageToConsole = function(payload)
+WebInspector.addConsoleMessage = function(payload)
 {
     var consoleMessage = new WebInspector.ConsoleMessage(
         payload.source,
@@ -1170,6 +1193,11 @@ WebInspector.addMessageToConsole = function(payload)
     this.console.addMessage(consoleMessage);
 }
 
+WebInspector.updateConsoleMessageRepeatCount = function(count)
+{
+    this.console.updateMessageRepeatCount(count);
+}
+
 WebInspector.log = function(message)
 {
     // remember 'this' for setInterval() callback
@@ -1254,14 +1282,15 @@ WebInspector.log = function(message)
     logMessage(message);
 }
 
-WebInspector.addProfile = function(profile)
+WebInspector.addProfileHeader = function(profile)
 {
-    this.panels.profiles.addProfile(profile);
+    this.panels.profiles.addProfileHeader(WebInspector.CPUProfileType.TypeId, new WebInspector.CPUProfile(profile));
 }
 
 WebInspector.setRecordingProfile = function(isProfiling)
 {
-    this.panels.profiles.setRecordingProfile(isProfiling);
+    this.panels.profiles.getProfileType(WebInspector.CPUProfileType.TypeId).setRecordingProfile(isProfiling);
+    this.panels.profiles.updateProfileTypeButtons();
 }
 
 WebInspector.drawLoadingPieChart = function(canvas, percent) {
@@ -1367,13 +1396,9 @@ WebInspector.linkifyStringAsFragment = function(string)
         var nonLink = string.substring(0, linkIndex);
         container.appendChild(document.createTextNode(nonLink));
 
-        var profileStringRegEx = new RegExp("webkit-profile://(.+)/[0-9]+");
-        var profileStringMatches = profileStringRegEx.exec(title);
-        var profileTitle;
+        var profileStringMatches = WebInspector.ProfileType.URLRegExp.exec(title);
         if (profileStringMatches)
-            profileTitle = profileStringMatches[1];
-        if (profileTitle)
-            title = WebInspector.panels.profiles.displayTitleForProfileLink(profileTitle);
+            title = WebInspector.panels.profiles.displayTitleForProfileLink(profileStringMatches[2], profileStringMatches[1]);
 
         var realURL = (linkString.indexOf("www.") === 0 ? "http://" + linkString : linkString);
         container.appendChild(WebInspector.linkifyURLAsNode(realURL, title, null, (realURL in WebInspector.resourceURLMap)));
@@ -1386,9 +1411,9 @@ WebInspector.linkifyStringAsFragment = function(string)
     return container;
 }
 
-WebInspector.showProfileById = function(uid) {
+WebInspector.showProfileForURL = function(url) {
     WebInspector.showProfilesPanel();
-    WebInspector.panels.profiles.showProfileById(uid);
+    WebInspector.panels.profiles.showProfileForURL(url);
 }
 
 WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
@@ -1417,26 +1442,15 @@ WebInspector.linkifyURL = function(url, linkText, classes, isExternal)
 
 WebInspector.addMainEventListeners = function(doc)
 {
-    doc.defaultView.addEventListener("focus", this.windowFocused.bind(this), true);
-    doc.defaultView.addEventListener("blur", this.windowBlured.bind(this), true);
+    doc.defaultView.addEventListener("focus", this.windowFocused.bind(this), false);
+    doc.defaultView.addEventListener("blur", this.windowBlurred.bind(this), false);
     doc.addEventListener("click", this.documentClick.bind(this), true);
 }
 
 WebInspector.searchKeyDown = function(event)
 {
-    if (event.keyIdentifier !== "Enter")
-        return;
-
-    // Call preventDefault since this was the Enter key. This prevents a "search" event
-    // from firing for key down. We handle the Enter key on key up in searchKeyUp. This
-    // stops performSearch from being called twice in a row.
-    event.preventDefault();
-}
-
-WebInspector.searchKeyUp = function(event)
-{
-    if (event.keyIdentifier !== "Enter")
-        return;
+    if (!isEnterKey(event))
+        return false;
 
     // Select all of the text so the user can easily type an entirely new query.
     event.target.select();
@@ -1445,14 +1459,33 @@ WebInspector.searchKeyUp = function(event)
     // performance is poor because of searching on every key. The search field has
     // the incremental attribute set, so we still get incremental searches.
     this.performSearch(event);
+
+    // Call preventDefault since this was the Enter key. This prevents a "search" event
+    // from firing for key down. This stops performSearch from being called twice in a row.
+    event.preventDefault();
 }
 
 WebInspector.performSearch = function(event)
 {
     var query = event.target.value;
     var forceSearch = event.keyIdentifier === "Enter";
+    var isShortSearch = (query.length < 3);
+
+    // Clear a leftover short search flag due to a non-conflicting forced search.
+    if (isShortSearch && this.shortSearchWasForcedByKeyEvent && this.currentQuery !== query)
+        delete this.shortSearchWasForcedByKeyEvent;
+
+    // Indicate this was a forced search on a short query.
+    if (isShortSearch && forceSearch)
+        this.shortSearchWasForcedByKeyEvent = true;
+
+    if (!query || !query.length || (!forceSearch && isShortSearch)) {
+        // Prevent clobbering a short search forced by the user.
+        if (this.shortSearchWasForcedByKeyEvent) {
+            delete this.shortSearchWasForcedByKeyEvent;
+            return;
+        }
 
-    if (!query || !query.length || (!forceSearch && query.length < 3)) {
         delete this.currentQuery;
 
         for (var panelName in this.panels) {
@@ -1525,7 +1558,8 @@ WebInspector.UIString = function(string)
         string = window.localizedStrings[string];
     else {
         if (!(string in this.missingLocalizedStrings)) {
-            console.error("Localized string \"" + string + "\" not found.");
+            if (!WebInspector.InspectorControllerStub)
+                console.error("Localized string \"" + string + "\" not found.");
             this.missingLocalizedStrings[string] = true;
         }
 
@@ -1608,7 +1642,7 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         if (event.handled)
             return;
 
-        if (event.keyIdentifier === "Enter") {
+        if (isEnterKey(event)) {
             editingCommitted.call(element);
             event.preventDefault();
         } else if (event.keyCode === 27) { // Escape key
@@ -1630,11 +1664,6 @@ WebInspector._toolbarItemClicked = function(event)
     this.currentPanel = toolbarItem.panel;
 }
 
-WebInspector.evaluateForTestInFrontend = function(callId, script)
-{
-    InspectorController.didEvaluateForTestInFrontend(callId, JSON.stringify(window.eval(script)));
-}
-
 // This table maps MIME types to the Resource.Types which are valid for them.
 // The following line:
 //    "text/html":                {0: 1},
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index 6df23de..e9d185f 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -817,3 +817,8 @@ String.format = function(format, substitutions, formatters, initialValue, append
 
     return { formattedResult: result, unusedSubstitutions: unusedSubstitutions };
 }
+
+function isEnterKey(event) {
+    // Check if in IME.
+    return event.keyCode !== 229 && event.keyIdentifier === "Enter";
+}
diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 391790f..46fb068 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -275,6 +275,12 @@ void Cache::pruneLiveResources()
     
     // Destroy any decoded data in live objects that we can.
     // Start from the tail, since this is the least recently accessed of the objects.
+
+    // The list might not be sorted by the m_lastDecodedAccessTime. The impact
+    // of this weaker invariant is minor as the below if statement to check the
+    // elapsedTime will evaluate to false as the currentTime will be a lot
+    // greater than the current->m_lastDecodedAccessTime.
+    // For more details see: https://bugs.webkit.org/show_bug.cgi?id=30209
     CachedResource* current = m_liveDecodedResources.m_tail;
     while (current) {
         CachedResource* prev = current->m_prevInLiveResourcesList;
diff --git a/WebCore/loader/CachedResource.cpp b/WebCore/loader/CachedResource.cpp
index 43de633..f2f52b0 100644
--- a/WebCore/loader/CachedResource.cpp
+++ b/WebCore/loader/CachedResource.cpp
@@ -242,6 +242,12 @@ void CachedResource::setDecodedSize(unsigned size)
         cache()->insertInLRUList(this);
         
         // Insert into or remove from the live decoded list if necessary.
+        // When inserting into the LiveDecodedResourcesList it is possible
+        // that the m_lastDecodedAccessTime is still zero or smaller than
+        // the m_lastDecodedAccessTime of the current list head. This is a
+        // violation of the invariant that the list is to be kept sorted
+        // by access time. The weakening of the invariant does not pose
+        // a problem. For more details please see: https://bugs.webkit.org/show_bug.cgi?id=30209
         if (m_decodedSize && !m_inLiveDecodedResourcesList && hasClients())
             cache()->insertInLiveDecodedResourcesList(this);
         else if (!m_decodedSize && m_inLiveDecodedResourcesList)
diff --git a/WebCore/loader/CachedResourceHandle.h b/WebCore/loader/CachedResourceHandle.h
index 9d45b94..0956e0c 100644
--- a/WebCore/loader/CachedResourceHandle.h
+++ b/WebCore/loader/CachedResourceHandle.h
@@ -60,7 +60,7 @@ namespace WebCore {
     template <class R> class CachedResourceHandle : public CachedResourceHandleBase {
     public: 
         CachedResourceHandle() { }
-        CachedResourceHandle(R* res) : CachedResourceHandleBase(res) { }
+        CachedResourceHandle(R* res);
         CachedResourceHandle(const CachedResourceHandle<R>& o) : CachedResourceHandleBase(o) { }
 
         R* get() const { return reinterpret_cast<R*>(CachedResourceHandleBase::get()); }
@@ -71,6 +71,17 @@ namespace WebCore {
         bool operator==(const CachedResourceHandleBase& o) const { return get() == o.get(); }
         bool operator!=(const CachedResourceHandleBase& o) const { return get() != o.get(); }
     };
+
+    // Don't inline for winscw compiler to prevent the compiler agressively resolving
+    // the base class of R* when CachedResourceHandler<T>(R*) is inlined.  The bug is
+    // reported at: https://xdabug001.ext.nokia.com/bugzilla/show_bug.cgi?id=9812.
+    template <class R>
+#if !COMPILER(WINSCW)
+    inline
+#endif
+    CachedResourceHandle<R>::CachedResourceHandle(R* res) : CachedResourceHandleBase(res) 
+    {
+    }
     
     template <class R, class RR> bool operator==(const CachedResourceHandle<R>& h, const RR* res) 
     { 
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index d9e09fb..44fad72 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -493,6 +493,7 @@ class EmptyPluginHalterClient : public PluginHalterClient
 {
 public:
     virtual bool shouldHaltPlugin(Node*) const { return false; }
+    virtual bool enabled() const { return false; }
 };
 
 }
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index 071c0a7..4e6b776 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -2,6 +2,8 @@
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,6 +59,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLAnchorElement.h"
 #include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
@@ -76,6 +79,7 @@
 #include "PageTransitionEvent.h"
 #include "PlaceholderDocument.h"
 #include "PluginData.h"
+#include "PluginDatabase.h"
 #include "PluginDocument.h"
 #include "ProgressTracker.h"
 #include "RenderPart.h"
@@ -114,6 +118,7 @@
 #include "SVGViewSpec.h"
 #endif
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
 #include "RenderArena.h"
@@ -127,6 +132,8 @@
 #define PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
 #endif
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/loader/FrameLoader.cpp
 namespace WebCore {
 
 #if ENABLE(SVG)
@@ -178,6 +185,8 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
     , m_policyChecker(frame)
+    , m_history(frame)
+    , m_notifer(frame)
     , m_state(FrameStateCommittedPage)
     , m_loadType(FrameLoadTypeStandard)
     , m_delegateIsHandlingProvisionalLoadError(false)
@@ -186,7 +195,6 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_sentRedirectNotification(false)
     , m_inStopAllLoaders(false)
     , m_isExecutingJavaScriptFormAction(false)
-    , m_isRunningScript(false)
     , m_didCallImplicitClose(false)
     , m_wasUnloadEventEmitted(false)
     , m_unloadEventBeingDispatched(false)
@@ -205,6 +213,7 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_committedFirstRealDocumentLoad(false)
     , m_didPerformFirstNavigation(false)
     , m_loadingFromCachedPage(false)
+    , m_suppressOpenerInNewFrame(false)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -262,7 +271,7 @@ Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const F
         Frame* frame = frameLoaderForFrameLookup->frame()->tree()->find(request.frameName());
         if (frame && shouldAllowNavigation(frame)) {
             if (!request.resourceRequest().url().isEmpty())
-                frame->loader()->loadFrameRequest(request, false, false, 0, 0);
+                frame->loader()->loadFrameRequest(request, false, false, 0, 0, SendReferrer);
             if (Page* page = frame->page())
                 page->chrome()->focus();
             created = false;
@@ -329,15 +338,17 @@ void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool l
     request.setUserGesture(userGesture);
 #endif
     
-    if (executeIfJavaScriptURL(request.url(), userGesture))
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture))
         return;
 
-    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture);
+    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture, SendReferrer);
 }
 
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy referrerPolicy)
 {
-    if (executeIfJavaScriptURL(request.url(), userGesture, false))
+    ASSERT(!m_suppressOpenerInNewFrame);
+
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture, false))
         return;
 
     String target = passedTarget;
@@ -346,11 +357,15 @@ void FrameLoader::urlSelected(const ResourceRequest& request, const String& pass
 
     FrameLoadRequest frameRequest(request, target);
 
-    if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+    if (referrerPolicy == NoReferrer)
+        m_suppressOpenerInNewFrame = true;
+    else if (frameRequest.resourceRequest().httpReferrer().isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0);
+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0, referrerPolicy);
+
+    m_suppressOpenerInNewFrame = false;
 }
 
 bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
@@ -374,7 +389,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
         return false;
 
     if (!scriptURL.isEmpty())
-        frame->loader()->executeIfJavaScriptURL(scriptURL);
+        frame->script()->executeIfJavaScriptURL(scriptURL);
 
     return true;
 }
@@ -446,7 +461,7 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
 
     if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
-        executeIfJavaScriptURL(u, false, false);
+        m_frame->script()->executeIfJavaScriptURL(u, false, false);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
@@ -533,8 +548,14 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
         }
 
         // Dispatching the unload event could have made m_frame->document() null.
-        if (m_frame->document() && !m_frame->document()->inPageCache())
-            m_frame->document()->removeAllEventListeners();
+        if (m_frame->document() && !m_frame->document()->inPageCache()) {
+            // Don't remove event listeners from a transitional empty document (see bug 28716 for more information).
+            bool keepEventListeners = m_isDisplayingInitialEmptyDocument && m_provisionalDocumentLoader
+                && m_frame->document()->securityOrigin()->isSecureTransitionTo(m_provisionalDocumentLoader->url());
+
+            if (!keepEventListeners)
+                m_frame->document()->removeAllEventListeners();
+        }
     }
 
     m_isComplete = true; // to avoid calling completed() in finishedParsing()
@@ -581,7 +602,7 @@ void FrameLoader::stop()
 
 bool FrameLoader::closeURL()
 {
-    saveDocumentState();
+    history()->saveDocumentState();
     
     // Should only send the pagehide event here if the current document exists and has not been placed in the page cache.    
     Document* currentDocument = m_frame->document();
@@ -624,7 +645,6 @@ bool FrameLoader::didOpenURL(const KURL& url)
 
     m_frame->redirectScheduler()->cancel();
     m_frame->editor()->clearLastEditCommand();
-    closeURL();
 
     m_isComplete = false;
     m_isLoadingMainResource = true;
@@ -664,62 +684,6 @@ void FrameLoader::didExplicitOpen()
         m_URL = m_frame->document()->url();
 }
 
-bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
-{
-    if (!protocolIsJavaScript(url))
-        return false;
-
-    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
-        return true;
-
-    const int javascriptSchemeLength = sizeof("javascript:") - 1;
-
-    String script = url.string().substring(javascriptSchemeLength);
-    ScriptValue result;
-    if (m_frame->script()->xssAuditor()->canEvaluateJavaScriptURL(script))
-        result = executeScript(decodeURLEscapeSequences(script), userGesture);
-
-    String scriptResult;
-    if (!result.getString(scriptResult))
-        return true;
-
-    SecurityOrigin* currentSecurityOrigin = m_frame->document()->securityOrigin();
-
-    // FIXME: We should always replace the document, but doing so
-    //        synchronously can cause crashes:
-    //        http://bugs.webkit.org/show_bug.cgi?id=16782
-    if (replaceDocument) {
-        stopAllLoaders();
-        begin(m_URL, true, currentSecurityOrigin);
-        write(scriptResult);
-        end();
-    }
-
-    return true;
-}
-
-ScriptValue FrameLoader::executeScript(const String& script, bool forceUserGesture)
-{
-    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_URL));
-}
-
-ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
-{
-    if (!m_frame->script()->isEnabled() || m_frame->script()->isPaused())
-        return ScriptValue();
-
-    bool wasRunningScript = m_isRunningScript;
-    m_isRunningScript = true;
-
-    ScriptValue result = m_frame->script()->evaluate(sourceCode);
-
-    if (!wasRunningScript) {
-        m_isRunningScript = false;
-        Document::updateStyleForAllDocuments();
-    }
-
-    return result;
-}
 
 void FrameLoader::cancelAndClear()
 {
@@ -732,6 +696,14 @@ void FrameLoader::cancelAndClear()
     m_frame->script()->updatePlatformScriptObjects();
 }
 
+void FrameLoader::replaceDocument(const String& html)
+{
+    stopAllLoaders();
+    begin(m_URL, true, m_frame->document()->securityOrigin());
+    write(html);
+    end();
+}
+
 void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)
 {
     m_frame->editor()->clear();
@@ -807,6 +779,8 @@ void FrameLoader::receivedFirstData()
     String url;
     if (!m_documentLoader)
         return;
+    if (m_frame->inViewSourceMode())
+        return;
     if (!parseHTTPRefresh(m_documentLoader->response().httpHeaderField("Refresh"), false, delay, url))
         return;
 
@@ -895,7 +869,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
             document->parseDNSPrefetchControlHeader(dnsPrefetchControl);
     }
 
-    restoreDocumentState();
+    history()->restoreDocumentState();
 
     document->implicitOpen();
     
@@ -1082,52 +1056,6 @@ void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
     iconDatabase()->setIconURLForPageURL(icon.string(), originalRequestURL().string());
 }
 
-void FrameLoader::restoreDocumentState()
-{
-    Document* doc = m_frame->document();
-        
-    HistoryItem* itemToRestore = 0;
-    
-    switch (loadType()) {
-        case FrameLoadTypeReload:
-        case FrameLoadTypeReloadFromOrigin:
-        case FrameLoadTypeSame:
-        case FrameLoadTypeReplace:
-            break;
-        case FrameLoadTypeBack:
-        case FrameLoadTypeBackWMLDeckNotAccessible:
-        case FrameLoadTypeForward:
-        case FrameLoadTypeIndexedBackForward:
-        case FrameLoadTypeRedirectWithLockedBackForwardList:
-        case FrameLoadTypeStandard:
-            itemToRestore = m_currentHistoryItem.get(); 
-    }
-    
-    if (!itemToRestore)
-        return;
-
-    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
-    doc->setStateForNewFormElements(itemToRestore->documentState());
-}
-
-void FrameLoader::gotoAnchor()
-{
-    // If our URL has no ref, then we have no place we need to jump to.
-    // OTOH If CSS target was set previously, we want to set it to 0, recalc
-    // and possibly repaint because :target pseudo class may have been
-    // set (see bug 11321).
-    if (!m_URL.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
-        return;
-
-    String fragmentIdentifier = m_URL.fragmentIdentifier();
-    if (gotoAnchor(fragmentIdentifier))
-        return;
-
-    // Try again after decoding the ref, based on the document's encoding.
-    if (m_decoder)
-        gotoAnchor(decodeURLEscapeSequences(fragmentIdentifier, m_decoder->encoding()));
-}
-
 void FrameLoader::finishedParsing()
 {
     if (m_creatingInitialEmptyDocument)
@@ -1150,8 +1078,7 @@ void FrameLoader::finishedParsing()
     // Check if the scrollbars are really needed for the content.
     // If not, remove them, relayout, and repaint.
     m_frame->view()->restoreScrollbar();
-
-    gotoAnchor();
+    m_frame->view()->scrollToFragment(m_URL);
 }
 
 void FrameLoader::loadDone()
@@ -1275,7 +1202,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
 {
     ASSERT(childFrame);
 
-    HistoryItem* parentItem = currentHistoryItem();
+    HistoryItem* parentItem = history()->currentItem();
     FrameLoadType loadType = this->loadType();
     FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
@@ -1291,7 +1218,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
             // this is needed is Radar 3213556.
             workingURL = KURL(ParsedURLString, childItem->originalURLString());
             childLoadType = loadType;
-            childFrame->loader()->m_provisionalHistoryItem = childItem;
+            childFrame->loader()->history()->setProvisionalItem(childItem);
         }
     }
 
@@ -1342,6 +1269,7 @@ String FrameLoader::encoding() const
     return settings ? settings->defaultTextEncodingName() : String();
 }
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
 bool FrameLoader::gotoAnchor(const String& name)
 {
     ASSERT(m_frame->document());
@@ -1399,6 +1327,8 @@ bool FrameLoader::gotoAnchor(const String& name)
     return true;
 }
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/loader/FrameLoader.cpp
 bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const AtomicString& frameName,
     const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
@@ -1453,6 +1383,30 @@ bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool
     return objectType == ObjectContentNone || objectType == ObjectContentNetscapePlugin || objectType == ObjectContentOtherPlugin;
 }
 
+ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn)
+{
+    String mimeType = mimeTypeIn;
+    // We don't use MIMETypeRegistry::getMIMETypeForPath() because it returns "application/octet-stream" upon failure
+    if (mimeType.isEmpty())
+        mimeType = MIMETypeRegistry::getMIMETypeForExtension(url.path().substring(url.path().reverseFind('.') + 1));
+
+    if (mimeType.isEmpty())
+        return ObjectContentFrame; // Go ahead and hope that we can display the content.
+
+    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+        return WebCore::ObjectContentImage;
+
+#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM)  // Mac has no PluginDatabase, nor does Chromium 
+    if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
+        return WebCore::ObjectContentNetscapePlugin;
+#endif
+
+    if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
+        return WebCore::ObjectContentFrame;
+
+    return WebCore::ObjectContentNone;
+}
+
 static HTMLPlugInElement* toPlugInElement(Node* node)
 {
     if (!node)
@@ -1483,6 +1437,8 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
             return false;
         }
 
+        checkIfRunInsecureContent(m_frame->document()->securityOrigin(), url);
+
         widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()),
                                         element, url, paramNames, paramValues, mimeType,
                                         m_frame->document()->isPluginDocument() && !m_containsPlugIns);
@@ -1521,6 +1477,10 @@ void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const K
     if (!isMixedContent(context, url))
         return;
 
+    String message = String::format("The page at %s displayed insecure content from %s.\n",
+        m_URL.string().utf8().data(), url.string().utf8().data());
+    m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
+
     m_client->didDisplayInsecureContent();
 }
 
@@ -1529,6 +1489,10 @@ void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL&
     if (!isMixedContent(context, url))
         return;
 
+    String message = String::format("The page at %s ran insecure content from %s.\n",
+        m_URL.string().utf8().data(), url.string().utf8().data());
+    m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
+
     m_client->didRunInsecureContent(context);
 }
 
@@ -1626,9 +1590,7 @@ bool FrameLoader::canCachePageContainingThisFrame()
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
         && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
-#endif
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
@@ -1636,7 +1598,7 @@ bool FrameLoader::canCachePageContainingThisFrame()
         && !SharedWorkerRepository::hasSharedWorkers(m_frame->document())
 #endif
         && !m_frame->document()->usingGeolocation()
-        && m_currentHistoryItem
+        && history()->currentItem()
         && !m_quickRedirectComing
         && !m_documentLoader->isLoadingInAPISense()
         && !m_documentLoader->isStopping()
@@ -1773,10 +1735,8 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
             { PCLOG("   -Frame contains plugins"); cannotCache = true; }
         if (m_URL.protocolIs("https"))
             { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
-#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
         if (m_frame->domWindow() && m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
             { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
-#endif
 #if ENABLE(DATABASE)
         if (m_frame->document()->hasOpenDatabases())
             { PCLOG("   -Frame has open database handles"); cannotCache = true; }
@@ -1787,7 +1747,7 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
 #endif
         if (m_frame->document()->usingGeolocation())
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
-        if (!m_currentHistoryItem)
+        if (!history()->currentItem())
             { PCLOG("   -No current history item"); cannotCache = true; }
         if (m_quickRedirectComing)
             { PCLOG("   -Quick redirect is coming"); cannotCache = true; }
@@ -1865,12 +1825,13 @@ void FrameLoader::scrollToAnchor(const KURL& url)
     }
     
     m_URL = url;
-    updateHistoryForAnchorScroll();
+    history()->updateForAnchorScroll();
 
     // If we were in the autoscroll/panScroll mode we want to stop it before following the link to the anchor
     m_frame->eventHandler()->stopAutoscrollTimer();
     started();
-    gotoAnchor();
+    if (FrameView* view = m_frame->view())
+        view->scrollToFragment(m_URL);
 
     // It's important to model this as a load that starts and immediately finishes.
     // Otherwise, the parent frame may think we never finished loading.
@@ -1886,10 +1847,13 @@ bool FrameLoader::isComplete() const
 void FrameLoader::completed()
 {
     RefPtr<Frame> protect(m_frame);
-    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->redirectScheduler()->startTimer();
+
+    for (Frame* descendant = m_frame->tree()->traverseNext(m_frame); descendant; descendant = descendant->tree()->traverseNext(m_frame))
+        descendant->redirectScheduler()->startTimer();
+    
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
+
     if (m_frame->view())
         m_frame->view()->maintainScrollPositionAtAnchor(0);
 }
@@ -1941,7 +1905,7 @@ static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 }
 
 void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
-    PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+    PassRefPtr<Event> event, PassRefPtr<FormState> formState, ReferrerPolicy referrerPolicy)
 {    
     KURL url = request.resourceRequest().url();
 
@@ -1960,7 +1924,7 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
         }
     }
 
-    if (SecurityOrigin::shouldHideReferrer(url, referrer))
+    if (SecurityOrigin::shouldHideReferrer(url, referrer) || referrerPolicy == NoReferrer)
         referrer = String();
     
     FrameLoadType loadType;
@@ -2182,6 +2146,13 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
         if (loader->triggeringAction().isEmpty())
             loader->setTriggeringAction(NavigationAction(newURL, policyChecker()->loadType(), isFormSubmission));
 
+        if (Element* ownerElement = m_frame->document()->ownerElement()) {
+            if (!ownerElement->dispatchBeforeLoadEvent(loader->request().url().string())) {
+                continueLoadAfterNavigationPolicy(loader->request(), formState, false);
+                return;
+            }
+        }
+
         policyChecker()->checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
     }
@@ -2208,15 +2179,12 @@ void FrameLoader::receivedData(const char* data, int length)
 
 bool FrameLoader::willLoadMediaElementURL(KURL& url)
 {
-    if (!m_client->shouldLoadMediaElementURL(url))
-        return false;
-
     ResourceRequest request(url);
 
     unsigned long identifier;
     ResourceError error;
     requestFromDelegate(request, identifier, error);
-    sendRemainingDelegateMessages(identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
 
     url = request.url();
 
@@ -2532,7 +2500,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
-    cachePageForHistoryItem(m_currentHistoryItem.get());
+    cachePageForHistoryItem(history()->currentItem());
     
     if (m_loadType != FrameLoadTypeReplace)
         closeOldDataSources();
@@ -2566,7 +2534,7 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
 
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
-        updateHistoryForClientRedirect();
+        history()->updateForClientRedirect();
 
     if (m_loadingFromCachedPage) {
         m_frame->document()->documentDidBecomeActive();
@@ -2586,10 +2554,10 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
             // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
             // However, with today's computers and networking speeds, this won't happen in practice.
             // Could be an issue with a giant local file.
-            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
+            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), error);
         }
         
-        pageCache()->remove(m_currentHistoryItem.get());
+        pageCache()->remove(history()->currentItem());
 
         m_documentLoader->setPrimaryLoadComplete(true);
 
@@ -2607,7 +2575,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         return;
 
     m_client->setCopiesOnScroll();
-    updateHistoryForCommit();
+    history()->updateForCommit();
 
     // The call to closeURL() invokes the unload event handler, which can execute arbitrary
     // JavaScript. If the script initiates a new load, we need to abandon the current load,
@@ -2639,7 +2607,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeIndexedBackForward:
             if (Page* page = m_frame->page())
                 if (page->backForwardList()) {
-                    updateHistoryForBackForwardNavigation();
+                    history()->updateForBackForwardNavigation();
 
                     // Create a document view for this document, or used the cached view.
                     if (cachedPage) {
@@ -2657,12 +2625,12 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
         case FrameLoadTypeReplace:
-            updateHistoryForReload();
+            history()->updateForReload();
             m_client->transitionToCommittedForNewPage();
             break;
 
         case FrameLoadTypeStandard:
-            updateHistoryForStandardLoad();
+            history()->updateForStandardLoad();
 #ifndef BUILDING_ON_TIGER
             // This code was originally added for a Leopard performance imporvement. We decided to 
             // ifdef it to fix correctness issues on Tiger documented in <rdar://problem/5441823>.
@@ -2673,7 +2641,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             break;
 
         case FrameLoadTypeRedirectWithLockedBackForwardList:
-            updateHistoryForRedirectWithLockedBackForwardList();
+            history()->updateForRedirectWithLockedBackForwardList();
             m_client->transitionToCommittedForNewPage();
             break;
 
@@ -2922,6 +2890,8 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     loader->setParsedArchiveData(mainResource->data());
 
     m_responseMIMEType = mainResource->mimeType();
+
+    closeURL();
     didOpenURL(mainResource->url());
 
     String userChosenEncoding = documentLoader()->overrideEncoding();
@@ -3026,7 +2996,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             RefPtr<HistoryItem> item;
             if (Page* page = m_frame->page())
                 if (isBackForwardLoadType(loadType()) && m_frame == page->mainFrame())
-                    item = m_currentHistoryItem;
+                    item = history()->currentItem();
                 
             bool shouldReset = true;
             if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
@@ -3075,7 +3045,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
             // If the user had a scroll point, scroll to it, overriding the anchor point if any.
             if (Page* page = m_frame->page())
                 if ((isBackForwardLoadType(m_loadType) || m_loadType == FrameLoadTypeReload || m_loadType == FrameLoadTypeReloadFromOrigin) && page->backForwardList())
-                    restoreScrollPositionAndViewState();
+                    history()->restoreScrollPositionAndViewState();
 
             if (m_creatingInitialEmptyDocument || !m_committedFirstRealDocumentLoad)
                 return;
@@ -3131,7 +3101,7 @@ void FrameLoader::continueLoadAfterWillSubmitForm()
 
     if (Page* page = m_frame->page()) {
         identifier = page->progress()->createUniqueIdentifier();
-        dispatchAssignIdentifierToInitialRequest(identifier, m_provisionalDocumentLoader.get(), m_provisionalDocumentLoader->originalRequest());
+        notifier()->assignIdentifierToInitialRequest(identifier, m_provisionalDocumentLoader.get(), m_provisionalDocumentLoader->originalRequest());
     }
 
     if (!m_provisionalDocumentLoader->startLoadingMainResource(identifier))
@@ -3142,7 +3112,7 @@ void FrameLoader::didFirstLayout()
 {
     if (Page* page = m_frame->page())
         if (isBackForwardLoadType(m_loadType) && page->backForwardList())
-            restoreScrollPositionAndViewState();
+            history()->restoreScrollPositionAndViewState();
 
     m_firstLayoutDone = true;
     m_client->dispatchDidFirstLayout();
@@ -3159,9 +3129,7 @@ void FrameLoader::frameLoadCompleted()
 
     m_client->frameLoadCompleted();
 
-    // Even if already complete, we might have set a previous item on a frame that
-    // didn't do any data loading on the past transaction. Make sure to clear these out.
-    m_previousHistoryItem = 0;
+    history()->updateForFrameLoadCompleted();
 
     // After a canceled provisional load, firstLayoutDone is false.
     // Reset it to true if we're displaying a page.
@@ -3262,7 +3230,7 @@ void FrameLoader::detachFromParent()
 
     closeURL();
     stopAllLoaders();
-    saveScrollPositionAndViewStateToItem(currentHistoryItem());
+    history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
     detachChildren();
 
 #if ENABLE(INSPECTOR)
@@ -3457,49 +3425,9 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         }
 #endif
     }
-    
-    sendRemainingDelegateMessages(identifier, response, data.size(), error);
-    return identifier;
-}
-
-void FrameLoader::assignIdentifierToInitialRequest(unsigned long identifier, const ResourceRequest& clientRequest)
-{
-    return dispatchAssignIdentifierToInitialRequest(identifier, activeDocumentLoader(), clientRequest);
-}
-
-void FrameLoader::willSendRequest(ResourceLoader* loader, ResourceRequest& clientRequest, const ResourceResponse& redirectResponse)
-{
-    applyUserAgent(clientRequest);
-    dispatchWillSendRequest(loader->documentLoader(), loader->identifier(), clientRequest, redirectResponse);
-}
-
-void FrameLoader::didReceiveResponse(ResourceLoader* loader, const ResourceResponse& r)
-{
-    activeDocumentLoader()->addResponse(r);
-    
-    if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), r);
-    dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
-}
-
-void FrameLoader::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
-{
-    if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), data, length);
-    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
-}
-
-void FrameLoader::didFailToLoad(ResourceLoader* loader, const ResourceError& error)
-{
-    if (Page* page = m_frame->page())
-        page->progress()->completeProgress(loader->identifier());
-    if (!error.isNull())
-        m_client->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
-}
 
-void FrameLoader::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
-{
-    m_client->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), error);
+    return identifier;
 }
 
 const ResourceRequest& FrameLoader::originalRequest() const
@@ -3513,7 +3441,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
     RefPtr<Frame> protect(m_frame);
 
     RefPtr<DocumentLoader> loader = activeDocumentLoader();
-    
+
     if (isComplete) {
         // FIXME: Don't want to do this if an entirely new load is going, so should check
         // that both data sources on the frame are either this or nil.
@@ -3521,7 +3449,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         if (m_client->shouldFallBack(error))
             handleFallbackContent();
     }
-    
+
     if (m_state == FrameStateProvisional && m_provisionalDocumentLoader) {
         if (m_submittedFormURL == m_provisionalDocumentLoader->originalRequestCopy().url())
             m_submittedFormURL = KURL();
@@ -3529,7 +3457,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         // We might have made a page cache item, but now we're bailing out due to an error before we ever
         // transitioned to the new page (before WebFrameState == commit).  The goal here is to restore any state
         // so that the existing view (that wenever got far enough to replace) can continue being used.
-        invalidateCurrentItemCachedPage();
+        history()->invalidateCurrentItemCachedPage();
         
         // Call clientRedirectCancelledOrFinished here so that the frame load delegate is notified that the redirect's
         // status has changed, if there was a redirect. The frame load delegate may have saved some state about
@@ -3539,8 +3467,7 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
         if (m_sentRedirectNotification)
             clientRedirectCancelledOrFinished(false);
     }
-    
-    
+
     loader->mainReceivedError(error, isComplete);
 }
 
@@ -3581,7 +3508,7 @@ void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequ
         // we have already saved away the scroll and doc state for the long slow load,
         // but it's not an obvious case.
 
-        addHistoryItemForFragmentScroll();
+        history()->updateBackForwardListForFragmentScroll();
     }
     
     scrollToAnchor(url);
@@ -3630,7 +3557,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     // through this method already, nested; otherwise, policyDataSource should still be set.
     ASSERT(m_policyDocumentLoader || !m_provisionalDocumentLoader->unreachableURL().isEmpty());
 
-    bool isTargetItem = m_provisionalHistoryItem ? m_provisionalHistoryItem->isTargetItem() : false;
+    bool isTargetItem = history()->provisionalItem() ? history()->provisionalItem()->isTargetItem() : false;
 
     // Two reasons we can't continue:
     //    1) Navigation policy delegate said we can't so request is nil. A primary case of this 
@@ -3653,7 +3580,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(policyChecker()->loadType()))
             if (Page* page = m_frame->page()) {
                 Frame* mainFrame = page->mainFrame();
-                if (HistoryItem* resetItem = mainFrame->loader()->m_currentHistoryItem.get()) {
+                if (HistoryItem* resetItem = mainFrame->loader()->history()->currentItem()) {
                     page->backForwardList()->goToItem(resetItem);
                     Settings* settings = m_frame->settings();
                     page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : resetItem);
@@ -3715,24 +3642,11 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
 
     mainFrame->page()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
-    mainFrame->loader()->setOpener(frame.get());
+    if (!m_suppressOpenerInNewFrame)
+        mainFrame->loader()->setOpener(frame.get());
     mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
 }
 
-void FrameLoader::sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
-{    
-    if (!response.isNull())
-        dispatchDidReceiveResponse(m_documentLoader.get(), identifier, response);
-    
-    if (length > 0)
-        dispatchDidReceiveContentLength(m_documentLoader.get(), identifier, length);
-    
-    if (error.isNull())
-        dispatchDidFinishLoading(m_documentLoader.get(), identifier);
-    else
-        m_client->dispatchDidFailLoading(m_documentLoader.get(), identifier, error);
-}
-
 void FrameLoader::requestFromDelegate(ResourceRequest& request, unsigned long& identifier, ResourceError& error)
 {
     ASSERT(!request.isNull());
@@ -3740,11 +3654,11 @@ void FrameLoader::requestFromDelegate(ResourceRequest& request, unsigned long& i
     identifier = 0;
     if (Page* page = m_frame->page()) {
         identifier = page->progress()->createUniqueIdentifier();
-        dispatchAssignIdentifierToInitialRequest(identifier, m_documentLoader.get(), request);
+        notifier()->assignIdentifierToInitialRequest(identifier, m_documentLoader.get(), request);
     }
 
     ResourceRequest newRequest(request);
-    dispatchWillSendRequest(m_documentLoader.get(), identifier, newRequest, ResourceResponse());
+    notifier()->dispatchWillSendRequest(m_documentLoader.get(), identifier, newRequest, ResourceResponse());
 
     if (newRequest.isNull())
         error = cancelledError(request);
@@ -3782,7 +3696,7 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     unsigned long identifier;
     ResourceError error;
     requestFromDelegate(request, identifier, error);
-    sendRemainingDelegateMessages(identifier, resource->response(), resource->encodedSize(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), error);
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
@@ -3810,14 +3724,9 @@ bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, con
     return false;
 }
 
-void FrameLoader::addHistoryItemForFragmentScroll()
-{
-    addBackForwardItemClippedAtTarget(false);
-}
-
 bool FrameLoader::loadProvisionalItemFromCachedPage()
 {
-    RefPtr<CachedPage> cachedPage = pageCache()->get(m_provisionalHistoryItem.get());
+    RefPtr<CachedPage> cachedPage = pageCache()->get(history()->provisionalItem());
     if (!cachedPage || !cachedPage->document())
         return false;
 
@@ -3861,119 +3770,21 @@ void FrameLoader::pageHidden()
 
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const
 {
-    if (!m_currentHistoryItem)
+    if (!history()->currentItem())
         return false;
-    return url == m_currentHistoryItem->url() || url == m_currentHistoryItem->originalURL();
-}
-
-PassRefPtr<HistoryItem> FrameLoader::createHistoryItem(bool useOriginal)
-{
-    DocumentLoader* docLoader = documentLoader();
-    
-    KURL unreachableURL = docLoader ? docLoader->unreachableURL() : KURL();
-    
-    KURL url;
-    KURL originalURL;
-
-    if (!unreachableURL.isEmpty()) {
-        url = unreachableURL;
-        originalURL = unreachableURL;
-    } else {
-        originalURL = docLoader ? docLoader->originalURL() : KURL();
-        if (useOriginal)
-            url = originalURL;
-        else if (docLoader)
-            url = docLoader->requestURL();
-    }
-
-    LOG(History, "WebCoreHistory: Creating item for %s", url.string().ascii().data());
-    
-    // Frames that have never successfully loaded any content
-    // may have no URL at all. Currently our history code can't
-    // deal with such things, so we nip that in the bud here.
-    // Later we may want to learn to live with nil for URL.
-    // See bug 3368236 and related bugs for more information.
-    if (url.isEmpty()) 
-        url = blankURL();
-    if (originalURL.isEmpty())
-        originalURL = blankURL();
-    
-    Frame* parentFrame = m_frame->tree()->parent();
-    String parent = parentFrame ? parentFrame->tree()->name() : "";
-    String title = docLoader ? docLoader->title() : "";
-
-    RefPtr<HistoryItem> item = HistoryItem::create(url, m_frame->tree()->name(), parent, title);
-    item->setOriginalURLString(originalURL.string());
-
-    if (!unreachableURL.isEmpty() || !docLoader || docLoader->response().httpStatusCode() >= 400)
-        item->setLastVisitWasFailure(true);
-
-    // Save form state if this is a POST
-    if (docLoader) {
-        if (useOriginal)
-            item->setFormInfoFromRequest(docLoader->originalRequest());
-        else
-            item->setFormInfoFromRequest(docLoader->request());
-    }
-    
-    // Set the item for which we will save document state
-    m_previousHistoryItem = m_currentHistoryItem;
-    m_currentHistoryItem = item;
-    
-    return item.release();
+    return url == history()->currentItem()->url() || url == history()->currentItem()->originalURL();
 }
 
-void FrameLoader::addBackForwardItemClippedAtTarget(bool doClip)
+void FrameLoader::checkDidPerformFirstNavigation()
 {
-    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
-    // The item that was the target of the user's navigation is designated as the "targetItem".  
-    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
-    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
-
     Page* page = m_frame->page();
     if (!page)
         return;
 
-    if (documentLoader()->urlForHistory().isEmpty())
-        return;
-
-    Frame* mainFrame = page->mainFrame();
-    ASSERT(mainFrame);
-    FrameLoader* frameLoader = mainFrame->loader();
-
-    if (!frameLoader->m_didPerformFirstNavigation && page->backForwardList()->entries().size() == 1) {
-        frameLoader->m_didPerformFirstNavigation = true;
+    if (!m_didPerformFirstNavigation && page->backForwardList()->entries().size() == 1) {
+        m_didPerformFirstNavigation = true;
         m_client->didPerformFirstNavigation();
     }
-
-    RefPtr<HistoryItem> item = frameLoader->createHistoryItemTree(m_frame, doClip);
-    LOG(BackForward, "WebCoreBackForward - Adding backforward item %p for frame %s", item.get(), documentLoader()->url().string().ascii().data());
-    page->backForwardList()->addItem(item);
-}
-
-PassRefPtr<HistoryItem> FrameLoader::createHistoryItemTree(Frame* targetFrame, bool clipAtTarget)
-{
-    RefPtr<HistoryItem> bfItem = createHistoryItem(m_frame->tree()->parent() ? true : false);
-    if (m_previousHistoryItem)
-        saveScrollPositionAndViewStateToItem(m_previousHistoryItem.get());
-    if (!(clipAtTarget && m_frame == targetFrame)) {
-        // save frame state for items that aren't loading (khtml doesn't save those)
-        saveDocumentState();
-        for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
-            FrameLoader* childLoader = child->loader();
-            bool hasChildLoaded = childLoader->frameHasLoaded();
-            
-            // If the child is a frame corresponding to an <object> element that never loaded,
-            // we don't want to create a history item, because that causes fallback content
-            // to be ignored on reload.
-            
-            if (!(!hasChildLoaded && childLoader->isHostedByObjectElement()))
-                bfItem->addChildItem(childLoader->createHistoryItemTree(targetFrame, clipAtTarget));
-        }
-    }
-    if (m_frame == targetFrame)
-        bfItem->setIsTargetItem(true);
-    return bfItem;
 }
 
 Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
@@ -3984,100 +3795,10 @@ Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
     return frame;
 }
 
-void FrameLoader::saveScrollPositionAndViewStateToItem(HistoryItem* item)
-{
-    if (!item || !m_frame->view())
-        return;
-        
-    item->setScrollPoint(m_frame->view()->scrollPosition());
-    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
-    m_client->saveViewStateToItem(item);
-}
-
-/*
- There is a race condition between the layout and load completion that affects restoring the scroll position.
- We try to restore the scroll position at both the first layout and upon load completion.
- 
- 1) If first layout happens before the load completes, we want to restore the scroll position then so that the
- first time we draw the page is already scrolled to the right place, instead of starting at the top and later
- jumping down.  It is possible that the old scroll position is past the part of the doc laid out so far, in
- which case the restore silent fails and we will fix it in when we try to restore on doc completion.
- 2) If the layout happens after the load completes, the attempt to restore at load completion time silently
- fails.  We then successfully restore it when the layout happens.
-*/
-void FrameLoader::restoreScrollPositionAndViewState()
-{
-    if (!m_committedFirstRealDocumentLoad)
-        return;
-
-    ASSERT(m_currentHistoryItem);
-    
-    // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
-    // One counterexample is <rdar://problem/4917290>
-    // For now, to cover this issue in release builds, there is no technical harm to returning
-    // early and from a user standpoint - as in the above radar - the previous page load failed 
-    // so there *is* no scroll or view state to restore!
-    if (!m_currentHistoryItem)
-        return;
-    
-    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling
-    // through to the client. It's currently used only for the PDF view on Mac.
-    m_client->restoreViewState();
-    
-    if (FrameView* view = m_frame->view())
-        if (!view->wasScrolledByUser())
-            view->setScrollPosition(m_currentHistoryItem->scrollPoint());
-}
-
-void FrameLoader::invalidateCurrentItemCachedPage()
-{
-    // When we are pre-commit, the currentItem is where the pageCache data resides    
-    CachedPage* cachedPage = pageCache()->get(m_currentHistoryItem.get());
-
-    // FIXME: This is a grotesque hack to fix <rdar://problem/4059059> Crash in RenderFlow::detach
-    // Somehow the PageState object is not properly updated, and is holding onto a stale document.
-    // Both Xcode and FileMaker see this crash, Safari does not.
-    
-    ASSERT(!cachedPage || cachedPage->document() == m_frame->document());
-    if (cachedPage && cachedPage->document() == m_frame->document()) {
-        cachedPage->document()->setInPageCache(false);
-        cachedPage->clear();
-    }
-    
-    if (cachedPage)
-        pageCache()->remove(m_currentHistoryItem.get());
-}
-
-void FrameLoader::saveDocumentState()
-{
-    if (m_creatingInitialEmptyDocument)
-        return;
-
-    // For a standard page load, we will have a previous item set, which will be used to
-    // store the form state.  However, in some cases we will have no previous item, and
-    // the current item is the right place to save the state.  One example is when we
-    // detach a bunch of frames because we are navigating from a site with frames to
-    // another site.  Another is when saving the frame state of a frame that is not the
-    // target of the current navigation (if we even decide to save with that granularity).
-
-    // Because of previousItem's "masking" of currentItem for this purpose, it's important
-    // that previousItem be cleared at the end of a page transition.  We leverage the
-    // checkLoadComplete recursion to achieve this goal.
-
-    HistoryItem* item = m_previousHistoryItem ? m_previousHistoryItem.get() : m_currentHistoryItem.get();
-    if (!item)
-        return;
-
-    Document* document = m_frame->document();
-    ASSERT(document);
-    
-    if (item->isCurrentDocument(document)) {
-        LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
-        item->setDocumentState(document->formElementsState());
-    }
-}
-
 // Loads content into this frame, as specified by history item
+// FIXME: This function should really be split into a couple pieces, some of
+// which should be methods of HistoryController and some of which should be
+// methods of FrameLoader.
 void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 {
     if (!m_frame->page())
@@ -4096,7 +3817,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     // check for all that as an additional optimization.
     // We also do not do anchor-style navigation if we're posting a form or navigating from
     // a page that was resulted from a form post.
-    bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
+    bool shouldScroll = !formData && !(history()->currentItem() && history()->currentItem()->formData()) && history()->urlsMatchItem(item);
 
 #if ENABLE(WML)
     // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
@@ -4106,12 +3827,12 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 
     if (shouldScroll) {
         // Must do this maintenance here, since we don't go through a real page reload
-        saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
+        history()->saveScrollPositionAndViewStateToItem(history()->currentItem());
 
         if (FrameView* view = m_frame->view())
             view->setWasScrolledByUser(false);
 
-        m_currentHistoryItem = item;
+        history()->setCurrentItem(item);
 
         // FIXME: Form state might need to be saved here too.
 
@@ -4120,7 +3841,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         scrollToAnchor(item->url());
     
         // must do this maintenance here, since we don't go through a real page reload
-        restoreScrollPositionAndViewState();
+        history()->restoreScrollPositionAndViewState();
         
         // Fake the URL change by updating the data source's request.  This will no longer
         // be necessary if we do the better fix described above.
@@ -4132,7 +3853,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
         m_client->didFinishLoad();
     } else {
         // Remember this item so we can traverse any child items as child frames load
-        m_provisionalHistoryItem = item;
+        history()->setProvisionalItem(item);
 
         bool inPageCache = false;
         
@@ -4149,7 +3870,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 loadWithDocumentLoader(cachedPage->documentLoader(), loadType, 0);   
                 inPageCache = true;
             } else {
-                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", m_provisionalHistoryItem->url().string().ascii().data());
+                LOG(PageCache, "Not restoring page for %s from back/forward cache because cache entry has expired", history()->provisionalItem()->url().string().ascii().data());
                 pageCache()->remove(item);
             }
         }
@@ -4224,322 +3945,6 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     }
 }
 
-// Walk the frame tree and ensure that the URLs match the URLs in the item.
-bool FrameLoader::urlsMatchItem(HistoryItem* item) const
-{
-    const KURL& currentURL = documentLoader()->url();
-    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
-        return false;
-
-    const HistoryItemVector& childItems = item->children();
-
-    unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i) {
-        Frame* childFrame = m_frame->tree()->child(childItems[i]->target());
-        if (childFrame && !childFrame->loader()->urlsMatchItem(childItems[i].get()))
-            return false;
-    }
-
-    return true;
-}
-
-// Main funnel for navigating to a previous location (back/forward, non-search snap-back)
-// This includes recursion to handle loading into framesets properly
-void FrameLoader::goToItem(HistoryItem* targetItem, FrameLoadType type)
-{
-    ASSERT(!m_frame->tree()->parent());
-    
-    // shouldGoToHistoryItem is a private delegate method. This is needed to fix:
-    // <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
-    // Ultimately, history item navigations should go through the policy delegate. That's covered in:
-    // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    if (!m_client->shouldGoToHistoryItem(targetItem))
-        return;
-
-    // Set the BF cursor before commit, which lets the user quickly click back/forward again.
-    // - plus, it only makes sense for the top level of the operation through the frametree,
-    // as opposed to happening for some/one of the page commits that might happen soon
-    BackForwardList* bfList = page->backForwardList();
-    HistoryItem* currentItem = bfList->currentItem();    
-    bfList->goToItem(targetItem);
-    Settings* settings = m_frame->settings();
-    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
-    recursiveGoToItem(targetItem, currentItem, type);
-}
-
-// The general idea here is to traverse the frame tree and the item tree in parallel,
-// tracking whether each frame already has the content the item requests.  If there is
-// a match (by URL), we just restore scroll position and recurse.  Otherwise we must
-// reload that frame, and all its kids.
-void FrameLoader::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, FrameLoadType type)
-{
-    ASSERT(item);
-    ASSERT(fromItem);
-    
-    KURL itemURL = item->url();
-    KURL currentURL;
-    if (documentLoader())
-        currentURL = documentLoader()->url();
-    
-    // Always reload the target frame of the item we're going to.  This ensures that we will
-    // do -some- load for the transition, which means a proper notification will be posted
-    // to the app.
-    // The exact URL has to match, including fragment.  We want to go through the _load
-    // method, even if to do a within-page navigation.
-    // The current frame tree and the frame tree snapshot in the item have to match.
-    if (!item->isTargetItem() &&
-        itemURL == currentURL &&
-        ((m_frame->tree()->name().isEmpty() && item->target().isEmpty()) || m_frame->tree()->name() == item->target()) &&
-        childFramesMatchItem(item))
-    {
-        // This content is good, so leave it alone and look for children that need reloading
-        // Save form state (works from currentItem, since prevItem is nil)
-        ASSERT(!m_previousHistoryItem);
-        saveDocumentState();
-        saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
-
-        if (FrameView* view = m_frame->view())
-            view->setWasScrolledByUser(false);
-
-        m_currentHistoryItem = item;
-                
-        // Restore form state (works from currentItem)
-        restoreDocumentState();
-        
-        // Restore the scroll position (we choose to do this rather than going back to the anchor point)
-        restoreScrollPositionAndViewState();
-        
-        const HistoryItemVector& childItems = item->children();
-        
-        int size = childItems.size();
-        for (int i = 0; i < size; ++i) {
-            String childFrameName = childItems[i]->target();
-            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
-            ASSERT(fromChildItem || fromItem->isTargetItem());
-            Frame* childFrame = m_frame->tree()->child(childFrameName);
-            ASSERT(childFrame);
-            childFrame->loader()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
-        }
-    } else {
-        loadItem(item, type);
-    }
-}
-
-// helper method that determines whether the subframes described by the item's subitems
-// match our own current frameset
-bool FrameLoader::childFramesMatchItem(HistoryItem* item) const
-{
-    const HistoryItemVector& childItems = item->children();
-    if (childItems.size() != m_frame->tree()->childCount())
-        return false;
-    
-    unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i) {
-        if (!m_frame->tree()->child(childItems[i]->target()))
-            return false;
-    }
-    
-    // Found matches for all item targets
-    return true;
-}
-
-// There are 3 things you might think of as "history", all of which are handled by these functions.
-//
-//     1) Back/forward: The m_currentHistoryItem is part of this mechanism.
-//     2) Global history: Handled by the client.
-//     3) Visited links: Handled by the PageGroup.
-
-void FrameLoader::updateHistoryForStandardLoad()
-{
-    LOG(History, "WebCoreHistory: Updating History for Standard Load in frame %s", documentLoader()->url().string().ascii().data());
-
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (!documentLoader()->isClientRedirect()) {
-        if (!historyURL.isEmpty()) {
-            addBackForwardItemClippedAtTarget(true);
-            if (!needPrivacy) {
-                m_client->updateGlobalHistory();
-                m_documentLoader->setDidCreateGlobalHistoryEntry(true);
-                if (m_documentLoader->unreachableURL().isEmpty())
-                    m_client->updateGlobalHistoryRedirectLinks();
-            }
-            if (Page* page = m_frame->page())
-                page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
-        }
-    } else if (documentLoader()->unreachableURL().isEmpty() && m_currentHistoryItem) {
-        m_currentHistoryItem->setURL(documentLoader()->url());
-        m_currentHistoryItem->setFormInfoFromRequest(documentLoader()->request());
-    }
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-
-        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
-            m_client->updateGlobalHistoryRedirectLinks();
-    }
-}
-
-void FrameLoader::updateHistoryForClientRedirect()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
-    // webcore has closed the URL and saved away the form state.
-    if (m_currentHistoryItem) {
-        m_currentHistoryItem->clearDocumentState();
-        m_currentHistoryItem->clearScrollPoint();
-    }
-
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-    }
-}
-
-void FrameLoader::updateHistoryForBackForwardNavigation()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    // Must grab the current scroll position before disturbing it
-    saveScrollPositionAndViewStateToItem(m_previousHistoryItem.get());
-}
-
-void FrameLoader::updateHistoryForReload()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", documentLoader()->title().utf8().data());
-#endif
-
-    if (m_currentHistoryItem) {
-        pageCache()->remove(m_currentHistoryItem.get());
-    
-        if (loadType() == FrameLoadTypeReload || loadType() == FrameLoadTypeReloadFromOrigin)
-            saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
-    
-        // Sometimes loading a page again leads to a different result because of cookies. Bugzilla 4072
-        if (documentLoader()->unreachableURL().isEmpty())
-            m_currentHistoryItem->setURL(documentLoader()->requestURL());
-    }
-}
-
-void FrameLoader::updateHistoryForRedirectWithLockedBackForwardList()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", documentLoader()->title().utf8().data());
-#endif
-    
-    Settings* settings = m_frame->settings();
-    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
-    const KURL& historyURL = documentLoader()->urlForHistory();
-
-    if (documentLoader()->isClientRedirect()) {
-        if (!m_currentHistoryItem && !m_frame->tree()->parent()) {
-            if (!historyURL.isEmpty()) {
-                addBackForwardItemClippedAtTarget(true);
-                if (!needPrivacy) {
-                    m_client->updateGlobalHistory();
-                    m_documentLoader->setDidCreateGlobalHistoryEntry(true);
-                    if (m_documentLoader->unreachableURL().isEmpty())
-                        m_client->updateGlobalHistoryRedirectLinks();
-                }
-                if (Page* page = m_frame->page())
-                    page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
-            }
-        }
-        if (m_currentHistoryItem) {
-            m_currentHistoryItem->setURL(documentLoader()->url());
-            m_currentHistoryItem->setFormInfoFromRequest(documentLoader()->request());
-        }
-    } else {
-        Frame* parentFrame = m_frame->tree()->parent();
-        if (parentFrame && parentFrame->loader()->m_currentHistoryItem)
-            parentFrame->loader()->m_currentHistoryItem->setChildItem(createHistoryItem(true));
-    }
-
-    if (!historyURL.isEmpty() && !needPrivacy) {
-        if (Page* page = m_frame->page())
-            page->group().addVisitedLink(historyURL);
-
-        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
-            m_client->updateGlobalHistoryRedirectLinks();
-    }
-}
-
-void FrameLoader::updateHistoryForCommit()
-{
-#if !LOG_DISABLED
-    if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", documentLoader()->title().utf8().data());
-#endif
-    FrameLoadType type = loadType();
-    if (isBackForwardLoadType(type) ||
-        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !provisionalDocumentLoader()->unreachableURL().isEmpty())) {
-        // Once committed, we want to use current item for saving DocState, and
-        // the provisional item for restoring state.
-        // Note previousItem must be set before we close the URL, which will
-        // happen when the data source is made non-provisional below
-        m_previousHistoryItem = m_currentHistoryItem;
-        ASSERT(m_provisionalHistoryItem);
-        m_currentHistoryItem = m_provisionalHistoryItem;
-        m_provisionalHistoryItem = 0;
-    }
-}
-
-void FrameLoader::updateHistoryForAnchorScroll()
-{
-    if (m_URL.isEmpty())
-        return;
-
-    Settings* settings = m_frame->settings();
-    if (!settings || settings->privateBrowsingEnabled())
-        return;
-
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-
-    page->group().addVisitedLink(m_URL);
-}
-
-// Walk the frame tree, telling all frames to save their form state into their current
-// history item.
-void FrameLoader::saveDocumentAndScrollState()
-{
-    for (Frame* frame = m_frame; frame; frame = frame->tree()->traverseNext(m_frame)) {
-        frame->loader()->saveDocumentState();
-        frame->loader()->saveScrollPositionAndViewStateToItem(frame->loader()->currentHistoryItem());
-    }
-}
-
-HistoryItem* FrameLoader::currentHistoryItem()
-{
-    return m_currentHistoryItem.get();
-}
-
-void FrameLoader::setCurrentHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_currentHistoryItem = item;
-}
-
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
 {
     m_client->setMainDocumentError(loader, error);
@@ -4581,28 +3986,11 @@ ResourceError FrameLoader::fileDoesNotExistError(const ResourceResponse& respons
     return m_client->fileDoesNotExistError(response);    
 }
 
-void FrameLoader::didFinishLoad(ResourceLoader* loader)
-{    
-    if (Page* page = m_frame->page())
-        page->progress()->completeProgress(loader->identifier());
-    dispatchDidFinishLoading(loader->documentLoader(), loader->identifier());
-}
-
 bool FrameLoader::shouldUseCredentialStorage(ResourceLoader* loader)
 {
     return m_client->shouldUseCredentialStorage(loader->documentLoader(), loader->identifier());
 }
 
-void FrameLoader::didReceiveAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
-{
-    m_client->dispatchDidReceiveAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
-}
-
-void FrameLoader::didCancelAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
-{
-    m_client->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
-}
-
 void FrameLoader::setTitle(const String& title)
 {
     documentLoader()->setTitle(title);
@@ -4626,7 +4014,8 @@ void FrameLoader::dispatchDocumentElementAvailable()
 
 void FrameLoader::dispatchWindowObjectAvailable()
 {
-    if (!m_frame->script()->isEnabled() || !m_frame->script()->haveWindowShell())
+    // FIXME: should this be isolated-worlds-aware?
+    if (!m_frame->script()->isEnabled() || !m_frame->script()->existingWindowShell(mainThreadNormalWorld()))
         return;
 
     m_client->windowObjectCleared();
@@ -4683,8 +4072,7 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
 
     if (loader == m_documentLoader) {
         // Must update the entries in the back-forward list too.
-        if (m_currentHistoryItem)
-            m_currentHistoryItem->setTitle(loader->title());
+        history()->setCurrentItemTitle(loader->title());
         // This must go through the WebFrame because it has the right notion of the current b/f item.
         m_client->setTitle(loader->title(), loader->urlForHistory());
         m_client->setMainFrameDocumentReady(true); // update observers with new DOMDocument
@@ -4709,63 +4097,6 @@ void FrameLoader::dispatchDidCommitLoad()
 #endif
 }
 
-void FrameLoader::dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-    m_client->assignIdentifierToInitialRequest(identifier, loader, request);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
-#endif
-}
-
-void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
-{
-    StringImpl* oldRequestURL = request.url().string().impl();
-    m_documentLoader->didTellClientAboutLoad(request.url());
-
-    m_client->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
-
-    // If the URL changed, then we want to put that new URL in the "did tell client" set too.
-    if (!request.isNull() && oldRequestURL != request.url().string().impl())
-        m_documentLoader->didTellClientAboutLoad(request.url());
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
-#endif
-}
-
-void FrameLoader::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
-{
-    m_client->dispatchDidReceiveResponse(loader, identifier, r);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(loader, identifier, r);
-#endif
-}
-
-void FrameLoader::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
-{
-    m_client->dispatchDidReceiveContentLength(loader, identifier, length);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
-#endif
-}
-
-void FrameLoader::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
-{
-    m_client->dispatchDidFinishLoading(loader, identifier);
-
-#if ENABLE(INSPECTOR)
-    if (Page* page = m_frame->page())
-        page->inspectorController()->didFinishLoading(loader, identifier);
-#endif
-}
-
 void FrameLoader::tellClientAboutPastMemoryCacheLoads()
 {
     ASSERT(m_frame->page());
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 9ea3775..1323089 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,9 +33,11 @@
 
 #include "CachePolicy.h"
 #include "FrameLoaderTypes.h"
+#include "HistoryController.h"
 #include "PolicyCallback.h"
 #include "PolicyChecker.h"
 #include "RedirectScheduler.h"
+#include "ResourceLoadNotifier.h"
 #include "ResourceRequest.h"
 #include "ThreadableLoader.h"
 #include "Timer.h"
@@ -42,6 +45,7 @@
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.h
 #if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
     class Archive;
 #endif
@@ -75,369 +79,369 @@ namespace WebCore {
     class SubstituteData;
     class TextResourceDecoder;
     class Widget;
+=======
+class Archive;
+class AuthenticationChallenge;
+class CachedFrameBase;
+class CachedPage;
+class CachedResource;
+class Document;
+class DocumentLoader;
+class Event;
+class FormData;
+class FormState;
+class Frame;
+class FrameLoaderClient;
+class HistoryItem;
+class HTMLAppletElement;
+class HTMLFormElement;
+class HTMLFrameOwnerElement;
+class IconLoader;
+class IntSize;
+class NavigationAction;
+class RenderPart;
+class ResourceError;
+class ResourceLoader;
+class ResourceResponse;
+class ScriptSourceCode;
+class ScriptString;
+class ScriptValue;
+class SecurityOrigin;
+class SharedBuffer;
+class SubstituteData;
+class TextResourceDecoder;
+class Widget;
+>>>>>>> webkit.org at r50258.:WebCore/loader/FrameLoader.h
+
+struct FrameLoadRequest;
+struct WindowFeatures;
+
+bool isBackForwardLoadType(FrameLoadType);
+
+class FrameLoader : public Noncopyable {
+public:
+    FrameLoader(Frame*, FrameLoaderClient*);
+    ~FrameLoader();
+
+    void init();
+
+    Frame* frame() const { return m_frame; }
+
+    PolicyChecker* policyChecker() const { return &m_policyChecker; }
+    HistoryController* history() const { return &m_history; }
+    ResourceLoadNotifier* notifier() const { return &m_notifer; }
+
+    // FIXME: This is not cool, people. There are too many different functions that all start loads.
+    // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
+    // the logic by extracting common code paths.
+
+    void prepareForLoadStart();
+    void setupForReplace();
+    void setupForReplaceByMIMEType(const String& newMIMEType);
+
+    void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
+
+    void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
+        PassRefPtr<Event>, PassRefPtr<FormState>, ReferrerPolicy);
+
+<<<<<<< HEAD:WebCore/loader/FrameLoader.h
+        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
+        
+#if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
+        void loadArchive(PassRefPtr<Archive>);
+#endif
+=======
+    void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+    void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+    void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
+    
+    void loadArchive(PassRefPtr<Archive>);
+>>>>>>> webkit.org at r50258.:WebCore/loader/FrameLoader.h
+
+    static void reportLocalLoadFailed(Frame*, const String& url);
 
-    struct FrameLoadRequest;
-    struct WindowFeatures;
+    // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
+    Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
-    bool isBackForwardLoadType(FrameLoadType);
+    unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
 
-    class FrameLoader : public Noncopyable {
-    public:
-        FrameLoader(Frame*, FrameLoaderClient*);
-        ~FrameLoader();
+    bool canHandleRequest(const ResourceRequest&);
 
-        void init();
+    // Also not cool.
+    void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
+    void stopForUserCancel(bool deferCheckLoadComplete = false);
 
-        Frame* frame() const { return m_frame; }
+    bool isLoadingMainResource() const { return m_isLoadingMainResource; }
+    bool isLoading() const;
+    bool frameHasLoaded() const;
 
-        PolicyChecker* policyChecker() { return &m_policyChecker; }
+    int numPendingOrLoadingRequests(bool recurse) const;
+    String referrer() const;
+    String outgoingReferrer() const;
+    String outgoingOrigin() const;
 
-        // FIXME: This is not cool, people. There are too many different functions that all start loads.
-        // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
-        // the logic by extracting common code paths.
+    DocumentLoader* activeDocumentLoader() const;
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
+    DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
+    FrameState state() const { return m_state; }
+    static double timeOfLastCompletedLoad();
 
-        void prepareForLoadStart();
-        void setupForReplace();
-        void setupForReplaceByMIMEType(const String& newMIMEType);
+    bool shouldUseCredentialStorage(ResourceLoader*);
+    const ResourceRequest& originalRequest() const;
+    const ResourceRequest& initialRequest() const;
+    void receivedMainResourceError(const ResourceError&, bool isComplete);
+    void receivedData(const char*, int);
 
-        void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
+    bool willLoadMediaElementURL(KURL&);
 
-        void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
-            PassRefPtr<Event>, PassRefPtr<FormState>);
+    void handleFallbackContent();
+    bool isStopping() const;
 
-        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
-        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
-        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
-        
-#if ENABLE(ARCHIVE) // ANDROID extension: disabled to reduce code size
-        void loadArchive(PassRefPtr<Archive>);
-#endif
+    void finishedLoading();
 
-        static void reportLocalLoadFailed(Frame*, const String& url);
+    ResourceError cancelledError(const ResourceRequest&) const;
+    ResourceError fileDoesNotExistError(const ResourceResponse&) const;
+    ResourceError blockedError(const ResourceRequest&) const;
+    ResourceError cannotShowURLError(const ResourceRequest&) const;
+    ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
 
-        // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
-        Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
+    bool isHostedByObjectElement() const;
+    bool isLoadingMainFrame() const;
+    bool canShowMIMEType(const String& MIMEType) const;
+    bool representationExistsForURLScheme(const String& URLScheme);
+    String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
+    void reload(bool endToEndReload = false);
+    void reloadWithOverrideEncoding(const String& overrideEncoding);
 
-        bool canHandleRequest(const ResourceRequest&);
+    void didReceiveServerRedirectForProvisionalLoadForFrame();
+    void finishedLoadingDocument(DocumentLoader*);
+    void committedLoad(DocumentLoader*, const char*, int);
+    bool isReplacing() const;
+    void setReplacing();
+    void revertToProvisional(DocumentLoader*);
+    void setMainDocumentError(DocumentLoader*, const ResourceError&);
+    void mainReceivedCompleteError(DocumentLoader*, const ResourceError&);
+    bool subframeIsLoading() const;
+    void willChangeTitle(DocumentLoader*);
+    void didChangeTitle(DocumentLoader*);
 
-        // Also not cool.
-        void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
-        void stopForUserCancel(bool deferCheckLoadComplete = false);
+    FrameLoadType loadType() const;
+    CachePolicy subresourceCachePolicy() const;
 
-        bool isLoadingMainResource() const { return m_isLoadingMainResource; }
-        bool isLoading() const;
-        bool frameHasLoaded() const;
+    void didFirstLayout();
+    bool firstLayoutDone() const;
 
-        int numPendingOrLoadingRequests(bool recurse) const;
-        String referrer() const;
-        String outgoingReferrer() const;
-        String outgoingOrigin() const;
+    void didFirstVisuallyNonEmptyLayout();
 
-        DocumentLoader* activeDocumentLoader() const;
-        DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
-        DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
-        DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
-        FrameState state() const { return m_state; }
-        static double timeOfLastCompletedLoad();
-
-        bool shouldUseCredentialStorage(ResourceLoader*);
-        void didReceiveAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
-        void didCancelAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
-        
-        void assignIdentifierToInitialRequest(unsigned long identifier, const ResourceRequest&);
-        void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
-        void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
-        void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
-        void didFinishLoad(ResourceLoader*);
-        void didFailToLoad(ResourceLoader*, const ResourceError&);
-        void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
-        const ResourceRequest& originalRequest() const;
-        const ResourceRequest& initialRequest() const;
-        void receivedMainResourceError(const ResourceError&, bool isComplete);
-        void receivedData(const char*, int);
-
-        bool willLoadMediaElementURL(KURL&);
-
-        void handleFallbackContent();
-        bool isStopping() const;
-
-        void finishedLoading();
-
-        ResourceError cancelledError(const ResourceRequest&) const;
-        ResourceError fileDoesNotExistError(const ResourceResponse&) const;
-        ResourceError blockedError(const ResourceRequest&) const;
-        ResourceError cannotShowURLError(const ResourceRequest&) const;
-        ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
-
-        bool isHostedByObjectElement() const;
-        bool isLoadingMainFrame() const;
-        bool canShowMIMEType(const String& MIMEType) const;
-        bool representationExistsForURLScheme(const String& URLScheme);
-        String generatedMIMETypeForURLScheme(const String& URLScheme);
-
-        void reload(bool endToEndReload = false);
-        void reloadWithOverrideEncoding(const String& overrideEncoding);
-
-        void didReceiveServerRedirectForProvisionalLoadForFrame();
-        void finishedLoadingDocument(DocumentLoader*);
-        void committedLoad(DocumentLoader*, const char*, int);
-        bool isReplacing() const;
-        void setReplacing();
-        void revertToProvisional(DocumentLoader*);
-        void setMainDocumentError(DocumentLoader*, const ResourceError&);
-        void mainReceivedCompleteError(DocumentLoader*, const ResourceError&);
-        bool subframeIsLoading() const;
-        void willChangeTitle(DocumentLoader*);
-        void didChangeTitle(DocumentLoader*);
-
-        FrameLoadType loadType() const;
-        CachePolicy subresourceCachePolicy() const;
-
-        void didFirstLayout();
-        bool firstLayoutDone() const;
-
-        void didFirstVisuallyNonEmptyLayout();
-
-        void loadedResourceFromMemoryCache(const CachedResource*);
-        void tellClientAboutPastMemoryCacheLoads();
-
-        void checkLoadComplete();
-        void detachFromParent();
-        void detachViewsAndDocumentLoader();
-
-        void addExtraFieldsToSubresourceRequest(ResourceRequest&);
-        void addExtraFieldsToMainResourceRequest(ResourceRequest&);
-        
-        static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
+    void loadedResourceFromMemoryCache(const CachedResource*);
+    void tellClientAboutPastMemoryCacheLoads();
 
-        FrameLoaderClient* client() const { return m_client; }
+    void checkLoadComplete();
+    void detachFromParent();
+    void detachViewsAndDocumentLoader();
 
-        void setDefersLoading(bool);
+    void addExtraFieldsToSubresourceRequest(ResourceRequest&);
+    void addExtraFieldsToMainResourceRequest(ResourceRequest&);
+    
+    static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
 
-        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
-        void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture);
-        bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
+    FrameLoaderClient* client() const { return m_client; }
 
-        void submitForm(const char* action, const String& url,
-            PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
-            bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void setDefersLoading(bool);
 
-        void stop();
-        void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
-        bool closeURL();
+    void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
+    void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy);
+    bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
 
-        void didExplicitOpen();
+    void submitForm(const char* action, const String& url,
+        PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
+        bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
 
-        KURL iconURL();
-        void commitIconURLToIconDatabase(const KURL&);
+    void stop();
+    void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
+    bool closeURL();
 
-        KURL baseURL() const;
+    void didExplicitOpen();
 
-        void begin();
-        void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
+    KURL iconURL();
+    void commitIconURLToIconDatabase(const KURL&);
 
-        void write(const char* string, int length = -1, bool flush = false);
-        void write(const String&);
-        void end();
-        void endIfNotLoadingMainResource();
+    KURL baseURL() const;
 
-        void setEncoding(const String& encoding, bool userChosen);
-        String encoding() const;
+    void replaceDocument(const String&);
 
-        ScriptValue executeScript(const ScriptSourceCode&);
-        ScriptValue executeScript(const String& script, bool forceUserGesture = false);
+    void begin();
+    void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
-        void gotoAnchor();
+    void write(const char* string, int length = -1, bool flush = false);
+    void write(const String&);
+    void end();
+    void endIfNotLoadingMainResource();
 
-        void tokenizerProcessedData();
+    void setEncoding(const String& encoding, bool userChosen);
+    String encoding() const;
 
-        void handledOnloadEvents();
-        String userAgent(const KURL&) const;
+    void tokenizerProcessedData();
 
-        PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
+    void handledOnloadEvents();
+    String userAgent(const KURL&) const;
 
-        void dispatchWindowObjectAvailable();
-        void dispatchDocumentElementAvailable();
-        void restoreDocumentState();
+    PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
-        // Mixed content related functions.
-        static bool isMixedContent(SecurityOrigin* context, const KURL&);
-        void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
-        void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
+    void dispatchWindowObjectAvailable();
+    void dispatchDocumentElementAvailable();
 
-        Frame* opener();
-        void setOpener(Frame*);
+    // Mixed content related functions.
+    static bool isMixedContent(SecurityOrigin* context, const KURL&);
+    void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
+    void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
 
-        bool isProcessingUserGesture();
+    Frame* opener();
+    void setOpener(Frame*);
 
-        void resetMultipleFormSubmissionProtection();
+    bool isProcessingUserGesture();
 
-        void addData(const char* bytes, int length);
+    void resetMultipleFormSubmissionProtection();
 
-        void checkCallImplicitClose();
+    void addData(const char* bytes, int length);
 
-        void frameDetached();
+    void checkCallImplicitClose();
 
-        const KURL& url() const { return m_URL; }
+    void frameDetached();
 
-        void setResponseMIMEType(const String&);
-        const String& responseMIMEType() const;
+    const KURL& url() const { return m_URL; }
 
-        bool containsPlugins() const;
+    void setResponseMIMEType(const String&);
+    const String& responseMIMEType() const;
 
-        void loadDone();
-        void finishedParsing();
-        void checkCompleted();
+    bool containsPlugins() const;
 
-        bool isComplete() const;
+    void loadDone();
+    void finishedParsing();
+    void checkCompleted();
 
-        bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
-            const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
+    void checkDidPerformFirstNavigation();
 
-        KURL completeURL(const String& url);
+    bool isComplete() const;
 
-        void cancelAndClear();
+    bool requestObject(RenderPart* frame, const String& url, const AtomicString& frameName,
+        const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues);
 
-        void setTitle(const String&);
+    KURL completeURL(const String& url);
 
-        void commitProvisionalLoad(PassRefPtr<CachedPage>);
-        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
+    void cancelAndClear();
 
-        void goToItem(HistoryItem*, FrameLoadType);
-        void saveDocumentAndScrollState();
+    void setTitle(const String&);
 
-        HistoryItem* currentHistoryItem();
-        void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
+    void commitProvisionalLoad(PassRefPtr<CachedPage>);
+    bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
 
-        bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
-        bool committedFirstRealDocumentLoad() const { return m_committedFirstRealDocumentLoad; }
+    bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+    bool committedFirstRealDocumentLoad() const { return m_committedFirstRealDocumentLoad; }
+    bool creatingInitialEmptyDocument() const { return m_creatingInitialEmptyDocument; }
 
-        void iconLoadDecisionAvailable();
+    void iconLoadDecisionAvailable();
 
-        bool shouldAllowNavigation(Frame* targetFrame) const;
-        Frame* findFrameForNavigation(const AtomicString& name);
+    bool shouldAllowNavigation(Frame* targetFrame) const;
+    Frame* findFrameForNavigation(const AtomicString& name);
 
-        void startIconLoader();
+    void startIconLoader();
 
-        void applyUserAgent(ResourceRequest& request);
+    void applyUserAgent(ResourceRequest& request);
 
-        bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
+    bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
 
-        void open(CachedFrameBase&);
+    void open(CachedFrameBase&);
 
-        // FIXME: Should these really be public?
-        void completed();
-        bool allAncestorsAreComplete() const; // including this
-        bool allChildrenAreComplete() const; // immediate children, not all descendants
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+    // FIXME: Should these really be public?
+    void completed();
+    bool allAncestorsAreComplete() const; // including this
+    bool allChildrenAreComplete() const; // immediate children, not all descendants
+    void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+    void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+    void loadItem(HistoryItem*, FrameLoadType);
 
-        // FIXME: This is public because this asynchronous callback from the FrameLoaderClient
-        // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
-        // introduce a proper callback type for this function, we should make it private again.
-        void continueLoadAfterWillSubmitForm();
+    // FIXME: This is public because this asynchronous callback from the FrameLoaderClient
+    // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
+    // introduce a proper callback type for this function, we should make it private again.
+    void continueLoadAfterWillSubmitForm();
+    
+    bool suppressOpenerInNewFrame() const { return m_suppressOpenerInNewFrame; }
 
-    private:
-        PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
-        PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
+    static ObjectContentType defaultObjectContentType(const KURL& url, const String& mimeType);
 
-        bool canCachePageContainingThisFrame();
+private:
+    bool canCachePageContainingThisFrame();
 #ifndef NDEBUG
-        void logCanCachePageDecision();
-        bool logCanCacheFrameDecision(int indentLevel);
+    void logCanCachePageDecision();
+    bool logCanCacheFrameDecision(int indentLevel);
 #endif
 
-        void addBackForwardItemClippedAtTarget(bool doClip);
-        void restoreScrollPositionAndViewState();
-        void saveDocumentState();
-        void loadItem(HistoryItem*, FrameLoadType);
-        bool urlsMatchItem(HistoryItem*) const;
-        void invalidateCurrentItemCachedPage();
-        void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
-        bool childFramesMatchItem(HistoryItem*) const;
-
-        void updateHistoryForBackForwardNavigation();
-        void updateHistoryForReload();
-        void updateHistoryForStandardLoad();
-        void updateHistoryForRedirectWithLockedBackForwardList();
-        void updateHistoryForClientRedirect();
-        void updateHistoryForCommit();
-        void updateHistoryForAnchorScroll();
-
-        void checkTimerFired(Timer<FrameLoader>*);
-
-        void started();
-
-        bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
-        bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
-        const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
-        
-        bool loadProvisionalItemFromCachedPage();
-        void cachePageForHistoryItem(HistoryItem*);
-        void pageHidden();
+    void checkTimerFired(Timer<FrameLoader>*);
 
-        void receivedFirstData();
+    void started();
 
-        void updateFirstPartyForCookies();
-        void setFirstPartyForCookies(const KURL&);
-        
-        void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
+    bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
+    bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
+    const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
+    
+    bool loadProvisionalItemFromCachedPage();
+    void cachePageForHistoryItem(HistoryItem*);
+    void pageHidden();
 
-        // Also not cool.
-        void stopLoadingSubframes();
+    void receivedFirstData();
 
-        void clearProvisionalLoad();
-        void markLoadComplete();
-        void transitionToCommitted(PassRefPtr<CachedPage>);
-        void frameLoadCompleted();
+    void updateFirstPartyForCookies();
+    void setFirstPartyForCookies(const KURL&);
+    
+    void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
 
-        void mainReceivedError(const ResourceError&, bool isComplete);
+    // Also not cool.
+    void stopLoadingSubframes();
 
-        void setLoadType(FrameLoadType);
+    void clearProvisionalLoad();
+    void markLoadComplete();
+    void transitionToCommitted(PassRefPtr<CachedPage>);
+    void frameLoadCompleted();
 
-        static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    void mainReceivedError(const ResourceError&, bool isComplete);
 
-        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
+    void setLoadType(FrameLoadType);
 
-        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
-        void addHistoryItemForFragmentScroll();
+    static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
 
-        void checkLoadCompleteForThisFrame();
+    void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
 
-        void setDocumentLoader(DocumentLoader*);
-        void setPolicyDocumentLoader(DocumentLoader*);
-        void setProvisionalDocumentLoader(DocumentLoader*);
+    bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
 
-        void setState(FrameState);
+    void checkLoadCompleteForThisFrame();
 
-        void closeOldDataSources();
-        void open(CachedPage&);
+    void setDocumentLoader(DocumentLoader*);
+    void setPolicyDocumentLoader(DocumentLoader*);
+    void setProvisionalDocumentLoader(DocumentLoader*);
 
-        void updateHistoryAfterClientRedirect();
+    void setState(FrameState);
 
-        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
+    void closeOldDataSources();
+    void open(CachedPage&);
 
-        bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
+    void updateHistoryAfterClientRedirect();
 
-        void dispatchDidCommitLoad();
-        void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-        void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
-        void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-        void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
-        void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
+    void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
-        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
-        void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+    bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
 
-        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
-            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
+    void dispatchDidCommitLoad();
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.h
 #ifdef ANDROID_USER_GESTURE
         void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
             const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>, bool);
@@ -449,118 +453,121 @@ namespace WebCore {
         void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
             bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 #endif
+=======
+    void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
+    void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+>>>>>>> webkit.org at r50258.:WebCore/loader/FrameLoader.h
 
-        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
+    void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
+        bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
 
-        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
-        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
+    void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+        const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+        bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 
-        void recursiveCheckLoadComplete();
+    bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 
-        void detachChildren();
-        void closeAndRemoveChild(Frame*);
+    void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
 
-        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
+    void recursiveCheckLoadComplete();
 
-        // Returns true if argument is a JavaScript URL.
-        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+    void detachChildren();
+    void closeAndRemoveChild(Frame*);
 
-        bool gotoAnchor(const String& name); // returns true if the anchor was found
-        void scrollToAnchor(const KURL&);
+    Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-        void provisionalLoadStarted();
+    void scrollToAnchor(const KURL&);
 
-        bool canCachePage();
+    void provisionalLoadStarted();
 
-        bool didOpenURL(const KURL&);
+    bool canCachePage();
 
-        void scheduleCheckCompleted();
-        void scheduleCheckLoadComplete();
-        void startCheckCompleteTimer();
+    bool didOpenURL(const KURL&);
 
-        KURL originalRequestURL() const;
+    void scheduleCheckCompleted();
+    void scheduleCheckLoadComplete();
+    void startCheckCompleteTimer();
 
-        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
+    KURL originalRequestURL() const;
 
-        void saveScrollPositionAndViewStateToItem(HistoryItem*);
+    bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
-        Frame* m_frame;
-        FrameLoaderClient* m_client;
+    Frame* m_frame;
+    FrameLoaderClient* m_client;
 
-        PolicyChecker m_policyChecker;
+    mutable PolicyChecker m_policyChecker;
+    mutable HistoryController m_history;
+    mutable ResourceLoadNotifier m_notifer;
 
-        FrameState m_state;
-        FrameLoadType m_loadType;
+    FrameState m_state;
+    FrameLoadType m_loadType;
 
-        // Document loaders for the three phases of frame loading. Note that while 
-        // a new request is being loaded, the old document loader may still be referenced.
-        // E.g. while a new request is in the "policy" state, the old document loader may
-        // be consulted in particular as it makes sense to imply certain settings on the new loader.
-        RefPtr<DocumentLoader> m_documentLoader;
-        RefPtr<DocumentLoader> m_provisionalDocumentLoader;
-        RefPtr<DocumentLoader> m_policyDocumentLoader;
+    // Document loaders for the three phases of frame loading. Note that while 
+    // a new request is being loaded, the old document loader may still be referenced.
+    // E.g. while a new request is in the "policy" state, the old document loader may
+    // be consulted in particular as it makes sense to imply certain settings on the new loader.
+    RefPtr<DocumentLoader> m_documentLoader;
+    RefPtr<DocumentLoader> m_provisionalDocumentLoader;
+    RefPtr<DocumentLoader> m_policyDocumentLoader;
 
-        bool m_delegateIsHandlingProvisionalLoadError;
+    bool m_delegateIsHandlingProvisionalLoadError;
 
-        bool m_firstLayoutDone;
-        bool m_quickRedirectComing;
-        bool m_sentRedirectNotification;
-        bool m_inStopAllLoaders;
+    bool m_firstLayoutDone;
+    bool m_quickRedirectComing;
+    bool m_sentRedirectNotification;
+    bool m_inStopAllLoaders;
 
-        String m_outgoingReferrer;
+    String m_outgoingReferrer;
 
-        bool m_isExecutingJavaScriptFormAction;
-        bool m_isRunningScript;
+    bool m_isExecutingJavaScriptFormAction;
 
-        String m_responseMIMEType;
+    String m_responseMIMEType;
 
-        bool m_didCallImplicitClose;
-        bool m_wasUnloadEventEmitted;
-        bool m_unloadEventBeingDispatched;
-        bool m_isComplete;
-        bool m_isLoadingMainResource;
+    bool m_didCallImplicitClose;
+    bool m_wasUnloadEventEmitted;
+    bool m_unloadEventBeingDispatched;
+    bool m_isComplete;
+    bool m_isLoadingMainResource;
 
-        KURL m_URL;
-        KURL m_workingURL;
+    KURL m_URL;
+    KURL m_workingURL;
 
-        OwnPtr<IconLoader> m_iconLoader;
-        bool m_mayLoadIconLater;
+    OwnPtr<IconLoader> m_iconLoader;
+    bool m_mayLoadIconLater;
 
-        bool m_cancellingWithLoadInProgress;
+    bool m_cancellingWithLoadInProgress;
 
-        bool m_needsClear;
-        bool m_receivedData;
+    bool m_needsClear;
+    bool m_receivedData;
 
-        bool m_encodingWasChosenByUser;
-        String m_encoding;
-        RefPtr<TextResourceDecoder> m_decoder;
+    bool m_encodingWasChosenByUser;
+    String m_encoding;
+    RefPtr<TextResourceDecoder> m_decoder;
 
-        bool m_containsPlugIns;
+    bool m_containsPlugIns;
 
-        KURL m_submittedFormURL;
+    KURL m_submittedFormURL;
 
-        Timer<FrameLoader> m_checkTimer;
-        bool m_shouldCallCheckCompleted;
-        bool m_shouldCallCheckLoadComplete;
+    Timer<FrameLoader> m_checkTimer;
+    bool m_shouldCallCheckCompleted;
+    bool m_shouldCallCheckLoadComplete;
 
-        Frame* m_opener;
-        HashSet<Frame*> m_openedFrames;
+    Frame* m_opener;
+    HashSet<Frame*> m_openedFrames;
 
-        bool m_creatingInitialEmptyDocument;
-        bool m_isDisplayingInitialEmptyDocument;
-        bool m_committedFirstRealDocumentLoad;
+    bool m_creatingInitialEmptyDocument;
+    bool m_isDisplayingInitialEmptyDocument;
+    bool m_committedFirstRealDocumentLoad;
 
-        RefPtr<HistoryItem> m_currentHistoryItem;
-        RefPtr<HistoryItem> m_previousHistoryItem;
-        RefPtr<HistoryItem> m_provisionalHistoryItem;
-        
-        bool m_didPerformFirstNavigation;
-        bool m_loadingFromCachedPage;
-        
+    bool m_didPerformFirstNavigation;
+    bool m_loadingFromCachedPage;
+    bool m_suppressOpenerInNewFrame;
+    
 #ifndef NDEBUG
-        bool m_didDispatchDidCommitLoad;
+    bool m_didDispatchDidCommitLoad;
 #endif
-    };
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/loader/FrameLoaderTypes.h b/WebCore/loader/FrameLoaderTypes.h
index 76299f5..e7d51c7 100644
--- a/WebCore/loader/FrameLoaderTypes.h
+++ b/WebCore/loader/FrameLoaderTypes.h
@@ -87,6 +87,11 @@ namespace WebCore {
         UnloadEventPolicyUnloadOnly,
         UnloadEventPolicyUnloadAndPageHide
     };
+
+    enum ReferrerPolicy {
+        SendReferrer,
+        NoReferrer
+    };
 }
 
 #endif
diff --git a/WebCore/loader/HistoryController.cpp b/WebCore/loader/HistoryController.cpp
new file mode 100644
index 0000000..501640a
--- /dev/null
+++ b/WebCore/loader/HistoryController.cpp
@@ -0,0 +1,627 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HistoryController.h"
+
+#include "CachedPage.h"
+#include "CString.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "HistoryItem.h"
+#include "Logging.h"
+#include "Page.h"
+#include "PageCache.h"
+#include "PageGroup.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+HistoryController::HistoryController(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+HistoryController::~HistoryController()
+{
+}
+
+void HistoryController::saveScrollPositionAndViewStateToItem(HistoryItem* item)
+{
+    if (!item || !m_frame->view())
+        return;
+        
+    item->setScrollPoint(m_frame->view()->scrollPosition());
+    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling through to the client.
+    m_frame->loader()->client()->saveViewStateToItem(item);
+}
+
+/*
+ There is a race condition between the layout and load completion that affects restoring the scroll position.
+ We try to restore the scroll position at both the first layout and upon load completion.
+ 
+ 1) If first layout happens before the load completes, we want to restore the scroll position then so that the
+ first time we draw the page is already scrolled to the right place, instead of starting at the top and later
+ jumping down.  It is possible that the old scroll position is past the part of the doc laid out so far, in
+ which case the restore silent fails and we will fix it in when we try to restore on doc completion.
+ 2) If the layout happens after the load completes, the attempt to restore at load completion time silently
+ fails.  We then successfully restore it when the layout happens.
+*/
+void HistoryController::restoreScrollPositionAndViewState()
+{
+    if (!m_frame->loader()->committedFirstRealDocumentLoad())
+        return;
+
+    ASSERT(m_currentItem);
+    
+    // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
+    // One counterexample is <rdar://problem/4917290>
+    // For now, to cover this issue in release builds, there is no technical harm to returning
+    // early and from a user standpoint - as in the above radar - the previous page load failed 
+    // so there *is* no scroll or view state to restore!
+    if (!m_currentItem)
+        return;
+    
+    // FIXME: It would be great to work out a way to put this code in WebCore instead of calling
+    // through to the client. It's currently used only for the PDF view on Mac.
+    m_frame->loader()->client()->restoreViewState();
+    
+    if (FrameView* view = m_frame->view())
+        if (!view->wasScrolledByUser())
+            view->setScrollPosition(m_currentItem->scrollPoint());
+}
+
+void HistoryController::updateBackForwardListForFragmentScroll()
+{
+    updateBackForwardListClippedAtTarget(false);
+}
+
+void HistoryController::saveDocumentState()
+{
+    // FIXME: Reading this bit of FrameLoader state here is unfortunate.  I need to study
+    // this more to see if we can remove this dependency.
+    if (m_frame->loader()->creatingInitialEmptyDocument())
+        return;
+
+    // For a standard page load, we will have a previous item set, which will be used to
+    // store the form state.  However, in some cases we will have no previous item, and
+    // the current item is the right place to save the state.  One example is when we
+    // detach a bunch of frames because we are navigating from a site with frames to
+    // another site.  Another is when saving the frame state of a frame that is not the
+    // target of the current navigation (if we even decide to save with that granularity).
+
+    // Because of previousItem's "masking" of currentItem for this purpose, it's important
+    // that previousItem be cleared at the end of a page transition.  We leverage the
+    // checkLoadComplete recursion to achieve this goal.
+
+    HistoryItem* item = m_previousItem ? m_previousItem.get() : m_currentItem.get();
+    if (!item)
+        return;
+
+    Document* document = m_frame->document();
+    ASSERT(document);
+    
+    if (item->isCurrentDocument(document)) {
+        LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
+        item->setDocumentState(document->formElementsState());
+    }
+}
+
+// Walk the frame tree, telling all frames to save their form state into their current
+// history item.
+void HistoryController::saveDocumentAndScrollState()
+{
+    for (Frame* frame = m_frame; frame; frame = frame->tree()->traverseNext(m_frame)) {
+        frame->loader()->history()->saveDocumentState();
+        frame->loader()->history()->saveScrollPositionAndViewStateToItem(frame->loader()->history()->currentItem());
+    }
+}
+
+void HistoryController::restoreDocumentState()
+{
+    Document* doc = m_frame->document();
+        
+    HistoryItem* itemToRestore = 0;
+    
+    switch (m_frame->loader()->loadType()) {
+        case FrameLoadTypeReload:
+        case FrameLoadTypeReloadFromOrigin:
+        case FrameLoadTypeSame:
+        case FrameLoadTypeReplace:
+            break;
+        case FrameLoadTypeBack:
+        case FrameLoadTypeBackWMLDeckNotAccessible:
+        case FrameLoadTypeForward:
+        case FrameLoadTypeIndexedBackForward:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
+        case FrameLoadTypeStandard:
+            itemToRestore = m_currentItem.get(); 
+    }
+    
+    if (!itemToRestore)
+        return;
+
+    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
+    doc->setStateForNewFormElements(itemToRestore->documentState());
+}
+
+void HistoryController::invalidateCurrentItemCachedPage()
+{
+    // When we are pre-commit, the currentItem is where the pageCache data resides    
+    CachedPage* cachedPage = pageCache()->get(currentItem());
+
+    // FIXME: This is a grotesque hack to fix <rdar://problem/4059059> Crash in RenderFlow::detach
+    // Somehow the PageState object is not properly updated, and is holding onto a stale document.
+    // Both Xcode and FileMaker see this crash, Safari does not.
+    
+    ASSERT(!cachedPage || cachedPage->document() == m_frame->document());
+    if (cachedPage && cachedPage->document() == m_frame->document()) {
+        cachedPage->document()->setInPageCache(false);
+        cachedPage->clear();
+    }
+    
+    if (cachedPage)
+        pageCache()->remove(currentItem());
+}
+
+// Main funnel for navigating to a previous location (back/forward, non-search snap-back)
+// This includes recursion to handle loading into framesets properly
+void HistoryController::goToItem(HistoryItem* targetItem, FrameLoadType type)
+{
+    ASSERT(!m_frame->tree()->parent());
+    
+    // shouldGoToHistoryItem is a private delegate method. This is needed to fix:
+    // <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
+    // Ultimately, history item navigations should go through the policy delegate. That's covered in:
+    // <rdar://problem/3979539> back/forward cache navigations should consult policy delegate
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    if (!m_frame->loader()->client()->shouldGoToHistoryItem(targetItem))
+        return;
+
+    // Set the BF cursor before commit, which lets the user quickly click back/forward again.
+    // - plus, it only makes sense for the top level of the operation through the frametree,
+    // as opposed to happening for some/one of the page commits that might happen soon
+    BackForwardList* bfList = page->backForwardList();
+    HistoryItem* currentItem = bfList->currentItem();    
+    bfList->goToItem(targetItem);
+    Settings* settings = m_frame->settings();
+    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : targetItem);
+    recursiveGoToItem(targetItem, currentItem, type);
+}
+
+// Walk the frame tree and ensure that the URLs match the URLs in the item.
+bool HistoryController::urlsMatchItem(HistoryItem* item) const
+{
+    const KURL& currentURL = m_frame->loader()->documentLoader()->url();
+    if (!equalIgnoringFragmentIdentifier(currentURL, item->url()))
+        return false;
+
+    const HistoryItemVector& childItems = item->children();
+
+    unsigned size = childItems.size();
+    for (unsigned i = 0; i < size; ++i) {
+        Frame* childFrame = m_frame->tree()->child(childItems[i]->target());
+        if (childFrame && !childFrame->loader()->history()->urlsMatchItem(childItems[i].get()))
+            return false;
+    }
+
+    return true;
+}
+
+void HistoryController::updateForBackForwardNavigation()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for back/forward navigation in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    // Must grab the current scroll position before disturbing it
+    saveScrollPositionAndViewStateToItem(m_previousItem.get());
+}
+
+void HistoryController::updateForReload()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for reload in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    if (m_currentItem) {
+        pageCache()->remove(m_currentItem.get());
+    
+        if (m_frame->loader()->loadType() == FrameLoadTypeReload || m_frame->loader()->loadType() == FrameLoadTypeReloadFromOrigin)
+            saveScrollPositionAndViewStateToItem(m_currentItem.get());
+    
+        // Sometimes loading a page again leads to a different result because of cookies. Bugzilla 4072
+        if (m_frame->loader()->documentLoader()->unreachableURL().isEmpty())
+            m_currentItem->setURL(m_frame->loader()->documentLoader()->requestURL());
+    }
+}
+
+// There are 3 things you might think of as "history", all of which are handled by these functions.
+//
+//     1) Back/forward: The m_currentItem is part of this mechanism.
+//     2) Global history: Handled by the client.
+//     3) Visited links: Handled by the PageGroup.
+
+void HistoryController::updateForStandardLoad()
+{
+    LOG(History, "WebCoreHistory: Updating History for Standard Load in frame %s", m_frame->loader()->documentLoader()->url().string().ascii().data());
+
+    FrameLoader* frameLoader = m_frame->loader();
+
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = frameLoader->documentLoader()->urlForHistory();
+
+    if (!frameLoader->documentLoader()->isClientRedirect()) {
+        if (!historyURL.isEmpty()) {
+            updateBackForwardListClippedAtTarget(true);
+            if (!needPrivacy) {
+                frameLoader->client()->updateGlobalHistory();
+                frameLoader->documentLoader()->setDidCreateGlobalHistoryEntry(true);
+                if (frameLoader->documentLoader()->unreachableURL().isEmpty())
+                    frameLoader->client()->updateGlobalHistoryRedirectLinks();
+            }
+            if (Page* page = m_frame->page())
+                page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
+        }
+    } else if (frameLoader->documentLoader()->unreachableURL().isEmpty() && m_currentItem) {
+        m_currentItem->setURL(frameLoader->documentLoader()->url());
+        m_currentItem->setFormInfoFromRequest(frameLoader->documentLoader()->request());
+    }
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+
+        if (!frameLoader->documentLoader()->didCreateGlobalHistoryEntry() && frameLoader->documentLoader()->unreachableURL().isEmpty() && !frameLoader->url().isEmpty())
+            frameLoader->client()->updateGlobalHistoryRedirectLinks();
+    }
+}
+
+void HistoryController::updateForRedirectWithLockedBackForwardList()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+    
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = m_frame->loader()->documentLoader()->urlForHistory();
+
+    if (m_frame->loader()->documentLoader()->isClientRedirect()) {
+        if (!m_currentItem && !m_frame->tree()->parent()) {
+            if (!historyURL.isEmpty()) {
+                updateBackForwardListClippedAtTarget(true);
+                if (!needPrivacy) {
+                    m_frame->loader()->client()->updateGlobalHistory();
+                    m_frame->loader()->documentLoader()->setDidCreateGlobalHistoryEntry(true);
+                    if (m_frame->loader()->documentLoader()->unreachableURL().isEmpty())
+                        m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
+                }
+                if (Page* page = m_frame->page())
+                    page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
+            }
+        }
+        if (m_currentItem) {
+            m_currentItem->setURL(m_frame->loader()->documentLoader()->url());
+            m_currentItem->setFormInfoFromRequest(m_frame->loader()->documentLoader()->request());
+        }
+    } else {
+        Frame* parentFrame = m_frame->tree()->parent();
+        if (parentFrame && parentFrame->loader()->history()->m_currentItem)
+            parentFrame->loader()->history()->m_currentItem->setChildItem(createItem(true));
+    }
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+
+        if (!m_frame->loader()->documentLoader()->didCreateGlobalHistoryEntry() && m_frame->loader()->documentLoader()->unreachableURL().isEmpty() && !m_frame->loader()->url().isEmpty())
+            m_frame->loader()->client()->updateGlobalHistoryRedirectLinks();
+    }
+}
+
+void HistoryController::updateForClientRedirect()
+{
+#if !LOG_DISABLED
+    if (m_frame->loader()->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for client redirect in frame %s", m_frame->loader()->documentLoader()->title().utf8().data());
+#endif
+
+    // Clear out form data so we don't try to restore it into the incoming page.  Must happen after
+    // webcore has closed the URL and saved away the form state.
+    if (m_currentItem) {
+        m_currentItem->clearDocumentState();
+        m_currentItem->clearScrollPoint();
+    }
+
+    Settings* settings = m_frame->settings();
+    bool needPrivacy = !settings || settings->privateBrowsingEnabled();
+    const KURL& historyURL = m_frame->loader()->documentLoader()->urlForHistory();
+
+    if (!historyURL.isEmpty() && !needPrivacy) {
+        if (Page* page = m_frame->page())
+            page->group().addVisitedLink(historyURL);
+    }
+}
+
+void HistoryController::updateForCommit()
+{
+    FrameLoader* frameLoader = m_frame->loader();
+#if !LOG_DISABLED
+    if (frameLoader->documentLoader())
+        LOG(History, "WebCoreHistory: Updating History for commit in frame %s", frameLoader->documentLoader()->title().utf8().data());
+#endif
+    FrameLoadType type = frameLoader->loadType();
+    if (isBackForwardLoadType(type) ||
+        ((type == FrameLoadTypeReload || type == FrameLoadTypeReloadFromOrigin) && !frameLoader->provisionalDocumentLoader()->unreachableURL().isEmpty())) {
+        // Once committed, we want to use current item for saving DocState, and
+        // the provisional item for restoring state.
+        // Note previousItem must be set before we close the URL, which will
+        // happen when the data source is made non-provisional below
+        m_previousItem = m_currentItem;
+        ASSERT(m_provisionalItem);
+        m_currentItem = m_provisionalItem;
+        m_provisionalItem = 0;
+    }
+}
+
+void HistoryController::updateForAnchorScroll()
+{
+    if (m_frame->loader()->url().isEmpty())
+        return;
+
+    Settings* settings = m_frame->settings();
+    if (!settings || settings->privateBrowsingEnabled())
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    page->group().addVisitedLink(m_frame->loader()->url());
+}
+
+void HistoryController::updateForFrameLoadCompleted()
+{
+    // Even if already complete, we might have set a previous item on a frame that
+    // didn't do any data loading on the past transaction. Make sure to clear these out.
+    m_previousItem = 0;
+}
+
+void HistoryController::setCurrentItem(HistoryItem* item)
+{
+    m_currentItem = item;
+}
+
+void HistoryController::setCurrentItemTitle(const String& title)
+{
+    if (m_currentItem)
+        m_currentItem->setTitle(title);
+}
+
+void HistoryController::setProvisionalItem(HistoryItem* item)
+{
+    m_provisionalItem = item;
+}
+
+PassRefPtr<HistoryItem> HistoryController::createItem(bool useOriginal)
+{
+    DocumentLoader* docLoader = m_frame->loader()->documentLoader();
+    
+    KURL unreachableURL = docLoader ? docLoader->unreachableURL() : KURL();
+    
+    KURL url;
+    KURL originalURL;
+
+    if (!unreachableURL.isEmpty()) {
+        url = unreachableURL;
+        originalURL = unreachableURL;
+    } else {
+        originalURL = docLoader ? docLoader->originalURL() : KURL();
+        if (useOriginal)
+            url = originalURL;
+        else if (docLoader)
+            url = docLoader->requestURL();
+    }
+
+    LOG(History, "WebCoreHistory: Creating item for %s", url.string().ascii().data());
+    
+    // Frames that have never successfully loaded any content
+    // may have no URL at all. Currently our history code can't
+    // deal with such things, so we nip that in the bud here.
+    // Later we may want to learn to live with nil for URL.
+    // See bug 3368236 and related bugs for more information.
+    if (url.isEmpty()) 
+        url = blankURL();
+    if (originalURL.isEmpty())
+        originalURL = blankURL();
+    
+    Frame* parentFrame = m_frame->tree()->parent();
+    String parent = parentFrame ? parentFrame->tree()->name() : "";
+    String title = docLoader ? docLoader->title() : "";
+
+    RefPtr<HistoryItem> item = HistoryItem::create(url, m_frame->tree()->name(), parent, title);
+    item->setOriginalURLString(originalURL.string());
+
+    if (!unreachableURL.isEmpty() || !docLoader || docLoader->response().httpStatusCode() >= 400)
+        item->setLastVisitWasFailure(true);
+
+    // Save form state if this is a POST
+    if (docLoader) {
+        if (useOriginal)
+            item->setFormInfoFromRequest(docLoader->originalRequest());
+        else
+            item->setFormInfoFromRequest(docLoader->request());
+    }
+    
+    // Set the item for which we will save document state
+    m_previousItem = m_currentItem;
+    m_currentItem = item;
+    
+    return item.release();
+}
+
+PassRefPtr<HistoryItem> HistoryController::createItemTree(Frame* targetFrame, bool clipAtTarget)
+{
+    RefPtr<HistoryItem> bfItem = createItem(m_frame->tree()->parent() ? true : false);
+    if (m_previousItem)
+        saveScrollPositionAndViewStateToItem(m_previousItem.get());
+    if (!(clipAtTarget && m_frame == targetFrame)) {
+        // save frame state for items that aren't loading (khtml doesn't save those)
+        saveDocumentState();
+        for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+            FrameLoader* childLoader = child->loader();
+            bool hasChildLoaded = childLoader->frameHasLoaded();
+
+            // If the child is a frame corresponding to an <object> element that never loaded,
+            // we don't want to create a history item, because that causes fallback content
+            // to be ignored on reload.
+            
+            if (!(!hasChildLoaded && childLoader->isHostedByObjectElement()))
+                bfItem->addChildItem(childLoader->history()->createItemTree(targetFrame, clipAtTarget));
+        }
+    }
+    if (m_frame == targetFrame)
+        bfItem->setIsTargetItem(true);
+    return bfItem;
+}
+
+// The general idea here is to traverse the frame tree and the item tree in parallel,
+// tracking whether each frame already has the content the item requests.  If there is
+// a match (by URL), we just restore scroll position and recurse.  Otherwise we must
+// reload that frame, and all its kids.
+void HistoryController::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, FrameLoadType type)
+{
+    ASSERT(item);
+    ASSERT(fromItem);
+
+    KURL itemURL = item->url();
+    KURL currentURL;
+    if (m_frame->loader()->documentLoader())
+        currentURL = m_frame->loader()->documentLoader()->url();
+
+    // Always reload the target frame of the item we're going to.  This ensures that we will
+    // do -some- load for the transition, which means a proper notification will be posted
+    // to the app.
+    // The exact URL has to match, including fragment.  We want to go through the _load
+    // method, even if to do a within-page navigation.
+    // The current frame tree and the frame tree snapshot in the item have to match.
+    if (!item->isTargetItem() &&
+        itemURL == currentURL &&
+        ((m_frame->tree()->name().isEmpty() && item->target().isEmpty()) || m_frame->tree()->name() == item->target()) &&
+        childFramesMatchItem(item))
+    {
+        // This content is good, so leave it alone and look for children that need reloading
+        // Save form state (works from currentItem, since prevItem is nil)
+        ASSERT(!m_previousItem);
+        saveDocumentState();
+        saveScrollPositionAndViewStateToItem(m_currentItem.get());
+
+        if (FrameView* view = m_frame->view())
+            view->setWasScrolledByUser(false);
+
+        m_currentItem = item;
+                
+        // Restore form state (works from currentItem)
+        restoreDocumentState();
+        
+        // Restore the scroll position (we choose to do this rather than going back to the anchor point)
+        restoreScrollPositionAndViewState();
+        
+        const HistoryItemVector& childItems = item->children();
+        
+        int size = childItems.size();
+        for (int i = 0; i < size; ++i) {
+            String childFrameName = childItems[i]->target();
+            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
+            ASSERT(fromChildItem || fromItem->isTargetItem());
+            Frame* childFrame = m_frame->tree()->child(childFrameName);
+            ASSERT(childFrame);
+            childFrame->loader()->history()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
+        }
+    } else {
+        m_frame->loader()->loadItem(item, type);
+    }
+}
+
+// helper method that determines whether the subframes described by the item's subitems
+// match our own current frameset
+bool HistoryController::childFramesMatchItem(HistoryItem* item) const
+{
+    const HistoryItemVector& childItems = item->children();
+    if (childItems.size() != m_frame->tree()->childCount())
+        return false;
+    
+    unsigned size = childItems.size();
+    for (unsigned i = 0; i < size; ++i) {
+        if (!m_frame->tree()->child(childItems[i]->target()))
+            return false;
+    }
+    
+    // Found matches for all item targets
+    return true;
+}
+
+void HistoryController::updateBackForwardListClippedAtTarget(bool doClip)
+{
+    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
+    // The item that was the target of the user's navigation is designated as the "targetItem".  
+    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
+    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    if (m_frame->loader()->documentLoader()->urlForHistory().isEmpty())
+        return;
+
+    Frame* mainFrame = page->mainFrame();
+    ASSERT(mainFrame);
+    FrameLoader* frameLoader = mainFrame->loader();
+
+    frameLoader->checkDidPerformFirstNavigation();
+
+    RefPtr<HistoryItem> item = frameLoader->history()->createItemTree(m_frame, doClip);
+    LOG(BackForward, "WebCoreBackForward - Adding backforward item %p for frame %s", item.get(), m_frame->loader()->documentLoader()->url().string().ascii().data());
+    page->backForwardList()->addItem(item);
+}
+
+} // namespace WebCore
diff --git a/WebCore/loader/HistoryController.h b/WebCore/loader/HistoryController.h
new file mode 100644
index 0000000..4ecae69
--- /dev/null
+++ b/WebCore/loader/HistoryController.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HistoryController_h
+#define HistoryController_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class HistoryItem;
+
+class HistoryController : public Noncopyable {
+public:
+    HistoryController(Frame*);
+    ~HistoryController();
+
+    void saveScrollPositionAndViewStateToItem(HistoryItem*);
+    void restoreScrollPositionAndViewState();
+
+    void updateBackForwardListForFragmentScroll();
+
+    void saveDocumentState();
+    void saveDocumentAndScrollState();
+    void restoreDocumentState();
+
+    void invalidateCurrentItemCachedPage();
+
+    void goToItem(HistoryItem*, FrameLoadType);
+    bool urlsMatchItem(HistoryItem*) const;
+
+    void updateForBackForwardNavigation();
+    void updateForReload();
+    void updateForStandardLoad();
+    void updateForRedirectWithLockedBackForwardList();
+    void updateForClientRedirect();
+    void updateForCommit();
+    void updateForAnchorScroll();
+    void updateForFrameLoadCompleted();
+
+    HistoryItem* currentItem() const { return m_currentItem.get(); }
+    void setCurrentItem(HistoryItem*);
+    void setCurrentItemTitle(const String&);
+
+    HistoryItem* provisionalItem() const { return m_provisionalItem.get(); }
+    void setProvisionalItem(HistoryItem*);
+
+private:
+    PassRefPtr<HistoryItem> createItem(bool useOriginal);
+    PassRefPtr<HistoryItem> createItemTree(Frame* targetFrame, bool clipAtTarget);
+
+    void recursiveGoToItem(HistoryItem*, HistoryItem*, FrameLoadType);
+    bool childFramesMatchItem(HistoryItem*) const;
+    void updateBackForwardListClippedAtTarget(bool doClip);
+
+    Frame* m_frame;
+
+    RefPtr<HistoryItem> m_currentItem;
+    RefPtr<HistoryItem> m_previousItem;
+    RefPtr<HistoryItem> m_provisionalItem;
+};
+
+} // namespace WebCore
+
+#endif // HistoryController_h
diff --git a/WebCore/loader/ImageLoader.cpp b/WebCore/loader/ImageLoader.cpp
index b183a66..cdc31bc 100644
--- a/WebCore/loader/ImageLoader.cpp
+++ b/WebCore/loader/ImageLoader.cpp
@@ -31,34 +31,40 @@
 
 namespace WebCore {
 
-class ImageLoadEventSender {
+class ImageEventSender {
 public:
-    ImageLoadEventSender();
+    ImageEventSender(const AtomicString& eventType);
 
-    void dispatchLoadEventSoon(ImageLoader*);
-    void cancelLoadEvent(ImageLoader*);
+    void dispatchEventSoon(ImageLoader*);
+    void cancelEvent(ImageLoader*);
 
-    void dispatchPendingLoadEvents();
+    void dispatchPendingEvents();
 
 private:
-    ~ImageLoadEventSender();
+    void timerFired(Timer<ImageEventSender>*);
 
-    void timerFired(Timer<ImageLoadEventSender>*);
-
-    Timer<ImageLoadEventSender> m_timer;
+    AtomicString m_eventType;
+    Timer<ImageEventSender> m_timer;
     Vector<ImageLoader*> m_dispatchSoonList;
     Vector<ImageLoader*> m_dispatchingList;
 };
 
-static ImageLoadEventSender& loadEventSender()
+static ImageEventSender& beforeLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().beforeloadEvent));
+    return sender;
+}
+
+static ImageEventSender& loadEventSender()
 {
-    DEFINE_STATIC_LOCAL(ImageLoadEventSender, sender, ());
+    DEFINE_STATIC_LOCAL(ImageEventSender, sender, (eventNames().loadEvent));
     return sender;
 }
 
 ImageLoader::ImageLoader(Element* element)
     : m_element(element)
     , m_image(0)
+    , m_firedBeforeLoad(true)
     , m_firedLoad(true)
     , m_imageComplete(true)
     , m_loadManually(false)
@@ -69,7 +75,10 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
-    loadEventSender().cancelLoadEvent(this);
+    if (!m_firedBeforeLoad)
+        beforeLoadEventSender().cancelEvent(this);
+    if (!m_firedLoad)
+        loadEventSender().cancelEvent(this);
 }
 
 void ImageLoader::setImage(CachedImage* newImage)
@@ -78,6 +87,7 @@ void ImageLoader::setImage(CachedImage* newImage)
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
         setLoadingImage(newImage);
+        m_firedBeforeLoad = true;
         m_firedLoad = true;
         m_imageComplete = true;
         if (newImage)
@@ -89,16 +99,16 @@ void ImageLoader::setImage(CachedImage* newImage)
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
-
         toRenderImage(renderer)->resetAnimation();
     }
 }
 
 void ImageLoader::setLoadingImage(CachedImage* loadingImage)
 {
-    m_firedLoad = false;
-    m_imageComplete = false;
     m_image = loadingImage;
+    m_firedBeforeLoad = !loadingImage;
+    m_firedLoad = !loadingImage;
+    m_imageComplete = !loadingImage;
 }
 
 void ImageLoader::updateFromElement()
@@ -137,8 +147,13 @@ void ImageLoader::updateFromElement()
     CachedImage* oldImage = m_image.get();
     if (newImage != oldImage) {
         setLoadingImage(newImage);
-        if (newImage)
+        if (newImage) {
             newImage->addClient(this);
+            if (!m_element->document()->hasListenerType(Document::BEFORELOAD_LISTENER))
+                dispatchPendingBeforeLoadEvent();
+            else
+                beforeLoadEventSender().dispatchEventSoon(this);
+        }
         if (oldImage)
             oldImage->removeClient(this);
     }
@@ -146,7 +161,6 @@ void ImageLoader::updateFromElement()
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
-
         toRenderImage(renderer)->resetAnimation();
     }
 }
@@ -161,16 +175,48 @@ void ImageLoader::updateFromElementIgnoringPreviousError()
 void ImageLoader::notifyFinished(CachedResource*)
 {
     ASSERT(m_failedLoadURL.isEmpty());
+
     m_imageComplete = true;
+    if (haveFiredBeforeLoadEvent())
+        updateRenderer();
 
-    loadEventSender().dispatchLoadEventSoon(this);
+    loadEventSender().dispatchEventSoon(this);
+}
 
+void ImageLoader::updateRenderer()
+{
     if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
+        RenderImage* imageRenderer = toRenderImage(renderer);
+        
+        // Only update the renderer if it doesn't have an image or if what we have
+        // is a complete image.  This prevents flickering in the case where a dynamic
+        // change is happening between two images.
+        CachedImage* cachedImage = imageRenderer->cachedImage();
+        if (m_image != cachedImage && (m_imageComplete || !imageRenderer->cachedImage()))
+            imageRenderer->setCachedImage(m_image.get());
+    }
+}
 
-        toRenderImage(renderer)->setCachedImage(m_image.get());
+void ImageLoader::dispatchPendingBeforeLoadEvent()
+{
+    if (m_firedBeforeLoad)
+        return;
+    if (!m_image)
+        return;
+    if (!m_element->document()->attached())
+        return;
+    m_firedBeforeLoad = true;
+    if (m_element->dispatchBeforeLoadEvent(m_image->url())) {
+        updateRenderer();
+        return;
+    }
+    if (m_image) {
+        m_image->removeClient(this);
+        m_image = 0;
     }
+    loadEventSender().cancelEvent(this);
 }
 
 void ImageLoader::dispatchPendingLoadEvent()
@@ -185,24 +231,26 @@ void ImageLoader::dispatchPendingLoadEvent()
     dispatchLoadEvent();
 }
 
-void ImageLoader::dispatchPendingLoadEvents()
+void ImageLoader::dispatchPendingEvents()
 {
-    loadEventSender().dispatchPendingLoadEvents();
+    beforeLoadEventSender().dispatchPendingEvents();
+    loadEventSender().dispatchPendingEvents();
 }
 
-ImageLoadEventSender::ImageLoadEventSender()
-    : m_timer(this, &ImageLoadEventSender::timerFired)
+ImageEventSender::ImageEventSender(const AtomicString& eventType)
+    : m_eventType(eventType)
+    , m_timer(this, &ImageEventSender::timerFired)
 {
 }
 
-void ImageLoadEventSender::dispatchLoadEventSoon(ImageLoader* loader)
+void ImageEventSender::dispatchEventSoon(ImageLoader* loader)
 {
     m_dispatchSoonList.append(loader);
     if (!m_timer.isActive())
         m_timer.startOneShot(0);
 }
 
-void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
+void ImageEventSender::cancelEvent(ImageLoader* loader)
 {
     // Remove instances of this loader from both lists.
     // Use loops because we allow multiple instances to get into the lists.
@@ -220,7 +268,7 @@ void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
         m_timer.stop();
 }
 
-void ImageLoadEventSender::dispatchPendingLoadEvents()
+void ImageEventSender::dispatchPendingEvents()
 {
     // Need to avoid re-entering this function; if new dispatches are
     // scheduled before the parent finishes processing the list, they
@@ -233,15 +281,19 @@ void ImageLoadEventSender::dispatchPendingLoadEvents()
     m_dispatchingList.swap(m_dispatchSoonList);
     size_t size = m_dispatchingList.size();
     for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* loader = m_dispatchingList[i])
-            loader->dispatchPendingLoadEvent();
+        if (ImageLoader* loader = m_dispatchingList[i]) {
+            if (m_eventType == eventNames().beforeloadEvent)
+                loader->dispatchPendingBeforeLoadEvent();
+            else
+                loader->dispatchPendingLoadEvent();
+        }
     }
     m_dispatchingList.clear();
 }
 
-void ImageLoadEventSender::timerFired(Timer<ImageLoadEventSender>*)
+void ImageEventSender::timerFired(Timer<ImageEventSender>*)
 {
-    dispatchPendingLoadEvents();
+    dispatchPendingEvents();
 }
 
 }
diff --git a/WebCore/loader/ImageLoader.h b/WebCore/loader/ImageLoader.h
index 3496f75..7f42e33 100644
--- a/WebCore/loader/ImageLoader.h
+++ b/WebCore/loader/ImageLoader.h
@@ -53,9 +53,10 @@ public:
 
     void setLoadManually(bool loadManually) { m_loadManually = loadManually; }
 
+    bool haveFiredBeforeLoadEvent() const { return m_firedBeforeLoad; }
     bool haveFiredLoadEvent() const { return m_firedLoad; }
 
-    static void dispatchPendingLoadEvents();
+    static void dispatchPendingEvents();
 
 protected:
     virtual void notifyFinished(CachedResource*);
@@ -64,14 +65,18 @@ private:
     virtual void dispatchLoadEvent() = 0;
     virtual String sourceURI(const AtomicString&) const = 0;
 
-    friend class ImageLoadEventSender;
+    friend class ImageEventSender;
+    void dispatchPendingBeforeLoadEvent();
     void dispatchPendingLoadEvent();
 
     void setLoadingImage(CachedImage*);
 
+    void updateRenderer();
+
     Element* m_element;
     CachedResourceHandle<CachedImage> m_image;
     AtomicString m_failedLoadURL;
+    bool m_firedBeforeLoad : 1;
     bool m_firedLoad : 1;
     bool m_imageComplete : 1;
     bool m_loadManually : 1;
diff --git a/WebCore/loader/MainResourceLoader.cpp b/WebCore/loader/MainResourceLoader.cpp
index e7bdbcb..c37daef 100644
--- a/WebCore/loader/MainResourceLoader.cpp
+++ b/WebCore/loader/MainResourceLoader.cpp
@@ -77,7 +77,7 @@ void MainResourceLoader::receivedError(const ResourceError& error)
 
     if (!cancelled()) {
         ASSERT(!reachedTerminalState());
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
         
         releaseResources();
     }
diff --git a/WebCore/loader/PolicyCallback.h b/WebCore/loader/PolicyCallback.h
index 2aa7c7c..757fff8 100644
--- a/WebCore/loader/PolicyCallback.h
+++ b/WebCore/loader/PolicyCallback.h
@@ -37,43 +37,43 @@
 
 namespace WebCore {
 
-    class FormState;
+class FormState;
 
-    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
+typedef void (*NavigationPolicyDecisionFunction)(void* argument,
+    const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
+    const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
 
-    class PolicyCallback {
-    public:
-        PolicyCallback();
-        ~PolicyCallback();
+class PolicyCallback {
+public:
+    PolicyCallback();
+    ~PolicyCallback();
 
-        void clear();
-        void set(const ResourceRequest&, PassRefPtr<FormState>,
-            NavigationPolicyDecisionFunction, void* argument);
-        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
-            NewWindowPolicyDecisionFunction, void* argument);
-        void set(ContentPolicyDecisionFunction, void* argument);
+    void clear();
+    void set(const ResourceRequest&, PassRefPtr<FormState>,
+        NavigationPolicyDecisionFunction, void* argument);
+    void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
+        NewWindowPolicyDecisionFunction, void* argument);
+    void set(ContentPolicyDecisionFunction, void* argument);
 
-        const ResourceRequest& request() const { return m_request; }
-        void clearRequest();
+    const ResourceRequest& request() const { return m_request; }
+    void clearRequest();
 
-        void call(bool shouldContinue);
-        void call(PolicyAction);
-        void cancel();
+    void call(bool shouldContinue);
+    void call(PolicyAction);
+    void cancel();
 
-    private:
-        ResourceRequest m_request;
-        RefPtr<FormState> m_formState;
-        String m_frameName;
+private:
+    ResourceRequest m_request;
+    RefPtr<FormState> m_formState;
+    String m_frameName;
 
-        NavigationPolicyDecisionFunction m_navigationFunction;
-        NewWindowPolicyDecisionFunction m_newWindowFunction;
-        ContentPolicyDecisionFunction m_contentFunction;
-        void* m_argument;
-    };
+    NavigationPolicyDecisionFunction m_navigationFunction;
+    NewWindowPolicyDecisionFunction m_newWindowFunction;
+    ContentPolicyDecisionFunction m_contentFunction;
+    void* m_argument;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/loader/PolicyChecker.h b/WebCore/loader/PolicyChecker.h
index c667f5b..541729c 100644
--- a/WebCore/loader/PolicyChecker.h
+++ b/WebCore/loader/PolicyChecker.h
@@ -38,59 +38,59 @@
 
 namespace WebCore {
 
-    class DocumentLoader;
-    class FormState;
-    class Frame;
-    class NavigationAction;
-    class ResourceError;
-    class ResourceResponse;
-
-    class PolicyChecker : public Noncopyable {
-    public:
-        PolicyChecker(Frame*);
-
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
-        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, NewWindowPolicyDecisionFunction, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, void* argument);
-        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
-
-        // FIXME: These are different.  They could use better names.
-        void cancelCheck();
-        void stopCheck();
-
-        void cannotShowMIMEType(const ResourceResponse&);
-
-        FrameLoadType loadType() const { return m_loadType; }
-        void setLoadType(FrameLoadType loadType) { m_loadType = loadType; }
-
-        bool delegateIsDecidingNavigationPolicy() const { return m_delegateIsDecidingNavigationPolicy; }
-        bool delegateIsHandlingUnimplementablePolicy() const { return m_delegateIsHandlingUnimplementablePolicy; }
-
-        // FIXME: This function is a cheat.  Basically, this is just an asynchronouc callback
-        // from the FrameLoaderClient, but this callback uses the policy types and so has to
-        // live on this object.  In the long term, we should create a type for non-policy
-        // callbacks from the FrameLoaderClient and remove this vestige.  I just don't have
-        // the heart to hack on all the platforms to make that happen right now.
-        void continueLoadAfterWillSubmitForm(PolicyAction);
-
-    private:
-        void continueAfterNavigationPolicy(PolicyAction);
-        void continueAfterNewWindowPolicy(PolicyAction);
-        void continueAfterContentPolicy(PolicyAction);
-
-        void handleUnimplementablePolicy(const ResourceError&);
-
-        Frame* m_frame;
-
-        bool m_delegateIsDecidingNavigationPolicy;
-        bool m_delegateIsHandlingUnimplementablePolicy;
-
-        // This identifies the type of navigation action which prompted this load. Note 
-        // that WebKit conveys this value as the WebActionNavigationTypeKey value
-        // on navigation action delegate callbacks.
-        FrameLoadType m_loadType;
-        PolicyCallback m_callback;
-    };
+class DocumentLoader;
+class FormState;
+class Frame;
+class NavigationAction;
+class ResourceError;
+class ResourceResponse;
+
+class PolicyChecker : public Noncopyable {
+public:
+    PolicyChecker(Frame*);
+
+    void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+    void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
+    void checkNewWindowPolicy(const NavigationAction&, NewWindowPolicyDecisionFunction, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, void* argument);
+    void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
+
+    // FIXME: These are different.  They could use better names.
+    void cancelCheck();
+    void stopCheck();
+
+    void cannotShowMIMEType(const ResourceResponse&);
+
+    FrameLoadType loadType() const { return m_loadType; }
+    void setLoadType(FrameLoadType loadType) { m_loadType = loadType; }
+
+    bool delegateIsDecidingNavigationPolicy() const { return m_delegateIsDecidingNavigationPolicy; }
+    bool delegateIsHandlingUnimplementablePolicy() const { return m_delegateIsHandlingUnimplementablePolicy; }
+
+    // FIXME: This function is a cheat.  Basically, this is just an asynchronouc callback
+    // from the FrameLoaderClient, but this callback uses the policy types and so has to
+    // live on this object.  In the long term, we should create a type for non-policy
+    // callbacks from the FrameLoaderClient and remove this vestige.  I just don't have
+    // the heart to hack on all the platforms to make that happen right now.
+    void continueLoadAfterWillSubmitForm(PolicyAction);
+
+private:
+    void continueAfterNavigationPolicy(PolicyAction);
+    void continueAfterNewWindowPolicy(PolicyAction);
+    void continueAfterContentPolicy(PolicyAction);
+
+    void handleUnimplementablePolicy(const ResourceError&);
+
+    Frame* m_frame;
+
+    bool m_delegateIsDecidingNavigationPolicy;
+    bool m_delegateIsHandlingUnimplementablePolicy;
+
+    // This identifies the type of navigation action which prompted this load. Note 
+    // that WebKit conveys this value as the WebActionNavigationTypeKey value
+    // on navigation action delegate callbacks.
+    FrameLoadType m_loadType;
+    PolicyCallback m_callback;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
index 819cbdd..c0d78ae 100644
--- a/WebCore/loader/RedirectScheduler.cpp
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -255,12 +255,20 @@ void RedirectScheduler::scheduleHistoryNavigation(int steps)
     if (!m_frame->page())
         return;
 
+    // Invalid history navigations (such as history.forward() during a new load) have the side effect of cancelling any scheduled
+    // redirects. We also avoid the possibility of cancelling the current load by avoiding the scheduled redirection altogether.
+    if (!m_frame->page()->canGoBackOrForward(steps)) { 
+        cancel(); 
+        return; 
+    } 
+
     schedule(new ScheduledRedirection(steps));
 }
 
 void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
 {
-    ASSERT(m_frame->page());
+    if (!m_frame->page())
+        return;
 
     if (m_frame->page()->defersLoading())
         return;
@@ -277,13 +285,12 @@ void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
         case ScheduledRedirection::historyNavigation:
             if (redirection->historySteps == 0) {
                 // Special case for go(0) from a frame -> reload only the frame
-                loader->urlSelected(loader->url(), "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
+                loader->urlSelected(loader->url(), "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, SendReferrer);
                 return;
             }
             // go(i!=0) from a frame navigates into the history of the frame only,
             // in both IE and NS (but not in Mozilla). We can't easily do that.
-            if (m_frame->page()->canGoBackOrForward(redirection->historySteps))
-                m_frame->page()->goBackOrForward(redirection->historySteps);
+            m_frame->page()->goBackOrForward(redirection->historySteps);
             return;
         case ScheduledRedirection::formSubmission:
             // The submitForm function will find a target frame before using the redirection timer.
@@ -293,7 +300,7 @@ void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
             if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
                 return;
             loader->loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
-                redirection->event, redirection->formState);
+                redirection->event, redirection->formState, SendReferrer);
             return;
     }
 
diff --git a/WebCore/loader/RedirectScheduler.h b/WebCore/loader/RedirectScheduler.h
index bf076d6..005a173 100644
--- a/WebCore/loader/RedirectScheduler.h
+++ b/WebCore/loader/RedirectScheduler.h
@@ -39,42 +39,42 @@
 
 namespace WebCore {
 
-    class FormState;
-    class Frame;
-    class String;
+class FormState;
+class Frame;
+class String;
 
-    struct FrameLoadRequest;
-    struct ScheduledRedirection;
+struct FrameLoadRequest;
+struct ScheduledRedirection;
 
-    class RedirectScheduler : public Noncopyable {
-    public:
-        RedirectScheduler(Frame*);
-        ~RedirectScheduler();
+class RedirectScheduler : public Noncopyable {
+public:
+    RedirectScheduler(Frame*);
+    ~RedirectScheduler();
 
-        bool redirectScheduledDuringLoad();
-        bool locationChangePending();
+    bool redirectScheduledDuringLoad();
+    bool locationChangePending();
 
-        void scheduleRedirect(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
-        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
-        void scheduleRefresh(bool userGesture = false);
-        void scheduleHistoryNavigation(int steps);
+    void scheduleRedirect(double delay, const String& url);
+    void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
+    void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+    void scheduleRefresh(bool userGesture = false);
+    void scheduleHistoryNavigation(int steps);
 
-        void startTimer();
+    void startTimer();
 
-        void cancel(bool newLoadInProgress = false);
-        void clear();
+    void cancel(bool newLoadInProgress = false);
+    void clear();
 
-    private:
-        void timerFired(Timer<RedirectScheduler>*);
-        void schedule(PassOwnPtr<ScheduledRedirection>);
+private:
+    void timerFired(Timer<RedirectScheduler>*);
+    void schedule(PassOwnPtr<ScheduledRedirection>);
 
-        static bool mustLockBackForwardList(Frame* targetFrame);
+    static bool mustLockBackForwardList(Frame* targetFrame);
 
-        Frame* m_frame;
-        Timer<RedirectScheduler> m_timer;
-        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
-    };
+    Frame* m_frame;
+    Timer<RedirectScheduler> m_timer;
+    OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/loader/ResourceLoadNotifier.cpp b/WebCore/loader/ResourceLoadNotifier.cpp
new file mode 100644
index 0000000..4cddd01
--- /dev/null
+++ b/WebCore/loader/ResourceLoadNotifier.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ResourceLoadNotifier.h"
+
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "InspectorController.h"
+#include "Page.h"
+#include "ProgressTracker.h"
+#include "ResourceLoader.h"
+
+namespace WebCore {
+
+ResourceLoadNotifier::ResourceLoadNotifier(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+void ResourceLoadNotifier::didReceiveAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
+{
+    m_frame->loader()->client()->dispatchDidReceiveAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
+}
+
+void ResourceLoadNotifier::didCancelAuthenticationChallenge(ResourceLoader* loader, const AuthenticationChallenge& currentWebChallenge)
+{
+    m_frame->loader()->client()->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
+}
+
+void ResourceLoadNotifier::willSendRequest(ResourceLoader* loader, ResourceRequest& clientRequest, const ResourceResponse& redirectResponse)
+{
+    m_frame->loader()->applyUserAgent(clientRequest);
+
+    dispatchWillSendRequest(loader->documentLoader(), loader->identifier(), clientRequest, redirectResponse);
+}
+
+void ResourceLoadNotifier::didReceiveResponse(ResourceLoader* loader, const ResourceResponse& r)
+{
+    loader->documentLoader()->addResponse(r);
+
+    if (Page* page = m_frame->page())
+        page->progress()->incrementProgress(loader->identifier(), r);
+
+    dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
+}
+
+void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
+{
+    if (Page* page = m_frame->page())
+        page->progress()->incrementProgress(loader->identifier(), data, length);
+
+    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
+}
+
+void ResourceLoadNotifier::didFinishLoad(ResourceLoader* loader)
+{    
+    if (Page* page = m_frame->page())
+        page->progress()->completeProgress(loader->identifier());
+    dispatchDidFinishLoading(loader->documentLoader(), loader->identifier());
+}
+
+void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceError& error)
+{
+    if (Page* page = m_frame->page())
+        page->progress()->completeProgress(loader->identifier());
+
+    if (!error.isNull())
+        m_frame->loader()->client()->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
+}
+
+void ResourceLoadNotifier::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
+{
+    m_frame->loader()->client()->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+}
+
+void ResourceLoadNotifier::assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
+{
+    m_frame->loader()->client()->assignIdentifierToInitialRequest(identifier, loader, request);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    StringImpl* oldRequestURL = request.url().string().impl();
+    m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
+
+    m_frame->loader()->client()->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
+
+    // If the URL changed, then we want to put that new URL in the "did tell client" set too.
+    if (!request.isNull() && oldRequestURL != request.url().string().impl())
+        m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
+{
+    m_frame->loader()->client()->dispatchDidReceiveResponse(loader, identifier, r);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didReceiveResponse(loader, identifier, r);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
+{
+    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, length);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+#endif
+}
+
+void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
+{
+    m_frame->loader()->client()->dispatchDidFinishLoading(loader, identifier);
+
+#if ENABLE(INSPECTOR)
+    if (Page* page = m_frame->page())
+        page->inspectorController()->didFinishLoading(loader, identifier);
+#endif
+}
+
+void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
+{
+    if (!response.isNull())
+        dispatchDidReceiveResponse(loader, identifier, response);
+
+    if (length > 0)
+        dispatchDidReceiveContentLength(loader, identifier, length);
+
+    if (error.isNull())
+        dispatchDidFinishLoading(loader, identifier);
+    else
+        m_frame->loader()->client()->dispatchDidFailLoading(loader, identifier, error);
+}
+
+} // namespace WebCore
diff --git a/WebCore/loader/ResourceLoadNotifier.h b/WebCore/loader/ResourceLoadNotifier.h
new file mode 100644
index 0000000..b09d7be
--- /dev/null
+++ b/WebCore/loader/ResourceLoadNotifier.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ResourceLoadNotifier_h
+#define ResourceLoadNotifier_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AuthenticationChallenge;
+class DocumentLoader;
+class Frame;
+class ResourceError;
+class ResourceLoader;
+class ResourceResponse;
+class ScriptString;
+struct ResourceRequest;
+
+class ResourceLoadNotifier : public Noncopyable {
+public:
+    ResourceLoadNotifier(Frame*);
+
+    void didReceiveAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
+    void didCancelAuthenticationChallenge(ResourceLoader*, const AuthenticationChallenge&);
+
+    void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
+    void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
+    void didFinishLoad(ResourceLoader*);
+    void didFailToLoad(ResourceLoader*, const ResourceError&);
+    void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+
+    void assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
+    void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
+    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
+    void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
+
+    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+
+private:
+    Frame* m_frame;
+};
+
+} // namespace WebCore
+
+#endif // ResourceLoadNotifier_h
diff --git a/WebCore/loader/ResourceLoader.cpp b/WebCore/loader/ResourceLoader.cpp
index 2dac844..fcc9f61 100644
--- a/WebCore/loader/ResourceLoader.cpp
+++ b/WebCore/loader/ResourceLoader.cpp
@@ -199,18 +199,18 @@ void ResourceLoader::willSendRequest(ResourceRequest& request, const ResourceRes
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-        
+
     ASSERT(!m_reachedTerminalState);
 
     if (m_sendResourceLoadCallbacks) {
         if (!m_identifier) {
             m_identifier = m_frame->page()->progress()->createUniqueIdentifier();
-            frameLoader()->assignIdentifierToInitialRequest(m_identifier, request);
+            frameLoader()->notifier()->assignIdentifierToInitialRequest(m_identifier, documentLoader(), request);
         }
 
-        frameLoader()->willSendRequest(this, request, redirectResponse);
+        frameLoader()->notifier()->willSendRequest(this, request, redirectResponse);
     }
-    
+
     m_request = request;
 }
 
@@ -232,7 +232,7 @@ void ResourceLoader::didReceiveResponse(const ResourceResponse& r)
         data->removeGeneratedFilesIfNeeded();
         
     if (m_sendResourceLoadCallbacks)
-        frameLoader()->didReceiveResponse(this, m_response);
+        frameLoader()->notifier()->didReceiveResponse(this, m_response);
 }
 
 void ResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
@@ -252,7 +252,7 @@ void ResourceLoader::didReceiveData(const char* data, int length, long long leng
     // However, with today's computers and networking speeds, this won't happen in practice.
     // Could be an issue with a giant local file.
     if (m_sendResourceLoadCallbacks && m_frame)
-        frameLoader()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
+        frameLoader()->notifier()->didReceiveData(this, data, length, static_cast<int>(lengthReceived));
 }
 
 void ResourceLoader::willStopBufferingData(const char* data, int length)
@@ -286,7 +286,7 @@ void ResourceLoader::didFinishLoadingOnePart()
         return;
     m_calledDidFinishLoad = true;
     if (m_sendResourceLoadCallbacks)
-        frameLoader()->didFinishLoad(this);
+        frameLoader()->notifier()->didFinishLoad(this);
 }
 
 void ResourceLoader::didFail(const ResourceError& error)
@@ -303,7 +303,7 @@ void ResourceLoader::didFail(const ResourceError& error)
         data->removeGeneratedFilesIfNeeded();
 
     if (m_sendResourceLoadCallbacks && !m_calledDidFinishLoad)
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
 
     releaseResources();
 }
@@ -332,7 +332,7 @@ void ResourceLoader::didCancel(const ResourceError& error)
         m_handle = 0;
     }
     if (m_sendResourceLoadCallbacks && !m_calledDidFinishLoad)
-        frameLoader()->didFailToLoad(this, error);
+        frameLoader()->notifier()->didFailToLoad(this, error);
 
     releaseResources();
 }
@@ -435,7 +435,7 @@ void ResourceLoader::didReceiveAuthenticationChallenge(const AuthenticationChall
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-    frameLoader()->didReceiveAuthenticationChallenge(this, challenge);
+    frameLoader()->notifier()->didReceiveAuthenticationChallenge(this, challenge);
 }
 
 void ResourceLoader::didCancelAuthenticationChallenge(const AuthenticationChallenge& challenge)
@@ -443,7 +443,7 @@ void ResourceLoader::didCancelAuthenticationChallenge(const AuthenticationChalle
     // Protect this in this delegate method since the additional processing can do
     // anything including possibly derefing this; one example of this is Radar 3266216.
     RefPtr<ResourceLoader> protector(this);
-    frameLoader()->didCancelAuthenticationChallenge(this, challenge);
+    frameLoader()->notifier()->didCancelAuthenticationChallenge(this, challenge);
 }
 
 void ResourceLoader::receivedCancellation(const AuthenticationChallenge&)
diff --git a/WebCore/manual-tests/crash-on-accessing-domwindow-without-frame.html b/WebCore/manual-tests/crash-on-accessing-domwindow-without-frame.html
new file mode 100644
index 0000000..77dd115
--- /dev/null
+++ b/WebCore/manual-tests/crash-on-accessing-domwindow-without-frame.html
@@ -0,0 +1,22 @@
+<script>
+var w;
+function clear() {
+    // Id doesn't matter, the crash happens while trying to access the NULL Document to lookup the Id.
+    w.clearTimeout(153);
+}
+
+function test() {
+    w = window.open("data:text/html,"+
+        "<script>" +
+        "function navigate() { location.href='data:text/html,<body>Close this page and wait.</body>'};" +
+        "setTimeout(navigate,0);</" + 
+        "script>");
+
+    setInterval(clear, 20);
+}
+</script>
+<body><p>This test reproduces the crash that happens when JavaScript has access to DOMWindow which is disconnected from its Frame. This crash was fixed by http://trac.webkit.org/changeset/49786</p>
+To reproduce the crash:
+<ul><li>Click the link below, the popup window opens.</li><li>Close the popup window.</li><li>Wait about 10 seconds (~10, page cache should start deleting pages) and observe the crash.</li></ul>
+Crashes on Safari 4.0.3</p><p><a href="javascript:test()">Crash me!</a></p>
+</body>
diff --git a/WebCore/manual-tests/inspector/duplicate-resource-urls.html b/WebCore/manual-tests/inspector/duplicate-resource-urls.html
new file mode 100644
index 0000000..7a9be7e
--- /dev/null
+++ b/WebCore/manual-tests/inspector/duplicate-resource-urls.html
@@ -0,0 +1,61 @@
+<html>
+<head>
+<title>Tests for Bug 30079</title>
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >
+</head>
+
+<body>
+<p>Tests for 
+<ul>    
+<li><p><a href="https://bugs.webkit.org/show_bug.cgi?id=30079">Bug 30079: unselectable resources in resource panel</a>
+</ul>
+
+<p>To test, open the Inspector on this page, go to the Resources panel.
+
+<p>First off, you should be able to actually select each "abc" resource to see
+the HTTP info / content.  Bug 30079 didn't allow you to select all of these.
+    
+<p>For each of the "abc" resources open the <b>HTTP Information</b> and 
+<b>Request Payload</b> tree elements above the content.  One of the resources 
+will not have a <b>Request Payload</b>.
+
+<p>There should be one each of the following resources:
+    
+<ul>
+<li><p>One with a Request Method: GET and no Request Payload
+<li><p>One with a Request Method: POST and Request Payload of "123"
+<li><p>One with a Request Method: POST and Request Payload of "456"
+</ul>
+
+<p>Another change made by this bug was to change the way the drag/drop of
+the resource itself worked.  The previous method of handling drag/drop of
+the resource was actually causing the unselectability.  So the drag/drop
+of the resources needs to be tested as well.
+
+<ul>
+<li><p>Select one of the resources.
+<li><p>Drag it to an application that can accept text or a link
+<li><p>The application should provide some feedback indicating it will accept
+the drop, but may not
+<li>Drop, and the URL for the resource should be rendered appropriately.
+    
+<script>
+
+var xhr;
+
+xhr = new XMLHttpRequest();
+xhr.open("POST", "http://example.org/abc");
+xhr.send("123");
+
+xhr = new XMLHttpRequest();
+xhr.open("POST", "http://example.org/abc");
+xhr.send("456");
+
+xhr = new XMLHttpRequest();
+xhr.open("GET", "http://example.org/abc");
+xhr.send();
+
+</script>
+
+</body>
+</html>
diff --git a/WebCore/manual-tests/keyboard-menukey-event.html b/WebCore/manual-tests/keyboard-menukey-event.html
new file mode 100644
index 0000000..bd2c8e7
--- /dev/null
+++ b/WebCore/manual-tests/keyboard-menukey-event.html
@@ -0,0 +1,31 @@
+<html lang="en">
+  <head>
+    <META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+    <title>Menu key testing</title>
+    <script language="javascript" type="text/javascript">
+      function log(str) {
+        var li = document.createElement("li");
+        li.appendChild(document.createTextNode(str));
+        var results = document.getElementById("results");
+        results.appendChild(li);
+      }
+    </script>
+  </head>
+  <body>
+    <p>
+    See bug: <a href="https://bugs.webkit.org/show_bug.cgi?id=30619">30619</a>.
+    Note: this test is only applicable for Linux and Windows.
+    </p>
+    <ol>
+      <li>Click the text input box below and press Menu key.
+          The test passes if you see 'PASS' below.
+        <input type="text" oncontextmenu="log('PASS');" />
+      </li>
+      <li oncontextmenu="log('PASS');">Click or select somewhere
+      in this text and press Menu key.
+      The test passes if you see additional 'PASS' below.
+      </li>
+    </ol>
+    <ul id="results"></ul>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/plugins/test.swf b/WebCore/manual-tests/plugins/test.swf
new file mode 100644
index 0000000..8952982
--- /dev/null
+++ b/WebCore/manual-tests/plugins/test.swf
diff --git a/WebCore/manual-tests/plugins/windowed.html b/WebCore/manual-tests/plugins/windowed.html
new file mode 100644
index 0000000..4020408
--- /dev/null
+++ b/WebCore/manual-tests/plugins/windowed.html
@@ -0,0 +1,97 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Transparent Flash Test File</title>
+<style>
+    #overlayDiv {
+        position: relative;
+        color: white;
+        background: black;
+        top: 50px;
+        left: -50px;
+        width: 200px;
+        opacity: 0.6;
+        float: left;
+        z-index: 1;
+        display: none;
+    } 
+    embed { 
+        float: left; 
+        -webkit-transition: -webkit-transform 3s ease-in;
+    }
+</style>
+<script>
+    function testResize() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        flashPlugin.width = flashPlugin.width == "200" ? "100" : "200";
+        flashPlugin.height = flashPlugin.height == "200" ? "100" : "200";
+    }
+
+    function testMove() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        var t = parseInt(flashPlugin.style.top);
+        flashPlugin.style['padding-left'] = "100px";
+    }
+
+    function testAnimation() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        flashPlugin.style.webkitTransform='rotate(180deg)';
+    }
+
+    function toggleDivOverFlash() {
+        var overlayDiv = document.getElementById('overlayDiv');
+        if (overlayDiv.style.display != 'block') {
+            overlayDiv.style.display = 'block';
+        } else {
+            overlayDiv.style.display = '';
+        }
+    }
+</script>
+</head>
+
+<body>
+
+    <b> Verify the following tests with and without the page scrolled (including seeming unrelated test cases like printing). <br/>
+        For the Qt port, test with both QtLauncher and QGVLauncher </b> <br/><br/>
+
+    <!-- <embed id="flashPlugin" src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" --!>
+    <embed id="flashPlugin" src="test.swf"
+           width="200" height="200"
+           type="application/x-shockwave-flash">
+    </embed>
+
+    <div id="overlayDiv"> This is an overlay that will display over the flash. In addition, you should be able to see
+            the flash through the div contents. </div>
+
+    <div style="clear:both"/>
+
+    <input type="checkbox" name="resizeCheckBox"> Verify if the flash resizes when element is resized
+            <input type="button" id="resizeButton" value="Test Resize" onClick="testResize()"/><br/>
+
+    <input type="checkbox" name="moveCheckBox"> Verify if the flash moves when element is moved
+            <input type="button" id="moveButton" value="Test Move" onClick="testMove()"/><br/>
+
+    <input type="checkbox" name="animationCheckBox"> Verify css animations with flash
+            <input type="button" id="animationButton" value="Test Animation" onClick="testAnimation()"/><br/>
+
+    <input type="checkbox" name="printCheckBox"> Verify if printing displays flash on the print preview and printer output <br/>
+
+    <input type="checkbox" name="zoomCheckBox"> Verify if elements in flash are correctly painted and clickable after zooming <br/>
+
+    <input type="checkbox" name="screenshotBox"> Verify if taking a screenshot from QtLauncher display flash <br/>
+
+    <input type="checkbox" name="paintSystemsCheckBox"> Verify if flash is displayed with graphicssystems - raster, opengl <br/>
+
+    <input type="checkbox" name="focusCheckBox"> Verify if shifting focus back and forth from flash to html works
+            <input value="Shift focus here"/></br/>
+
+    <input type="checkbox" name="testZIndex"> Test if html can display over flash
+            <input type="button" value="Toggle transparent div" onClick="toggleDivOverFlash()"<br/>
+
+    <input type="checkbox" name="testZIndex"> Test opaque mode by setting wmode to opaque <br/>
+
+    <br/>
+</body>
+
+</html>
diff --git a/WebCore/manual-tests/plugins/windowless.html b/WebCore/manual-tests/plugins/windowless.html
new file mode 100644
index 0000000..b553526
--- /dev/null
+++ b/WebCore/manual-tests/plugins/windowless.html
@@ -0,0 +1,96 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<title>Transparent Flash Test File</title>
+<style>
+    #overlayDiv {
+        position: relative;
+        color: white;
+        background: black;
+        top: 50px;
+        left: -50px;
+        width: 200px;
+        opacity: 0.6;
+        float: left;
+        z-index: 1;
+        display: none;
+    } 
+    embed { 
+        float: left; 
+        -webkit-transition: -webkit-transform 3s ease-in;
+    }
+</style>
+<script>
+    function testResize() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        flashPlugin.width = flashPlugin.width == "200" ? "100" : "200";
+        flashPlugin.height = flashPlugin.height == "200" ? "100" : "200";
+    }
+
+    function testMove() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        var t = parseInt(flashPlugin.style.top);
+        flashPlugin.style['padding-left'] = "100px";
+    }
+
+    function testAnimation() {
+        var flashPlugin = document.getElementById('flashPlugin');
+        flashPlugin.style.webkitTransform='rotate(180deg)';
+    }
+
+    function toggleDivOverFlash() {
+        var overlayDiv = document.getElementById('overlayDiv');
+        if (overlayDiv.style.display != 'block') {
+            overlayDiv.style.display = 'block';
+        } else {
+            overlayDiv.style.display = '';
+        }
+    }
+</script>
+</head>
+
+<body>
+
+    <b> Verify the following tests with and without the page scrolled (including seeming unrelated test cases like printing). <br/>
+        For the Qt port, test with both QtLauncher and QGVLauncher </b> <br/><br/>
+
+    <!-- <embed id="flashPlugin" src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" --!>
+    <embed id="flashPlugin" src="test.swf"
+           width="200" height="200"
+           wmode="transparent"
+           type="application/x-shockwave-flash">
+    </embed>
+
+    <div id="overlayDiv"> This is an overlay that will display over the flash. In addition, you should be able to see
+            the flash through the div contents. </div>
+
+    <div style="clear:both"/>
+
+    <input type="checkbox" name="resizeCheckBox"> Verify if the flash resizes when element is resized
+            <input type="button" id="resizeButton" value="Test Resize" onClick="testResize()"/><br/>
+
+    <input type="checkbox" name="moveCheckBox"> Verify if the flash moves when element is moved
+            <input type="button" id="moveButton" value="Test Move" onClick="testMove()"/><br/>
+
+    <input type="checkbox" name="animationCheckBox"> Verify css animations with flash
+            <input type="button" id="animationButton" value="Test Animation" onClick="testAnimation()"/><br/>
+
+    <input type="checkbox" name="printCheckBox"> Verify if printing displays flash on the print preview and printer output <br/>
+
+    <input type="checkbox" name="zoomCheckBox"> Verify if elements in flash are correctly painted and clickable after zooming <br/>
+
+    <input type="checkbox" name="screenshotBox"> Verify if taking a screenshot from QtLauncher display flash <br/>
+
+    <input type="checkbox" name="paintSystemsCheckBox"> Verify if flash is displayed with graphicssystems - raster, opengl <br/>
+
+    <input type="checkbox" name="focusCheckBox"> Verify if shifting focus back and forth from flash to html works
+            <input value="Shift focus here"/></br/>
+
+    <input type="checkbox" name="testZIndex"> Test if html can display over flash
+            <input type="button" value="Toggle transparent div" onClick="toggleDivOverFlash()"<br/>
+
+    <br/>
+</body>
+
+</html>
diff --git a/WebCore/manual-tests/qt/plugin-sibling-frame-include.html b/WebCore/manual-tests/qt/plugin-sibling-frame-include.html
index ca509e9..e59867c 100644
--- a/WebCore/manual-tests/qt/plugin-sibling-frame-include.html
+++ b/WebCore/manual-tests/qt/plugin-sibling-frame-include.html
@@ -7,7 +7,8 @@
 
 <body bgcolor="#000">
 
-    <embed src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" 
+    <!-- <embed id="flashPlugin" src="http://www.youtube.com/v/loXfcsXRB-w&#038;hl=en&#038;fs=1" --!>
+    <embed src="../plugins/test.swf"
             type="application/x-shockwave-flash">
     </embed>
     
diff --git a/WebCore/notifications/NotificationCenter.cpp b/WebCore/notifications/NotificationCenter.cpp
index 94976a2..69b0075 100644
--- a/WebCore/notifications/NotificationCenter.cpp
+++ b/WebCore/notifications/NotificationCenter.cpp
@@ -40,6 +40,20 @@
 
 namespace WebCore {
 
+#if USE(V8)
+static bool notificationCenterAvailable = false;
+
+void NotificationCenter::setIsAvailable(bool available)
+{
+    notificationCenterAvailable = available;
+}
+
+bool NotificationCenter::isAvailable()
+{
+    return notificationCenterAvailable;
+}
+#endif
+
 NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
     : ActiveDOMObject(context, this)
     , m_scriptExecutionContext(context)
diff --git a/WebCore/notifications/NotificationCenter.h b/WebCore/notifications/NotificationCenter.h
index 596ab8b..1084442 100644
--- a/WebCore/notifications/NotificationCenter.h
+++ b/WebCore/notifications/NotificationCenter.h
@@ -47,8 +47,12 @@ namespace WebCore {
 
     class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
     public:
+#if USE(V8)
+        static void setIsAvailable(bool);
+        static bool isAvailable();
+#endif
         static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
-        
+
         Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
         {
             return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index 51928d4..1935f56 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -46,9 +46,15 @@
 
 #include "ScriptCallStack.h"
 #include <stdio.h>
+<<<<<<< HEAD:WebCore/page/Console.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Console.cpp
 #include <wtf/UnusedParam.h>
+<<<<<<< HEAD:WebCore/page/Console.cpp
 #endif
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Console.cpp
 
 namespace WebCore {
 
@@ -250,8 +256,7 @@ void Console::assertCondition(bool condition, ScriptCallStack* callStack)
     if (condition)
         return;
 
-    // FIXME: <https://bugs.webkit.org/show_bug.cgi?id=19135> It would be nice to prefix assertion failures with a message like "Assertion failed: ".
-    addMessage(LogMessageType, ErrorMessageLevel, callStack, true);
+    addMessage(AssertMessageType, ErrorMessageLevel, callStack, true);
 }
 
 void Console::count(ScriptCallStack* callStack)
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index 08d43e3..1b93a4a 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -64,7 +64,8 @@ namespace WebCore {
         ObjectMessageType,
         TraceMessageType,
         StartGroupMessageType,
-        EndGroupMessageType
+        EndGroupMessageType,
+        AssertMessageType
     };
 
     enum MessageLevel {
diff --git a/WebCore/page/ContextMenuController.cpp b/WebCore/page/ContextMenuController.cpp
index 1cf0014..7d773ca 100644
--- a/WebCore/page/ContextMenuController.cpp
+++ b/WebCore/page/ContextMenuController.cpp
@@ -217,7 +217,7 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         break;
     case ContextMenuItemTagOpenLink:
         if (Frame* targetFrame = result.targetFrame())
-            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0);
+            targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), frame->loader()->outgoingReferrer())), false, false, 0, 0, SendReferrer);
         else
             openNewWindow(result.absoluteLinkURL(), frame);
         break;
diff --git a/WebCore/page/DOMTimer.cpp b/WebCore/page/DOMTimer.cpp
index dd1e842..83bcb02 100644
--- a/WebCore/page/DOMTimer.cpp
+++ b/WebCore/page/DOMTimer.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "DOMTimer.h"
 
+#include "InspectorTimelineAgent.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/HashSet.h>
@@ -87,6 +88,12 @@ int DOMTimer::install(ScriptExecutionContext* context, ScheduledAction* action,
     // The timer is deleted when context is deleted (DOMTimer::contextDestroyed) or explicitly via DOMTimer::removeById(),
     // or if it is a one-time timer and it has fired (DOMTimer::fired).
     DOMTimer* timer = new DOMTimer(context, action, timeout, singleShot);
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
+        timelineAgent->didInstallTimer(timer->m_timeoutId, timeout, singleShot);
+#endif    
+
     return timer->m_timeoutId;
 }
 
@@ -97,6 +104,12 @@ void DOMTimer::removeById(ScriptExecutionContext* context, int timeoutId)
     // respectively
     if (timeoutId <= 0)
         return;
+
+#if ENABLE(INSPECTOR)
+    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
+        timelineAgent->didRemoveTimer(timeoutId);
+#endif
+
     delete context->findTimeout(timeoutId);
 }
 
@@ -105,6 +118,12 @@ void DOMTimer::fired()
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context);
+    if (timelineAgent)
+        timelineAgent->willFireTimer(m_timeoutId);
+#endif
+
     // Simple case for non-one-shot timers.
     if (isActive()) {
         if (repeatInterval() && repeatInterval() < s_minTimerInterval) {
@@ -115,6 +134,10 @@ void DOMTimer::fired()
 
         // No access to member variables after this point, it can delete the timer.
         m_action->execute(context);
+#if ENABLE(INSPECTOR)
+        if (timelineAgent)
+            timelineAgent->didFireTimer();
+#endif
         return;
     }
 
@@ -125,6 +148,10 @@ void DOMTimer::fired()
     delete this;
 
     action->execute(context);
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didFireTimer();
+#endif
     delete action;
     timerNestingLevel = 0;
 }
diff --git a/WebCore/page/DOMTimer.h b/WebCore/page/DOMTimer.h
index 3c65258..460430f 100644
--- a/WebCore/page/DOMTimer.h
+++ b/WebCore/page/DOMTimer.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class InspectorTimelineAgent;
     class ScheduledAction;
 
     class DOMTimer : public TimerBase, public ActiveDOMObject {
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index c8eafe6..dfafa35 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -163,15 +163,15 @@ module window {
         readonly attribute DOMApplicationCache applicationCache;
 #endif    
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
+        [EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
             raises(DOMException);
 #endif
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-        readonly attribute Storage sessionStorage;
-        readonly attribute Storage localStorage;
+        readonly attribute [EnabledAtRuntime] Storage sessionStorage;
+        readonly attribute [EnabledAtRuntime] Storage localStorage;
 #endif
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
-        readonly attribute NotificationCenter webkitNotifications;
+        readonly attribute [EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
 
 #if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
@@ -436,6 +436,7 @@ module window {
         attribute HTMLUListElementConstructor HTMLUListElement;
 
         attribute HTMLCollectionConstructor HTMLCollection;
+        attribute HTMLAllCollectionConstructor HTMLAllCollection;
 
         attribute [CustomGetter] HTMLImageElementConstructor Image; // Usable with new operator
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
@@ -515,11 +516,11 @@ module window {
 #endif
 
 #if defined(ENABLE_SHARED_WORKERS) && ENABLE_SHARED_WORKERS
-        attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+        attribute [JSCCustomGetter, EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
 #endif
 
 #if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
-        attribute [JSCCustomGetter] WebSocketConstructor WebSocket; // Usable with the new operator
+        attribute [JSCCustomGetter,EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
 #endif
 
         attribute PluginConstructor Plugin;
@@ -536,11 +537,11 @@ module window {
         attribute StorageEventConstructor StorageEvent;
 #endif
 
-        attribute [CustomGetter,Conditional=VIDEO] HTMLAudioElementConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO] MediaErrorConstructor MediaError;
+        attribute [CustomGetter, Conditional=VIDEO, EnabledAtRuntime] HTMLAudioElementConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, EnabledAtRuntime] MediaErrorConstructor MediaError;
 
 #if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
@@ -573,7 +574,7 @@ module window {
         attribute SVGFECompositeElementConstructor SVGFECompositeElement;
 //      attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
         attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-//      attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
 #endif
 #endif
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 6b4031e..9d45ca7 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -136,10 +136,12 @@ inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResu
     return false;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 inline bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
     return false;
 }
+#endif
 
 #endif
 
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index da3c92b..afda0b9 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -202,6 +202,7 @@ Frame::~Frame()
 
     if (m_domWindow)
         m_domWindow->disconnectFrame();
+    script()->clearWindowShell();
 
     HashSet<DOMWindow*>::iterator end = m_liveFormerWindows.end();
     for (HashSet<DOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 587048c..5016fc7 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -52,6 +52,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
+#include "TextResourceDecoder.h"
 #include <wtf/CurrentTime.h>
 
 #ifdef ANDROID_INSTRUMENT
@@ -63,6 +64,17 @@
 #include "RenderLayerCompositor.h"
 #endif
 
+#if ENABLE(SVG)
+#include "SVGDocument.h"
+#include "SVGLocatable.h"
+#include "SVGNames.h"
+#include "SVGPreserveAspectRatio.h"
+#include "SVGSVGElement.h"
+#include "SVGViewElement.h"
+#include "SVGViewSpec.h"
+#endif
+
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -650,6 +662,7 @@ void FrameView::layout(bool allowSubtree)
     beginDeferredRepaints();
     layer->updateLayerPositions((m_doFullRepaint ? RenderLayer::DoFullRepaint : 0)
                                 | RenderLayer::CheckForRepaint
+                                | RenderLayer::IsCompositingUpdateRoot
                                 | RenderLayer::UpdateCompositingLayers);
     endDeferredRepaints();
 
@@ -783,6 +796,72 @@ void FrameView::restoreScrollbar()
     setScrollbarsSuppressed(false);
 }
 
+bool FrameView::scrollToFragment(const KURL& url)
+{
+    // If our URL has no ref, then we have no place we need to jump to.
+    // OTOH If CSS target was set previously, we want to set it to 0, recalc
+    // and possibly repaint because :target pseudo class may have been
+    // set (see bug 11321).
+    if (!url.hasFragmentIdentifier() && !m_frame->document()->cssTarget())
+        return false;
+
+    String fragmentIdentifier = url.fragmentIdentifier();
+    if (scrollToAnchor(fragmentIdentifier))
+        return true;
+
+    // Try again after decoding the ref, based on the document's encoding.
+    if (TextResourceDecoder* decoder = m_frame->document()->decoder())
+        return scrollToAnchor(decodeURLEscapeSequences(fragmentIdentifier, decoder->encoding()));
+
+    return false;
+}
+
+bool FrameView::scrollToAnchor(const String& name)
+{
+    ASSERT(m_frame->document());
+
+    if (!m_frame->document()->haveStylesheetsLoaded()) {
+        m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(true);
+        return false;
+    }
+
+    m_frame->document()->setGotoAnchorNeededAfterStylesheetsLoad(false);
+
+    Element* anchorNode = m_frame->document()->findAnchor(name);
+
+#if ENABLE(SVG)
+    if (m_frame->document()->isSVGDocument()) {
+        if (name.startsWith("xpointer(")) {
+            // We need to parse the xpointer reference here
+        } else if (name.startsWith("svgView(")) {
+            RefPtr<SVGSVGElement> svg = static_cast<SVGDocument*>(m_frame->document())->rootElement();
+            if (!svg->currentView()->parseViewSpec(name))
+                return false;
+            svg->setUseCurrentView(true);
+        } else {
+            if (anchorNode && anchorNode->hasTagName(SVGNames::viewTag)) {
+                RefPtr<SVGViewElement> viewElement = anchorNode->hasTagName(SVGNames::viewTag) ? static_cast<SVGViewElement*>(anchorNode) : 0;
+                if (viewElement.get()) {
+                    RefPtr<SVGSVGElement> svg = static_cast<SVGSVGElement*>(SVGLocatable::nearestViewportElement(viewElement.get()));
+                    svg->inheritViewAttributes(viewElement.get());
+                }
+            }
+        }
+        // FIXME: need to decide which <svg> to focus on, and zoom to that one
+        // FIXME: need to actually "highlight" the viewTarget(s)
+    }
+#endif
+
+    m_frame->document()->setCSSTarget(anchorNode); // Setting to null will clear the current target.
+  
+    // Implement the rule that "" and "top" both mean top of page as in other browsers.
+    if (!anchorNode && !(name.isEmpty() || equalIgnoringCase(name, "top")))
+        return false;
+
+    maintainScrollPositionAtAnchor(anchorNode ? static_cast<Node*>(anchorNode) : m_frame->document());
+    return true;
+}
+
 void FrameView::maintainScrollPositionAtAnchor(Node* anchorNode)
 {
     m_maintainScrollPositionAnchor = anchorNode;
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 4c900ae..3d17d2c 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -183,6 +183,8 @@ public:
 
     void adjustPageHeight(float* newBottom, float oldTop, float oldBottom, float bottomLimit);
 
+    bool scrollToFragment(const KURL&);
+    bool scrollToAnchor(const String&);
     void maintainScrollPositionAtAnchor(Node*);
 
     // Methods to convert points and rects between the coordinate space of the renderer, and this view.
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 74b3f79..184ee57 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -34,10 +34,13 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "Page.h"
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 #include "SQLiteDatabase.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
 #include "SQLValue.h"
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
 
 namespace WebCore {
 
@@ -95,12 +98,15 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
         return;
     }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     if (m_cachedPosition) {
         m_successCallback->handleEvent(m_cachedPosition.get());
         m_geolocation->requestReturnedCachedPosition(this);
         return;
     }
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
     if (m_errorCallback) {
         RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
         m_errorCallback->handleEvent(error.get());
@@ -148,6 +154,7 @@ void Geolocation::Watchers::getNotifiersVector(Vector<RefPtr<GeoNotifier> >& cop
     copyValuesToVector(m_idToNotifierMap, copy);
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 static const char* databaseName = "/CachedPosition.db";
 
 class CachedPositionManager {
@@ -286,6 +293,8 @@ RefPtr<Geoposition>* CachedPositionManager::s_cachedPosition;
 String CachedPositionManager::s_databaseFile;
 
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
 Geolocation::Geolocation(Frame* frame)
     : EventListener(GeolocationEventListenerType)
     , m_frame(frame)
@@ -322,7 +331,12 @@ void Geolocation::disconnectFrame()
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     ASSERT(notifier);
+=======
+    if (!notifier)
+        return;
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
 
     m_oneShots.add(notifier);
 }
@@ -330,9 +344,20 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     ASSERT(notifier);
+=======
+    if (!notifier)
+        return 0;
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
 
     static int nextAvailableWatchId = 1;
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    // In case of overflow, make sure the ID remains positive, but reuse the ID values.
+    if (nextAvailableWatchId < 1)
+        nextAvailableWatchId = 1;
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
     m_watchers.set(nextAvailableWatchId, notifier.release());
     return nextAvailableWatchId++;
 }
@@ -346,6 +371,7 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
     if (isDenied())
         notifier->setFatalError(PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage));
     else {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         if (haveSuitableCachedPosition(notifier->m_options.get())) {
             ASSERT(m_cachedPositionManager->cachedPosition());
             if (isAllowed())
@@ -353,12 +379,24 @@ PassRefPtr<Geolocation::GeoNotifier> Geolocation::startRequest(PassRefPtr<Positi
             else {
                 m_requestsAwaitingCachedPosition.add(notifier);
                 requestPermission();
+=======
+        if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+            notifier->startTimerIfNeeded();
+        else {
+            if (notifier->m_errorCallback) {
+                RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
+                notifier->m_errorCallback->handleEvent(error.get());
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
             }
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         } else {
             if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
                 notifier->startTimerIfNeeded();
             else
                 notifier->setFatalError(PositionError::create(PositionError::UNKNOWN_ERROR, "Failed to start Geolocation service"));
+=======
+            return 0;
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
         }
     }
 
@@ -438,8 +476,15 @@ void Geolocation::setIsAllowed(bool allowed)
     // This may be due to either a new position from the service, or a cached
     // position.
     m_allowGeolocation = allowed ? Yes : No;
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
     if (!isAllowed()) {
+=======
+    
+    if (isAllowed())
+        makeSuccessCallbacks();
+    else {
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.cpp
         RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage);
         error->setIsFatal(true);
         handleError(error.get());
diff --git a/WebCore/page/Geolocation.h b/WebCore/page/Geolocation.h
index d9b23c4..f5e05a6 100644
--- a/WebCore/page/Geolocation.h
+++ b/WebCore/page/Geolocation.h
@@ -94,7 +94,10 @@ private:
         RefPtr<PositionOptions> m_options;
         Timer<GeoNotifier> m_timer;
         RefPtr<PositionError> m_fatalError;
+<<<<<<< HEAD:WebCore/page/Geolocation.h
         RefPtr<Geoposition> m_cachedPosition;
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.h
 
     private:
         GeoNotifier(Geolocation*, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
@@ -136,10 +139,13 @@ private:
 
     PassRefPtr<GeoNotifier> startRequest(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
 
+<<<<<<< HEAD:WebCore/page/Geolocation.h
     // EventListener
     virtual bool operator==(const EventListener&);
     virtual void handleEvent(ScriptExecutionContext*, Event*);
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/page/Geolocation.h
     void fatalErrorOccurred(GeoNotifier*);
     void requestTimedOut(GeoNotifier*);
     void requestReturnedCachedPosition(GeoNotifier*);
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index 397cb72..8a685f4 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -137,7 +137,6 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
     , m_canStartPlugins(true)
-    , m_pluginHalterClient(pluginHalterClient)
 {
 #if !ENABLE(CONTEXT_MENUS)
     UNUSED_PARAM(contextMenuClient);
@@ -157,7 +156,10 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     ASSERT(!allPages->contains(this));
     allPages->add(this);
 
-    pluginHalterEnabledStateChanged();
+    if (pluginHalterClient) {
+        m_pluginHalter.set(new PluginHalter(pluginHalterClient));
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+    }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     JavaScriptDebugServer::shared().pageCreated(this);
@@ -289,7 +291,7 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
         databasePolicy = DatabasePolicyContinue;
 #endif
     m_mainFrame->loader()->stopAllLoaders(databasePolicy);
-    m_mainFrame->loader()->goToItem(item, type);
+    m_mainFrame->loader()->history()->goToItem(item, type);
 }
 
 int Page::getHistoryLength()
@@ -733,16 +735,6 @@ InspectorTimelineAgent* Page::inspectorTimelineAgent() const
 }
 #endif
 
-void Page::pluginHalterEnabledStateChanged()
-{
-    if (m_settings->pluginHalterEnabled()) {
-        ASSERT(!m_pluginHalter);
-        m_pluginHalter.set(new PluginHalter(m_pluginHalterClient));
-        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
-    } else
-        m_pluginHalter = 0;
-}
-
 void Page::pluginAllowedRunTimeChanged()
 {
     if (m_pluginHalter)
diff --git a/WebCore/page/Page.h b/WebCore/page/Page.h
index cab075e..4886464 100644
--- a/WebCore/page/Page.h
+++ b/WebCore/page/Page.h
@@ -193,7 +193,6 @@ namespace WebCore {
         void didStartPlugin(HaltablePlugin*);
         void didStopPlugin(HaltablePlugin*);
         void pluginAllowedRunTimeChanged();
-        void pluginHalterEnabledStateChanged();
 
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
@@ -300,7 +299,6 @@ namespace WebCore {
         HashSet<PluginView*> m_unstartedPlugins;
 
         OwnPtr<PluginHalter> m_pluginHalter;
-        PluginHalterClient* m_pluginHalterClient;
 
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
diff --git a/WebCore/page/PageGroup.cpp b/WebCore/page/PageGroup.cpp
index cf6ba37..427c240 100644
--- a/WebCore/page/PageGroup.cpp
+++ b/WebCore/page/PageGroup.cpp
@@ -200,8 +200,8 @@ StorageNamespace* PageGroup::localStorage()
 }
 #endif
 
-void PageGroup::addUserScript(const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
-                              PassOwnPtr<Vector<String> > blacklist, unsigned worldID, UserScriptInjectionTime injectionTime)
+void PageGroup::addUserScriptToWorld(unsigned worldID, const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+                                     PassOwnPtr<Vector<String> > blacklist, UserScriptInjectionTime injectionTime)
 {
     if (worldID == UINT_MAX)
         return;
@@ -214,8 +214,8 @@ void PageGroup::addUserScript(const String& source, const KURL& url,  PassOwnPtr
     scriptsInWorld->append(userScript.release());
 }
 
-void PageGroup::addUserStyleSheet(const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
-                                  PassOwnPtr<Vector<String> > blacklist, unsigned worldID)
+void PageGroup::addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+                                         PassOwnPtr<Vector<String> > blacklist)
 {
     if (worldID == UINT_MAX)
         return;
@@ -235,80 +235,92 @@ void PageGroup::addUserStyleSheet(const String& source, const KURL& url, PassOwn
     }
 }
 
-void PageGroup::removeUserContentWithURLForWorld(const KURL& url, unsigned worldID)
+void PageGroup::removeUserScriptFromWorld(unsigned worldID, const KURL& url)
 {
-    if (m_userScripts) {
-        UserScriptMap::iterator it = m_userScripts->find(worldID);
-        if (it != m_userScripts->end()) {
-            UserScriptVector* scripts = it->second;
-            for (int i = scripts->size() - 1; i >= 0; --i) {
-                if (scripts->at(i)->url() == url)
-                    scripts->remove(i);
-            }
-            
-            if (scripts->isEmpty()) {
-                delete it->second;
-                m_userScripts->remove(it);
-            }
-        }
+    if (!m_userScripts)
+        return;
+
+    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    if (it == m_userScripts->end())
+        return;
+    
+    UserScriptVector* scripts = it->second;
+    for (int i = scripts->size() - 1; i >= 0; --i) {
+        if (scripts->at(i)->url() == url)
+            scripts->remove(i);
     }
     
-    if (m_userStyleSheets) {
-        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
-        bool sheetsChanged = false;
-        if (it != m_userStyleSheets->end()) {
-            UserStyleSheetVector* stylesheets = it->second;
-            for (int i = stylesheets->size() - 1; i >= 0; --i) {
-                if (stylesheets->at(i)->url() == url) {
-                    stylesheets->remove(i);
-                    sheetsChanged = true;
-                }
-            }
-            
-            if (stylesheets->isEmpty()) {
-                delete it->second;
-                m_userStyleSheets->remove(it);
-            }
+    if (!scripts->isEmpty())
+        return;
+    
+    delete it->second;
+    m_userScripts->remove(it);
+}
+
+void PageGroup::removeUserStyleSheetFromWorld(unsigned worldID, const KURL& url)
+{
+    if (!m_userStyleSheets)
+        return;
+
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    bool sheetsChanged = false;
+    if (it == m_userStyleSheets->end())
+        return;
+    
+    UserStyleSheetVector* stylesheets = it->second;
+    for (int i = stylesheets->size() - 1; i >= 0; --i) {
+        if (stylesheets->at(i)->url() == url) {
+            stylesheets->remove(i);
+            sheetsChanged = true;
         }
+    }
         
-        // Clear our cached sheets and have them just reparse.
-        if (sheetsChanged) {
-            HashSet<Page*>::const_iterator end = m_pages.end();
-            for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
-                for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
-                    frame->document()->clearPageGroupUserSheets();
-            }
-        }
+    if (!sheetsChanged)
+        return;
+
+    if (!stylesheets->isEmpty()) {
+        delete it->second;
+        m_userStyleSheets->remove(it);
+    }
+    
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
     }
 }
 
-void PageGroup::removeUserContentForWorld(unsigned worldID)
+void PageGroup::removeUserScriptsFromWorld(unsigned worldID)
 {
-    if (m_userScripts) {
-        UserScriptMap::iterator it = m_userScripts->find(worldID);
-        if (it != m_userScripts->end()) {
-            delete it->second;
-            m_userScripts->remove(it);
-        }
-    }
+    if (!m_userScripts)
+        return;
+
+    UserScriptMap::iterator it = m_userScripts->find(worldID);
+    if (it == m_userScripts->end())
+        return;
+       
+    delete it->second;
+    m_userScripts->remove(it);
+}
+
+void PageGroup::removeUserStyleSheetsFromWorld(unsigned worldID)
+{
+    if (!m_userStyleSheets)
+        return;
     
-    if (m_userStyleSheets) {
-        bool sheetsChanged = false;
-        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
-        if (it != m_userStyleSheets->end()) {
-            delete it->second;
-            m_userStyleSheets->remove(it);
-            sheetsChanged = true;
-        }
+    UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+    if (it == m_userStyleSheets->end())
+        return;
     
-        if (sheetsChanged) {
-            // Clear our cached sheets and have them just reparse.
-            HashSet<Page*>::const_iterator end = m_pages.end();
-            for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
-                for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
-                    frame->document()->clearPageGroupUserSheets();
-            }
-        }
+    delete it->second;
+    m_userStyleSheets->remove(it);
+
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
     }
 }
 
diff --git a/WebCore/page/PageGroup.h b/WebCore/page/PageGroup.h
index 7ea2967..c233cd1 100644
--- a/WebCore/page/PageGroup.h
+++ b/WebCore/page/PageGroup.h
@@ -70,20 +70,23 @@ namespace WebCore {
         bool hasLocalStorage() { return m_localStorage; }
 #endif
 
-        void addUserScript(const String& source, const KURL&, 
-                           PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                           unsigned worldID, UserScriptInjectionTime);
-        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        void addUserScriptToWorld(unsigned worldID, const String& source, const KURL&, 
+                                  PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                                  UserScriptInjectionTime);
+        void addUserStyleSheetToWorld(unsigned worldID, const String& source, const KURL&,
+                               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist);
         
-        void addUserStyleSheet(const String& source, const KURL&,
-                               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
-                               unsigned worldID);
-        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+        void removeUserScriptFromWorld(unsigned, const KURL&);
+        void removeUserStyleSheetFromWorld(unsigned, const KURL&);
         
-        void removeUserContentForWorld(unsigned);
-        void removeUserContentWithURLForWorld(const KURL&, unsigned);
+        void removeUserScriptsFromWorld(unsigned);
+        void removeUserStyleSheetsFromWorld(unsigned);
+    
         void removeAllUserContent();
         
+        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+
     private:
         void addVisitedLink(LinkHash stringHash);
 
diff --git a/WebCore/page/PluginHalter.cpp b/WebCore/page/PluginHalter.cpp
index 8025337..63f5469 100644
--- a/WebCore/page/PluginHalter.cpp
+++ b/WebCore/page/PluginHalter.cpp
@@ -28,7 +28,6 @@
 #include "PluginHalter.h"
 
 #include "HaltablePlugin.h"
-#include "PluginHalterClient.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/Vector.h>
 
@@ -49,6 +48,9 @@ void PluginHalter::didStartPlugin(HaltablePlugin* obj)
     ASSERT_ARG(obj, obj);
     ASSERT_ARG(obj, !m_plugins.contains(obj));
 
+    if (!m_client->enabled())
+        return;
+
     double currentTime = WTF::currentTime();
 
     m_plugins.add(obj, currentTime);
@@ -61,6 +63,9 @@ void PluginHalter::didStartPlugin(HaltablePlugin* obj)
 
 void PluginHalter::didStopPlugin(HaltablePlugin* obj)
 {
+    if (!m_client->enabled())
+        return;
+
     m_plugins.remove(obj);
 }
 
diff --git a/WebCore/page/PluginHalter.h b/WebCore/page/PluginHalter.h
index 26f5101..eddce34 100644
--- a/WebCore/page/PluginHalter.h
+++ b/WebCore/page/PluginHalter.h
@@ -26,13 +26,14 @@
 #ifndef PluginHalter_h
 #define PluginHalter_h
 
+#include "PluginHalterClient.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 class HaltablePlugin;
-class PluginHalterClient;
 
 class PluginHalter {
 public:
@@ -47,7 +48,7 @@ private:
     void timerFired(Timer<PluginHalter>*);
     void startTimerIfNecessary();
 
-    PluginHalterClient* m_client;
+    OwnPtr<PluginHalterClient> m_client;
     Timer<PluginHalter> m_timer;
     unsigned m_pluginAllowedRunTime;
     double m_oldestStartTime;
diff --git a/WebCore/page/PluginHalterClient.h b/WebCore/page/PluginHalterClient.h
index 7ea460a..f77091f 100644
--- a/WebCore/page/PluginHalterClient.h
+++ b/WebCore/page/PluginHalterClient.h
@@ -35,6 +35,7 @@ public:
     virtual ~PluginHalterClient() { }
 
     virtual bool shouldHaltPlugin(Node*) const = 0;
+    virtual bool enabled() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index 4d3a839..bba678a 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -25,6 +25,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "RenderView.h"
+#include "Settings.h"
 
 using namespace WebCore;
 
@@ -95,18 +96,23 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
 void PrintContext::begin(float width)
 {
-    // By imaging to a width a little wider than the available pixels,
-    // thin pages will be scaled down a little, matching the way they
-    // print in IE and Camino. This lets them use fewer sheets than they
-    // would otherwise, which is presumably why other browsers do this.
-    // Wide pages will be scaled down more than this.
-    const float PrintingMinimumShrinkFactor = 1.25f;
-
-    // This number determines how small we are willing to reduce the page content
-    // in order to accommodate the widest line. If the page would have to be
-    // reduced smaller to make the widest line fit, we just clip instead (this
-    // behavior matches MacIE and Mozilla, at least)
-    const float PrintingMaximumShrinkFactor = 2.0f;
+    float PrintingMinimumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMinimumShrinkFactor() : 0.0f;
+    float PrintingMaximumShrinkFactor = m_frame->settings() ? m_frame->settings()->printingMaximumShrinkFactor() : 0.0f;
+
+    if (PrintingMaximumShrinkFactor < PrintingMinimumShrinkFactor || PrintingMinimumShrinkFactor <= 0.0f) {
+        // By imaging to a width a little wider than the available pixels,
+        // thin pages will be scaled down a little, matching the way they
+        // print in IE and Camino. This lets them use fewer sheets than they
+        // would otherwise, which is presumably why other browsers do this.
+        // Wide pages will be scaled down more than this.
+        PrintingMinimumShrinkFactor = 1.25f;
+
+        // This number determines how small we are willing to reduce the page content
+        // in order to accommodate the widest line. If the page would have to be
+        // reduced smaller to make the widest line fit, we just clip instead (this
+        // behavior matches MacIE and Mozilla, at least)
+        PrintingMaximumShrinkFactor = 2.0f;
+    }
 
     float minLayoutWidth = width * PrintingMinimumShrinkFactor;
     float maxLayoutWidth = width * PrintingMaximumShrinkFactor;
diff --git a/WebCore/page/SecurityOrigin.h b/WebCore/page/SecurityOrigin.h
index 46e6fad..6d4ce1f 100644
--- a/WebCore/page/SecurityOrigin.h
+++ b/WebCore/page/SecurityOrigin.h
@@ -127,9 +127,8 @@ namespace WebCore {
         // SecurityOrigin is represented with the string "null".
         String toString() const;
 
-        // Serialize the security origin for storage in the database. This format is
-        // deprecated and should be used only for compatibility with old databases;
-        // use toString() and createFromString() instead.
+        // Serialize the security origin to a string that could be used as part of
+        // file names. This format should be used in storage APIs only.
         String databaseIdentifier() const;
 
         // This method checks for equality between SecurityOrigins, not whether
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index df42718..d848e1c 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -75,6 +75,8 @@ Settings::Settings(Page* page)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
     , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
     , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+    , m_printingMinimumShrinkFactor(0.0f)
+    , m_printingMaximumShrinkFactor(0.0f)
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -129,11 +131,7 @@ Settings::Settings(Page* page)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
     , m_experimentalNotificationsEnabled(false)
-    , m_pluginHalterEnabled(false)
     , m_webGLEnabled(false)
-#if ENABLE(WEB_SOCKETS)
-    , m_experimentalWebSocketsEnabled(false)
-#endif
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -642,16 +640,6 @@ void Settings::setExperimentalNotificationsEnabled(bool enabled)
     m_experimentalNotificationsEnabled = enabled;
 }
 
-void Settings::setPluginHalterEnabled(bool enabled)
-{
-    if (m_pluginHalterEnabled == enabled)
-        return;
-
-    m_pluginHalterEnabled = enabled;
-
-    m_page->pluginHalterEnabledStateChanged();
-}
-
 void Settings::setPluginAllowedRunTime(unsigned runTime)
 {
     m_pluginAllowedRunTime = runTime;
@@ -670,11 +658,14 @@ void Settings::setWebGLEnabled(bool enabled)
     m_webGLEnabled = enabled;
 }
 
-#if ENABLE(WEB_SOCKETS)
-void Settings::setExperimentalWebSocketsEnabled(bool enabled)
+void Settings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
 {
-    m_experimentalWebSocketsEnabled = enabled;
-}
-#endif
+    m_printingMinimumShrinkFactor = printingMinimumShrinkFactor;
+}    
+
+void Settings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+{
+    m_printingMaximumShrinkFactor = printingMaximumShrinkFactor;
+}    
 
 } // namespace WebCore
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index f03e792..b2eb7fa 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -306,19 +306,17 @@ namespace WebCore {
         static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
 #endif
 
-        void setPluginHalterEnabled(bool);
-        bool pluginHalterEnabled() const { return m_pluginHalterEnabled; }
-
         void setPluginAllowedRunTime(unsigned);
         unsigned pluginAllowedRunTime() const { return m_pluginAllowedRunTime; }
 
         void setWebGLEnabled(bool);
         bool webGLEnabled() const { return m_webGLEnabled; }
 
-#if ENABLE(WEB_SOCKETS)
-        void setExperimentalWebSocketsEnabled(bool);
-        bool experimentalWebSocketsEnabled() const { return m_experimentalWebSocketsEnabled; }
-#endif
+        void setPrintingMinimumShrinkFactor(float);
+        float printingMinimumShrinkFactor() const { return m_printingMinimumShrinkFactor; }
+
+        void setPrintingMaximumShrinkFactor(float);
+        float printingMaximumShrinkFactor() const { return m_printingMaximumShrinkFactor; }
 
     private:
         Page* m_page;
@@ -379,6 +377,8 @@ namespace WebCore {
         size_t m_maximumDecodedImageSize;
         unsigned m_localStorageQuota;
         unsigned m_pluginAllowedRunTime;
+        float m_printingMinimumShrinkFactor;
+        float m_printingMaximumShrinkFactor;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -424,13 +424,8 @@ namespace WebCore {
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
         bool m_experimentalNotificationsEnabled : 1;
-        bool m_pluginHalterEnabled : 1;
         bool m_webGLEnabled : 1;
 
-#if ENABLE(WEB_SOCKETS)
-        bool m_experimentalWebSocketsEnabled : 1;
-#endif
-
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
 #endif
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 92ed896..890c3fa 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -65,20 +65,23 @@ static bool isIllegalURICharacter(UChar c)
     // in a valid URI: ', ", <, >
     //
     // If the request does not contain these characters then we can assume that no inline scripts have been injected 
-    // into response page, because it is impossible to write an inline script of the form <script>...</script>
+    // into the response page, because it is impossible to write an inline script of the form <script>...</script>
     // without "<", ">".
     return (c == '\'' || c == '"' || c == '<' || c == '>');
 }
 
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
+String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                                            bool decodeURLEscapeSequencesTwice)
 {
-    if (decodeEntities == m_decodeEntities && encoding == m_encoding && url == m_inputURL)
+    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
+        && encoding == m_encoding && url == m_inputURL)
         return m_cachedCanonicalizedURL;
 
-    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities));
+    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities, decodeURLEscapeSequencesTwice));
     m_inputURL = url;
     m_encoding = encoding;
     m_decodeEntities = decodeEntities;
+    m_decodeURLEscapeSequencesTwice = decodeURLEscapeSequencesTwice;
     return m_cachedCanonicalizedURL;
 }
 
@@ -115,7 +118,7 @@ bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -141,6 +144,16 @@ bool XSSAuditor::canLoadExternalScriptFromSrc(const String& context, const Strin
     if (!isEnabled())
         return true;
 
+    // If the script is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // script. If the script has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL scriptURL(m_frame->document()->url(), url);
+    if (m_frame->document()->url().host() == scriptURL.host() && scriptURL.query().isEmpty())
+        return true;
+
     if (findInRequest(context + url)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
@@ -182,7 +195,7 @@ String XSSAuditor::canonicalize(const String& string)
     return result.removeCharacters(&isNonCanonicalCharacter);
 }
 
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities)
+String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities, bool decodeURLEscapeSequencesTwice)
 {
     String result;
     String url = string;
@@ -193,6 +206,13 @@ String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding,
     String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
     if (!decodedResult.isEmpty())
         result = decodedResult;
+    if (decodeURLEscapeSequencesTwice) {
+        result = decodeURLEscapeSequences(result);
+        utf8Url = result.utf8();
+        decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
+        if (!decodedResult.isEmpty())
+            result = decodedResult;
+    }
     if (decodeEntities)
         result = decodeHTMLEntities(result);
     return result;
@@ -235,18 +255,20 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters) const
+bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
+                               bool decodeURLEscapeSequencesTwice) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters);
+        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
     if (!result)
-        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters);
+        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters, decodeURLEscapeSequencesTwice);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters, 
+                               bool decodeURLEscapeSequencesTwice) const
 {
     ASSERT(frame->document());
 
@@ -285,7 +307,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities);
+        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
 
         if (allowRequestIfNoIllegalURICharacters && (!formDataObj || formDataObj->isEmpty()) 
             && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
@@ -302,7 +324,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEn
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities);
+            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities, decodeURLEscapeSequencesTwice);
             if (decodedFormData.find(canonicalizedString, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/WebCore/page/XSSAuditor.h b/WebCore/page/XSSAuditor.h
index d3d1ec9..adfa5c7 100644
--- a/WebCore/page/XSSAuditor.h
+++ b/WebCore/page/XSSAuditor.h
@@ -102,25 +102,30 @@ namespace WebCore {
         class CachingURLCanonicalizer
         {
         public:
-            CachingURLCanonicalizer() : m_decodeEntities(false) { }
-            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+            CachingURLCanonicalizer() : m_decodeEntities(false), m_decodeURLEscapeSequencesTwice(false) { }
+            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                   bool decodeURLEscapeSequencesTwice);
 
         private:
             // The parameters we were called with last.
             String m_inputURL;
             TextEncoding m_encoding;
             bool m_decodeEntities;
+            bool m_decodeURLEscapeSequencesTwice;
 
             // The cached result.
             String m_cachedCanonicalizedURL;
         };
 
         static String canonicalize(const String&);
-        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
+                                bool decodeURLEscapeSequencesTwice = false);
         static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false) const;
-        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false) const;
+        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
+                           bool decodeURLEscapeSequencesTwice = false) const;
+        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false, 
+                           bool decodeURLEscapeSequencesTwice = false) const;
 
         // The frame to audit.
         Frame* m_frame;
diff --git a/WebCore/page/animation/AnimationBase.cpp b/WebCore/page/animation/AnimationBase.cpp
index ec0e284..59797da 100644
--- a/WebCore/page/animation/AnimationBase.cpp
+++ b/WebCore/page/animation/AnimationBase.cpp
@@ -468,6 +468,7 @@ public:
                 m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::yPosition, &FillLayer::setYPosition);
                 break;
             case CSSPropertyBackgroundSize:
+            case CSSPropertyWebkitBackgroundSize:
             case CSSPropertyWebkitMaskSize:
                 m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<LengthSize>(&FillLayer::sizeLength, &FillLayer::setSizeLength);
                 break;
@@ -592,6 +593,7 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
 
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
         gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
diff --git a/WebCore/page/animation/AnimationController.cpp b/WebCore/page/animation/AnimationController.cpp
index 691932e..aa5de2c 100644
--- a/WebCore/page/animation/AnimationController.cpp
+++ b/WebCore/page/animation/AnimationController.cpp
@@ -55,7 +55,7 @@ AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     , m_lastStyleAvailableWaiter(0)
     , m_responseWaiters(0)
     , m_lastResponseWaiter(0)
-    , m_waitingForAResponse(false)
+    , m_waitingForResponse(false)
 {
 }
 
@@ -279,6 +279,19 @@ double AnimationControllerPrivate::beginAnimationUpdateTime()
     return m_beginAnimationUpdateTime;
 }
 
+void AnimationControllerPrivate::endAnimationUpdate()
+{
+    styleAvailable();
+    if (!m_waitingForResponse)
+        startTimeResponse(beginAnimationUpdateTime());
+}
+
+void AnimationControllerPrivate::receivedStartTimeResponse(double time)
+{
+    m_waitingForResponse = false;
+    startTimeResponse(time);
+}
+
 PassRefPtr<RenderStyle> AnimationControllerPrivate::getAnimatedStyleForRenderer(RenderObject* renderer)
 {
     if (!renderer)
@@ -378,7 +391,7 @@ void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* a
     ASSERT(!animation->next());
     
     if (willGetResponse)
-        m_waitingForAResponse = true;
+        m_waitingForResponse = true;
     
     if (m_responseWaiters)
         m_lastResponseWaiter->setNext(animation);
@@ -408,13 +421,13 @@ void AnimationControllerPrivate::removeFromStartTimeResponseWaitList(AnimationBa
     }
 }
 
-void AnimationControllerPrivate::startTimeResponse(double t)
+void AnimationControllerPrivate::startTimeResponse(double time)
 {
     // Go through list of waiters and send them on their way
     for (AnimationBase* animation = m_responseWaiters; animation; ) {
         AnimationBase* nextAnimation = animation->next();
         animation->setNext(0);
-        animation->onAnimationStartResponse(t);
+        animation->onAnimationStartResponse(time);
         animation = nextAnimation;
     }
     
diff --git a/WebCore/page/animation/AnimationControllerPrivate.h b/WebCore/page/animation/AnimationControllerPrivate.h
index 359b9b5..7db3803 100644
--- a/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/WebCore/page/animation/AnimationControllerPrivate.h
@@ -80,18 +80,8 @@ public:
 
     double beginAnimationUpdateTime();
     void setBeginAnimationUpdateTime(double t) { m_beginAnimationUpdateTime = t; }
-    void endAnimationUpdate()
-    {
-        styleAvailable();
-        if (!m_waitingForAResponse)
-            startTimeResponse(beginAnimationUpdateTime());
-    }
-    
-    void receivedStartTimeResponse(double t)
-    {
-        m_waitingForAResponse = false;
-        startTimeResponse(t);
-    }
+    void endAnimationUpdate();
+    void receivedStartTimeResponse(double);
     
     void addToStyleAvailableWaitList(AnimationBase*);
     void removeFromStyleAvailableWaitList(AnimationBase*);    
@@ -127,7 +117,7 @@ private:
     
     AnimationBase* m_responseWaiters;
     AnimationBase* m_lastResponseWaiter;
-    bool m_waitingForAResponse;
+    bool m_waitingForResponse;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/animation/ImplicitAnimation.cpp b/WebCore/page/animation/ImplicitAnimation.cpp
index 8e6349d..50fc781 100644
--- a/WebCore/page/animation/ImplicitAnimation.cpp
+++ b/WebCore/page/animation/ImplicitAnimation.cpp
@@ -142,10 +142,8 @@ void ImplicitAnimation::onAnimationEnd(double elapsedTime)
     if (keyframeAnim)
         keyframeAnim->setUnanimatedStyle(m_toStyle);
     
-    if (!sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime)) {
-        // We didn't dispatch an event, which would call endAnimation(), so we'll just call it here.
-        endAnimation(true);
-    }
+    sendTransitionEvent(eventNames().webkitTransitionEndEvent, elapsedTime);
+    endAnimation(true);
 }
 
 bool ImplicitAnimation::sendTransitionEvent(const AtomicString& eventType, double elapsedTime)
diff --git a/WebCore/page/animation/KeyframeAnimation.cpp b/WebCore/page/animation/KeyframeAnimation.cpp
index 39ae1e7..7e37e5f 100644
--- a/WebCore/page/animation/KeyframeAnimation.cpp
+++ b/WebCore/page/animation/KeyframeAnimation.cpp
@@ -244,10 +244,8 @@ void KeyframeAnimation::onAnimationIteration(double elapsedTime)
 
 void KeyframeAnimation::onAnimationEnd(double elapsedTime)
 {
-    if (!sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime)) {
-        // We didn't dispatch an event, which would call endAnimation(), so we'll just call it here.
-        endAnimation(true);
-    }
+    sendAnimationEvent(eventNames().webkitAnimationEndEvent, elapsedTime);
+    endAnimation(true);
 }
 
 bool KeyframeAnimation::sendAnimationEvent(const AtomicString& eventType, double elapsedTime)
diff --git a/WebCore/platform/FileSystem.h b/WebCore/platform/FileSystem.h
index 958eb73..9952b39 100644
--- a/WebCore/platform/FileSystem.h
+++ b/WebCore/platform/FileSystem.h
@@ -65,15 +65,23 @@ namespace WebCore {
 
 class CString;
 
-#if PLATFORM(QT)
-
-typedef QFile* PlatformFileHandle;
-const PlatformFileHandle invalidPlatformFileHandle = 0;
+// PlatformModule
+#if PLATFORM(WIN_OS)
+typedef HMODULE PlatformModule;
+#elif PLATFORM(QT)
 #if defined(Q_WS_MAC)
 typedef CFBundleRef PlatformModule;
-typedef unsigned PlatformModuleVersion;
-#elif defined(Q_OS_WIN)
-typedef HMODULE PlatformModule;
+#else
+typedef QLibrary* PlatformModule;
+#endif // defined(Q_WS_MAC)
+#elif PLATFORM(GTK)
+typedef GModule* PlatformModule;
+#else
+typedef void* PlatformModule;
+#endif
+
+// PlatformModuleVersion
+#if PLATFORM(WIN_OS)
 struct PlatformModuleVersion {
     unsigned leastSig;
     unsigned mostSig;
@@ -92,44 +100,21 @@ struct PlatformModuleVersion {
 
 };
 #else
-typedef QLibrary* PlatformModule;
 typedef unsigned PlatformModuleVersion;
 #endif
 
+// PlatformFileHandle
+#if PLATFORM(QT)
+typedef QFile* PlatformFileHandle;
+const PlatformFileHandle invalidPlatformFileHandle = 0;
 #elif PLATFORM(WIN_OS)
 typedef HANDLE PlatformFileHandle;
-typedef HMODULE PlatformModule;
 // FIXME: -1 is INVALID_HANDLE_VALUE, defined in <winbase.h>. Chromium tries to
 // avoid using Windows headers in headers.  We'd rather move this into the .cpp.
 const PlatformFileHandle invalidPlatformFileHandle = reinterpret_cast<HANDLE>(-1);
-
-struct PlatformModuleVersion {
-    unsigned leastSig;
-    unsigned mostSig;
-
-    PlatformModuleVersion(unsigned)
-        : leastSig(0)
-        , mostSig(0)
-    {
-    }
-
-    PlatformModuleVersion(unsigned lsb, unsigned msb)
-        : leastSig(lsb)
-        , mostSig(msb)
-    {
-    }
-
-};
 #else
 typedef int PlatformFileHandle;
-#if PLATFORM(GTK)
-typedef GModule* PlatformModule;
-#else
-typedef void* PlatformModule;
-#endif
 const PlatformFileHandle invalidPlatformFileHandle = -1;
-
-typedef unsigned PlatformModuleVersion;
 #endif
 
 bool fileExists(const String&);
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index b323332..d0aae0c 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -106,7 +106,7 @@ static inline bool isUnicodeEncoding(const TextEncoding* encoding)
 static bool lowerCaseEqualsASCII(const char* begin, const char* end, const char* str)
 {
     while (begin != end && *str) {
-        ASSERT(isASCIILower(*str));
+        ASSERT(toASCIILower(*str) == *str);
         if (toASCIILower(*begin++) != *str++)
             return false;
     }
diff --git a/WebCore/platform/SSLKeyGenerator.h b/WebCore/platform/SSLKeyGenerator.h
index 398a009..f81f0a5 100644
--- a/WebCore/platform/SSLKeyGenerator.h
+++ b/WebCore/platform/SSLKeyGenerator.h
@@ -33,7 +33,14 @@ namespace WebCore {
 
     class KURL;
 
-    void getSupportedKeySizes(Vector<String>&);
+    // Returns strings representing key sizes that may be used
+    // for the <keygen> tag. The first string is displayed as the default
+    // key size in the <keygen> menu.
+    void getSupportedKeySizes(Vector<String>& sizes);
+
+    // This function handles the <keygen> tag in form elements.
+    // Returns a signed copy of the combined challenge string and public
+    // key (from a newly generated key pair).
     String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const KURL&);
 
 } // namespace WebCore
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index d59d10a..1c9b5ce 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -762,6 +762,22 @@ void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& corn
     ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
+void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
+{
+    if (m_horizontalScrollbar)
+        m_horizontalScrollbar->paint(context, rect);
+    if (m_verticalScrollbar)
+        m_verticalScrollbar->paint(context, rect);
+
+    paintScrollCorner(context, scrollCornerRect());
+}
+
+void ScrollView::paintPanScrollIcon(GraphicsContext* context)
+{
+    DEFINE_STATIC_LOCAL(Image*, panScrollIcon, (Image::loadPlatformResource("panIcon").releaseRef()));
+    context->drawImage(panScrollIcon, m_panScrollIconPoint);
+}
+
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
 {
     if (platformWidget()) {
@@ -796,20 +812,15 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         scrollViewDirtyRect.intersect(frameRect());
         context->translate(x(), y());
         scrollViewDirtyRect.move(-x(), -y());
-        if (m_horizontalScrollbar)
-            m_horizontalScrollbar->paint(context, scrollViewDirtyRect);
-        if (m_verticalScrollbar)
-            m_verticalScrollbar->paint(context, scrollViewDirtyRect);
 
-        paintScrollCorner(context, scrollCornerRect());
+        paintScrollbars(context, scrollViewDirtyRect);
+
         context->restore();
     }
 
     // Paint the panScroll Icon
-    if (m_drawPanScrollIcon) {
-        DEFINE_STATIC_LOCAL(RefPtr<Image>, panScrollIcon, (Image::loadPlatformResource("panIcon")));
-        context->drawImage(panScrollIcon.get(), m_panScrollIconPoint);
-    }
+    if (m_drawPanScrollIcon)
+        paintPanScrollIcon(context);
 }
 
 bool ScrollView::isPointInScrollbarCorner(const IntPoint& windowPoint)
diff --git a/WebCore/platform/ScrollView.h b/WebCore/platform/ScrollView.h
index 2da6829..2844ace 100644
--- a/WebCore/platform/ScrollView.h
+++ b/WebCore/platform/ScrollView.h
@@ -207,6 +207,7 @@ public:
 
     // Widget override.  Handles painting of the contents of the view as well as the scrollbars.
     virtual void paint(GraphicsContext*, const IntRect&);
+    void paintScrollbars(GraphicsContext*, const IntRect&);
 
     // Widget overrides to ensure that our children's visibility status is kept up to date when we get shown and hidden.
     virtual void show();
@@ -217,6 +218,7 @@ public:
     static const int noPanScrollRadius = 15;
     void addPanScrollIcon(const IntPoint&);
     void removePanScrollIcon();
+    void paintPanScrollIcon(GraphicsContext*);
 
     virtual bool isPointInScrollbarCorner(const IntPoint&);
     virtual bool scrollbarCornerPresent() const;
@@ -234,7 +236,7 @@ protected:
     
     virtual void contentsResized() = 0;
     virtual void visibleContentsResized() = 0;
-    
+
     // These methods are used to create/destroy scrollbars.
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
diff --git a/WebCore/platform/SuddenTermination.h b/WebCore/platform/SuddenTermination.h
index 7171102..3fc5b0f 100644
--- a/WebCore/platform/SuddenTermination.h
+++ b/WebCore/platform/SuddenTermination.h
@@ -30,6 +30,9 @@
 
 namespace WebCore {
 
+    // Once disabled via one or more more calls to disableSuddenTermination(), fast shutdown
+    // is not valid until enableSuddenTermination() has been called an equal number of times.
+    // On Mac, these are thin wrappers around Mac OS X functions of the same name.
     void disableSuddenTermination();
     void enableSuddenTermination();
 
diff --git a/WebCore/platform/android/ClipboardAndroid.h b/WebCore/platform/android/ClipboardAndroid.h
index f11798d..e30ea7d 100644
--- a/WebCore/platform/android/ClipboardAndroid.h
+++ b/WebCore/platform/android/ClipboardAndroid.h
@@ -33,8 +33,9 @@
 
 namespace WebCore {
 
-    class CachedImage;
+class CachedImage;
 
+<<<<<<< HEAD:WebCore/platform/android/ClipboardAndroid.h
     class ClipboardAndroid : public Clipboard, public CachedResourceClient {
     public:
         ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging);
@@ -48,17 +49,31 @@ namespace WebCore {
         // extensions beyond IE's API
         HashSet<String> types() const;
         PassRefPtr<FileList> files() const;
+=======
+class ClipboardAndroid : public Clipboard, public CachedResourceClient {
+public:
+    ClipboardAndroid(ClipboardAccessPolicy policy, bool isForDragging);
+    ~ClipboardAndroid();
+
+    void clearData(const String&);
+    void clearAllData();
+    String getData(const String&, bool& success) const;
+    bool setData(const String&, const String&);
+
+    // extensions beyond IE's API
+    HashSet<String> types() const;
+
+    void setDragImage(CachedImage*, const IntPoint&);
+    void setDragImageElement(Node*, const IntPoint&);
+>>>>>>> webkit.org at r50258.:WebCore/platform/android/ClipboardAndroid.h
     
-        void setDragImage(CachedImage*, const IntPoint&);
-        void setDragImageElement(Node*, const IntPoint&);
-        
-        virtual DragImageRef createDragImage(IntPoint&) const;
-        virtual void declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*);
-        virtual void writeURL(const KURL&, const String&, Frame*);
-        virtual void writeRange(Range*, Frame*);
+    virtual DragImageRef createDragImage(IntPoint&) const;
+    virtual void declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*);
+    virtual void writeURL(const KURL&, const String&, Frame*);
+    virtual void writeRange(Range*, Frame*);
 
-        virtual bool hasData();
-    };
+    virtual bool hasData();
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/platform/android/CursorAndroid.cpp b/WebCore/platform/android/CursorAndroid.cpp
index 5c6e473..beef3b2 100644
--- a/WebCore/platform/android/CursorAndroid.cpp
+++ b/WebCore/platform/android/CursorAndroid.cpp
@@ -23,6 +23,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
+
 #define LOG_TAG "WebCore"
 
 #include "config.h"
@@ -282,12 +283,14 @@ const Cursor& westPanningCursor()
     return c;
 }
 
-const Cursor& grabCursor() {
+const Cursor& grabCursor()
+{
     notImplemented();
     return c;
 }
 
-const Cursor& grabbingCursor() {
+const Cursor& grabbingCursor()
+{
     notImplemented();
     return c;
 }
diff --git a/WebCore/platform/android/FileChooserAndroid.cpp b/WebCore/platform/android/FileChooserAndroid.cpp
index c293e66..c8e1999 100644
--- a/WebCore/platform/android/FileChooserAndroid.cpp
+++ b/WebCore/platform/android/FileChooserAndroid.cpp
@@ -36,12 +36,20 @@ String FileChooser::basenameForWidth(const Font& font, int width) const
         return String();
     // FIXME: This could be a lot faster, but assuming the data will not
     // often be much longer than the provided width, this may be fast enough.
+<<<<<<< HEAD:WebCore/platform/android/FileChooserAndroid.cpp
     // If this does not need to be threadsafe, we can use crossThreadString().
     // See http://trac.webkit.org/changeset/49160.
+=======
+>>>>>>> webkit.org at r50258.:WebCore/platform/android/FileChooserAndroid.cpp
     String output = m_filenames[0].threadsafeCopy();
+<<<<<<< HEAD:WebCore/platform/android/FileChooserAndroid.cpp
     while (font.width(TextRun(output.impl())) > width && output.length() > 4) {
         output = output.replace(0, 4, String("..."));
     }
+=======
+    while (font.width(TextRun(output.impl())) > width && output.length() > 4)
+        output = output.replace(output.length() - 4, 4, String("..."));
+>>>>>>> webkit.org at r50258.:WebCore/platform/android/FileChooserAndroid.cpp
     return output;
 }
 
diff --git a/WebCore/platform/android/FileSystemAndroid.cpp b/WebCore/platform/android/FileSystemAndroid.cpp
index f2665a2..46c1297 100644
--- a/WebCore/platform/android/FileSystemAndroid.cpp
+++ b/WebCore/platform/android/FileSystemAndroid.cpp
@@ -30,12 +30,12 @@
 
 #include "CString.h"
 #include "StringBuilder.h"
-#include <fnmatch.h>
-#include <dlfcn.h>
+#include "cutils/log.h"
 #include <dirent.h>
+#include <dlfcn.h>
 #include <errno.h>
+#include <fnmatch.h>
 #include <sys/stat.h>
-#include "cutils/log.h"
 
 namespace WebCore {
 
@@ -72,7 +72,7 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 
 bool unloadModule(PlatformModule module)
 {
-    return dlclose(module) == 0;
+    return !dlclose(module);
 }
 
 void closeFile(PlatformFileHandle& handle)
@@ -90,7 +90,7 @@ int writeToFile(PlatformFileHandle handle, const char* data, int length)
         int bytesWritten = write(handle, data, (size_t)(length - totalBytesWritten));
         if (bytesWritten < 0 && errno != EINTR)
             return -1;
-        else if (bytesWritten > 0)
+        if (bytesWritten > 0)
             totalBytesWritten += bytesWritten;
     }
 
diff --git a/WebCore/platform/android/KeyEventAndroid.cpp b/WebCore/platform/android/KeyEventAndroid.cpp
index 998c781..af29598 100644
--- a/WebCore/platform/android/KeyEventAndroid.cpp
+++ b/WebCore/platform/android/KeyEventAndroid.cpp
@@ -41,128 +41,128 @@ namespace WebCore {
 static int windowsKeyCodeForKeyEvent(unsigned int keyCode)
 {
     // Does not provide all key codes, and does not handle all keys.
-    switch(keyCode) {
-        case kKeyCodeDel:
-            return VK_BACK;
-        case kKeyCodeTab:
-            return VK_TAB;
-        case kKeyCodeClear:
-            return VK_CLEAR;
-        case kKeyCodeDpadCenter:
-        case kKeyCodeNewline:
-            return VK_RETURN;
-        case kKeyCodeShiftLeft:
-        case kKeyCodeShiftRight:
-            return VK_SHIFT;
-        // back will serve as escape, although we probably do not have access to it
-        case kKeyCodeBack:
-            return VK_ESCAPE;
-        case kKeyCodeSpace:
-            return VK_SPACE;
-        case kKeyCodeHome:
-            return VK_HOME;
-        case kKeyCodeDpadLeft:
-            return VK_LEFT;
-        case kKeyCodeDpadUp:
-            return VK_UP;
-        case kKeyCodeDpadRight:
-            return VK_RIGHT;
-        case kKeyCodeDpadDown:
-            return VK_DOWN;
-        case kKeyCode0:
-            return VK_0;
-        case kKeyCode1:
-            return VK_1;
-        case kKeyCode2:
-            return VK_2;
-        case kKeyCode3:
-            return VK_3;
-        case kKeyCode4:
-            return VK_4;
-        case kKeyCode5:
-            return VK_5;
-        case kKeyCode6:
-            return VK_6;
-        case kKeyCode7:
-            return VK_7;
-        case kKeyCode8:
-            return VK_8;
-        case kKeyCode9:
-            return VK_9;
-        case kKeyCodeA:
-            return VK_A;
-        case kKeyCodeB:
-            return VK_B;
-        case kKeyCodeC:
-            return VK_C;
-        case kKeyCodeD:
-            return VK_D;
-        case kKeyCodeE:
-            return VK_E;
-        case kKeyCodeF:
-            return VK_F;
-        case kKeyCodeG:
-            return VK_G;
-        case kKeyCodeH:
-            return VK_H;
-        case kKeyCodeI:
-            return VK_I;
-        case kKeyCodeJ:
-            return VK_J;
-        case kKeyCodeK:
-            return VK_K;
-        case kKeyCodeL:
-            return VK_L;
-        case kKeyCodeM:
-            return VK_M;
-        case kKeyCodeN:
-            return VK_N;
-        case kKeyCodeO:
-            return VK_O;
-        case kKeyCodeP:
-            return VK_P;
-        case kKeyCodeQ:
-            return VK_Q;
-        case kKeyCodeR:
-            return VK_R;
-        case kKeyCodeS:
-            return VK_S;
-        case kKeyCodeT:
-            return VK_T;
-        case kKeyCodeU:
-            return VK_U;
-        case kKeyCodeV:
-            return VK_V;
-        case kKeyCodeW:
-            return VK_W;
-        case kKeyCodeX:
-            return VK_X;
-        case kKeyCodeY:
-            return VK_Y;
-        case kKeyCodeZ:
-            return VK_Z;
-        // colon
-        case kKeyCodeSemicolon:
-            return VK_OEM_1;
-        case kKeyCodeComma:
-            return VK_OEM_COMMA;
-        case kKeyCodeMinus:
-            return VK_OEM_MINUS;
-        case kKeyCodeEquals:
-            return VK_OEM_PLUS;
-        case kKeyCodePeriod:
-            return VK_OEM_PERIOD;
-        case kKeyCodeSlash:
-            return VK_OEM_2;
-        // maybe not the right choice
-        case kKeyCodeLeftBracket:
-            return VK_OEM_4;
-        case kKeyCodeBackslash:
-            return VK_OEM_5;
-        case kKeyCodeRightBracket:
-            return VK_OEM_6;
-        default:
-            return 0;
+    switch (keyCode) {
+    case kKeyCodeDel:
+        return VK_BACK;
+    case kKeyCodeTab:
+        return VK_TAB;
+    case kKeyCodeClear:
+        return VK_CLEAR;
+    case kKeyCodeDpadCenter:
+    case kKeyCodeNewline:
+        return VK_RETURN;
+    case kKeyCodeShiftLeft:
+    case kKeyCodeShiftRight:
+        return VK_SHIFT;
+    // back will serve as escape, although we probably do not have access to it
+    case kKeyCodeBack:
+        return VK_ESCAPE;
+    case kKeyCodeSpace:
+        return VK_SPACE;
+    case kKeyCodeHome:
+        return VK_HOME;
+    case kKeyCodeDpadLeft:
+        return VK_LEFT;
+    case kKeyCodeDpadUp:
+        return VK_UP;
+    case kKeyCodeDpadRight:
+        return VK_RIGHT;
+    case kKeyCodeDpadDown:
+        return VK_DOWN;
+    case kKeyCode0:
+        return VK_0;
+    case kKeyCode1:
+        return VK_1;
+    case kKeyCode2:
+        return VK_2;
+    case kKeyCode3:
+        return VK_3;
+    case kKeyCode4:
+        return VK_4;
+    case kKeyCode5:
+        return VK_5;
+    case kKeyCode6:
+        return VK_6;
+    case kKeyCode7:
+        return VK_7;
+    case kKeyCode8:
+        return VK_8;
+    case kKeyCode9:
+        return VK_9;
+    case kKeyCodeA:
+        return VK_A;
+    case kKeyCodeB:
+        return VK_B;
+    case kKeyCodeC:
+        return VK_C;
+    case kKeyCodeD:
+        return VK_D;
+    case kKeyCodeE:
+        return VK_E;
+    case kKeyCodeF:
+        return VK_F;
+    case kKeyCodeG:
+        return VK_G;
+    case kKeyCodeH:
+        return VK_H;
+    case kKeyCodeI:
+        return VK_I;
+    case kKeyCodeJ:
+        return VK_J;
+    case kKeyCodeK:
+        return VK_K;
+    case kKeyCodeL:
+        return VK_L;
+    case kKeyCodeM:
+        return VK_M;
+    case kKeyCodeN:
+        return VK_N;
+    case kKeyCodeO:
+        return VK_O;
+    case kKeyCodeP:
+        return VK_P;
+    case kKeyCodeQ:
+        return VK_Q;
+    case kKeyCodeR:
+        return VK_R;
+    case kKeyCodeS:
+        return VK_S;
+    case kKeyCodeT:
+        return VK_T;
+    case kKeyCodeU:
+        return VK_U;
+    case kKeyCodeV:
+        return VK_V;
+    case kKeyCodeW:
+        return VK_W;
+    case kKeyCodeX:
+        return VK_X;
+    case kKeyCodeY:
+        return VK_Y;
+    case kKeyCodeZ:
+        return VK_Z;
+    // colon
+    case kKeyCodeSemicolon:
+        return VK_OEM_1;
+    case kKeyCodeComma:
+        return VK_OEM_COMMA;
+    case kKeyCodeMinus:
+        return VK_OEM_MINUS;
+    case kKeyCodeEquals:
+        return VK_OEM_PLUS;
+    case kKeyCodePeriod:
+        return VK_OEM_PERIOD;
+    case kKeyCodeSlash:
+        return VK_OEM_2;
+    // maybe not the right choice
+    case kKeyCodeLeftBracket:
+        return VK_OEM_4;
+    case kKeyCodeBackslash:
+        return VK_OEM_5;
+    case kKeyCodeRightBracket:
+        return VK_OEM_6;
+    default:
+        return 0;
     }
 }
 
@@ -171,28 +171,28 @@ static String keyIdentifierForAndroidKeyCode(int keyCode)
     // Does not return all of the same key identifiers, and
     // does not handle all the keys.
     switch (keyCode) {
-        case kKeyCodeClear:
-            return "Clear";
-        case kKeyCodeNewline:
-        case kKeyCodeDpadCenter:
-            return "Enter";
-        case kKeyCodeHome:
-            return "Home";
-        case kKeyCodeDpadDown:
-            return "Down";
-        case kKeyCodeDpadLeft:
-            return "Left";
-        case kKeyCodeDpadRight:
-            return "Right";
-        case kKeyCodeDpadUp:
-            return "Up";
-        // Standard says that DEL becomes U+00007F.
-        case kKeyCodeDel:
-            return "U+00007F";
-        default:
-            char upper[16];
-            sprintf(upper, "U+%06X", windowsKeyCodeForKeyEvent(keyCode));
-            return String(upper);
+    case kKeyCodeClear:
+        return "Clear";
+    case kKeyCodeNewline:
+    case kKeyCodeDpadCenter:
+        return "Enter";
+    case kKeyCodeHome:
+        return "Home";
+    case kKeyCodeDpadDown:
+        return "Down";
+    case kKeyCodeDpadLeft:
+        return "Left";
+    case kKeyCodeDpadRight:
+        return "Right";
+    case kKeyCodeDpadUp:
+        return "Up";
+    // Standard says that DEL becomes U+00007F.
+    case kKeyCodeDel:
+        return "U+00007F";
+    default:
+        char upper[16];
+        sprintf(upper, "U+%06X", windowsKeyCodeForKeyEvent(keyCode));
+        return String(upper);
     }
 }
 
diff --git a/WebCore/platform/android/ScreenAndroid.cpp b/WebCore/platform/android/ScreenAndroid.cpp
index 2439c1f..dcd2d10 100644
--- a/WebCore/platform/android/ScreenAndroid.cpp
+++ b/WebCore/platform/android/ScreenAndroid.cpp
@@ -31,14 +31,12 @@
 
 #include "FloatRect.h"
 #include "Widget.h"
-
+#include "ui/DisplayInfo.h"
+#include "ui/PixelFormat.h"
+#include "ui/SurfaceComposerClient.h"
 #undef LOG // FIXME: Still have to do this to get the log to show up
 #include "utils/Log.h"
 
-#include "ui/SurfaceComposerClient.h"
-#include "ui/PixelFormat.h"
-#include "ui/DisplayInfo.h"
-
 namespace WebCore {
 
 int screenDepth(Widget* page)
@@ -70,18 +68,18 @@ int Screen::orientation() const
     // to the values described here
     // (http://developer.apple.com/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/chapter_8_section_6.html)
     switch (info.orientation) {
-        case android::ISurfaceComposer::eOrientationDefault:
-            return 0;
-        case android::ISurfaceComposer::eOrientation90:
-            return 90;
-        case android::ISurfaceComposer::eOrientation180:
-            return 180;
-        case android::ISurfaceComposer::eOrientation270:
-            return -90;
-        default:
-            LOGE("Bad orientation returned from getDisplayIndo %d",
-                    info.orientation);
-            return 0;
+    case android::ISurfaceComposer::eOrientationDefault:
+        return 0;
+    case android::ISurfaceComposer::eOrientation90:
+        return 90;
+    case android::ISurfaceComposer::eOrientation180:
+        return 180;
+    case android::ISurfaceComposer::eOrientation270:
+        return -90;
+    default:
+        LOGE("Bad orientation returned from getDisplayIndo %d",
+                info.orientation);
+        return 0;
     }
 }
 #endif
diff --git a/WebCore/platform/android/TemporaryLinkStubs.cpp b/WebCore/platform/android/TemporaryLinkStubs.cpp
index 215c7f5..e1889f0 100644
--- a/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -28,17 +28,15 @@
 
 #define ANDROID_COMPILE_HACK
 
-#include <stdio.h>
-#include <stdlib.h>
 #include "AXObjectCache.h"
+#include "CString.h"
 #include "CachedPage.h"
 #include "CachedResource.h"
-#include "CookieJar.h"
+#include "Clipboard.h"
 #include "Console.h"
 #include "ContextMenu.h"
 #include "ContextMenuItem.h"
-#include "Clipboard.h"
-#include "CString.h"
+#include "CookieJar.h"
 #include "Cursor.h"
 #include "Database.h"
 #include "DocumentFragment.h"
@@ -48,8 +46,8 @@
 #include "File.h"
 #include "Font.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameLoadRequest.h"
+#include "FrameLoader.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLFrameOwnerElement.h"
@@ -59,21 +57,11 @@
 #include "IconDatabase.h"
 #include "IconLoader.h"
 #include "IntPoint.h"
-
-#if USE(JSC)
-#include "JavaScriptCallFrame.h"
-#include "JavaScriptDebugServer.h"
-#include "API/JSClassRef.h"
-#include "JavaScriptProfile.h"
-#include "jni_utility.h"
-#endif
-
 #include "KURL.h"
 #include "Language.h"
-#include "loader.h"
 #include "LocalizedStrings.h"
-#include "MainResourceLoader.h"
 #include "MIMETypeRegistry.h"
+#include "MainResourceLoader.h"
 #include "Node.h"
 #include "NotImplemented.h"
 #include "PageCache.h"
@@ -88,6 +76,17 @@
 #include "ScrollbarTheme.h"
 #include "SmartReplace.h"
 #include "Widget.h"
+#include "loader.h"
+#include <stdio.h>
+#include <stdlib.h>
+
+#if USE(JSC)
+#include "API/JSClassRef.h"
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+#include "JavaScriptProfile.h"
+#include "jni_utility.h"
+#endif
 
 using namespace WebCore;
 
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index 1afcc23..0c80636 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -32,12 +32,11 @@
 #define ChromiumBridge_h
 
 #include "FileSystem.h"
+#include "ImageSource.h"
 #include "LinkHash.h"
 #include "PassRefPtr.h"
 #include "PasteboardPrivate.h"
 
-class NativeImageSkia;
-
 typedef struct NPObject NPObject;
 typedef struct _NPP NPP_t;
 typedef NPP_t* NPP;
@@ -78,7 +77,7 @@ namespace WebCore {
         static void clipboardWriteSelection(const String&, const KURL&, const String&, bool);
         static void clipboardWritePlainText(const String&);
         static void clipboardWriteURL(const KURL&, const String&);
-        static void clipboardWriteImage(const NativeImageSkia*, const KURL&, const String&);
+        static void clipboardWriteImage(NativeImagePtr, const KURL&, const String&);
 
         // Cookies ------------------------------------------------------------
         static void setCookies(const KURL& url, const KURL& firstPartyForCookies, const String& value);
@@ -127,6 +126,9 @@ namespace WebCore {
         static void notifyJSOutOfMemory(Frame*);
         static bool allowScriptDespiteSettings(const KURL& documentURL);
 
+        // Keygen -------------------------------------------------------------
+        static String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challenge, const KURL& url);
+
         // Language -----------------------------------------------------------
         static String computedDefaultLanguage();
 
diff --git a/WebCore/platform/chromium/ChromiumDataObject.h b/WebCore/platform/chromium/ChromiumDataObject.h
index a227001..3e8675e 100644
--- a/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/WebCore/platform/chromium/ChromiumDataObject.h
@@ -55,38 +55,7 @@ namespace WebCore {
 
         void clear();
         bool hasData() const;
-        
-        KURL mainURL() const { return url; }
-        void setMainURL(const KURL& newURL) { url = newURL; }
 
-        String mainURLTitle() const { return urlTitle; }
-        void setMainURLTitle(const String& newURLTitle) { urlTitle = newURLTitle; }
-
-        String textPlain() const { return plainText; }
-        void setTextPlain(const String& newText) { plainText = newText; }
-
-        String textHTML() const { return textHtml; }
-        void setTextHTML(const String& newText) { textHtml = newText; }
-
-        KURL htmlBaseURL() const { return htmlBaseUrl; }
-        void setHTMLBaseURL(const KURL& newURL) { htmlBaseUrl = newURL; }
-
-        SharedBuffer* content() const { return fileContent.get(); }
-        PassRefPtr<SharedBuffer> releaseContent() { return fileContent.release(); }
-        void setContent(PassRefPtr<SharedBuffer> newContent) { fileContent = newContent; }
-
-        String contentFileExtension() const { return fileExtension; }
-        void setContentFileExtension(const String& newFileExtension) { fileExtension = newFileExtension; }
-
-        String contentFileName() const { return fileContentFilename; }
-        void setContentFileName(const String& newFilename) { fileContentFilename = newFilename; }
-
-        const Vector<String>& fileNames() const { return filenames; }
-        void setFileNames(const Vector<String>& newFilenames) { filenames = newFilenames; }
-        void takeFileNames(Vector<String>& newFilenames) { filenames.swap(newFilenames); }
-
-        // Interim state: All members will become private, do NOT access them directly! 
-        // Rather use the above accessor methods (or devise new ones if necessary).
         KURL url;
         String urlTitle;
 
diff --git a/WebCore/platform/chromium/FramelessScrollViewClient.h b/WebCore/platform/chromium/FramelessScrollViewClient.h
index 4b32a43..35bae10 100644
--- a/WebCore/platform/chromium/FramelessScrollViewClient.h
+++ b/WebCore/platform/chromium/FramelessScrollViewClient.h
@@ -34,6 +34,7 @@
 #include "HostWindow.h"
 
 namespace WebCore {
+    class FramelessScrollView;
 
     class FramelessScrollViewClient : public HostWindow {
     public:
diff --git a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
index 5950de1..e3d5f61 100644
--- a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
+++ b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
@@ -91,6 +91,7 @@ int windowsKeyCodeForKeyEvent(unsigned keycode)
     case GDK_Control_R:
         return VKEY_CONTROL; // (11) CTRL key
     case GDK_Menu:
+        return VKEY_APPS;  // (5D) Applications key (Natural keyboard)
     case GDK_Alt_L:
     case GDK_Alt_R:
         return VKEY_MENU; // (12) ALT key
@@ -261,7 +262,6 @@ int windowsKeyCodeForKeyEvent(unsigned keycode)
         return VKEY_LWIN; // (5B) Left Windows key (Microsoft Natural keyboard)
     case GDK_Meta_R:
         return VKEY_RWIN; // (5C) Right Windows key (Natural keyboard)
-        // VKEY_APPS (5D) Applications key (Natural keyboard)
         // VKEY_SLEEP (5F) Computer Sleep key
         // VKEY_SEPARATOR (6C) Separator key
         // VKEY_SUBTRACT (6D) Subtract key
diff --git a/WebCore/platform/chromium/MimeTypeRegistryChromium.cpp b/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
index 0f371b1..51bff80 100644
--- a/WebCore/platform/chromium/MimeTypeRegistryChromium.cpp
+++ b/WebCore/platform/chromium/MIMETypeRegistryChromium.cpp
@@ -78,6 +78,8 @@ String MIMETypeRegistry::getMIMETypeForPath(const String& path)
         // if a plugin can handle the extension.
         mimeType = getPluginMimeTypeFromExtension(extension);
     }
+    if (mimeType.isEmpty())
+        return "application/octet-stream";
     return mimeType;
 }
 
diff --git a/WebCore/platform/chromium/PasteboardChromium.cpp b/WebCore/platform/chromium/PasteboardChromium.cpp
index 7702730..4929eb8 100644
--- a/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -147,10 +147,7 @@ void Pasteboard::writeImage(Node* node, const KURL&, const String& title)
     }
     KURL url = urlString.isEmpty() ? KURL() : node->document()->completeURL(deprecatedParseURL(urlString));
 
-    NativeImageSkia* bitmap = 0;
-#if !PLATFORM(CG)
-    bitmap = image->nativeImageForCurrentFrame();
-#endif
+    NativeImagePtr bitmap = image->nativeImageForCurrentFrame();
     ChromiumBridge::clipboardWriteImage(bitmap, url, title);
 }
 
diff --git a/WebCore/platform/chromium/SSLKeyGeneratorChromium.cpp b/WebCore/platform/chromium/SSLKeyGeneratorChromium.cpp
index fdedf2b..49d9517 100644
--- a/WebCore/platform/chromium/SSLKeyGeneratorChromium.cpp
+++ b/WebCore/platform/chromium/SSLKeyGeneratorChromium.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -31,22 +31,29 @@
 #include "config.h"
 #include "SSLKeyGenerator.h"
 
+#include "ChromiumBridge.h"
+#include "PlatformString.h"
+
 namespace WebCore {
 
-// These are defined in webkit/glue/localized_strings.cpp.
+// These are defined in webkit/api/src/LocalizedStrings.cpp.
 String keygenMenuHighGradeKeySize();
 String keygenMenuMediumGradeKeySize();
 
-// Returns the key sizes supported by the HTML keygen tag.  The first string
-// is displayed as the default key size in the keygen menu.
-Vector<String> supportedKeySizes()
+void getSupportedKeySizes(Vector<String>& sizes)
 {
-    Vector<String> sizes(2);
+    sizes.resize(2);
     sizes[0] = keygenMenuHighGradeKeySize();
     sizes[1] = keygenMenuMediumGradeKeySize();
-    return sizes;
 }
 
-// FIXME: implement signedPublicKeyAndChallengeString here.
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex,
+                                         const String& challengeString,
+                                         const KURL& url)
+{
+    return ChromiumBridge::signedPublicKeyAndChallengeString(keySizeIndex,
+                                                             challengeString,
+                                                             url);
+}
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index ed8bf36..64f58c4 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -140,9 +140,17 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
 
     if (rect.height() > 10 && rect.width() > 10) {
         paint.setARGB(0xff, 0x9d, 0x96, 0x8e);
-        drawHorizLine(canvas, midx - 1, midx + 3, midy, paint);
-        drawHorizLine(canvas, midx - 1, midx + 3, midy - 3, paint);
-        drawHorizLine(canvas, midx - 1, midx + 3, midy + 3, paint);
+        const int grippyHalfWidth = 2;
+        const int interGrippyOffset = 3;
+        if (vertical) {
+            drawHorizLine(canvas, midx - grippyHalfWidth, midx + grippyHalfWidth, midy - interGrippyOffset, paint);
+            drawHorizLine(canvas, midx - grippyHalfWidth, midx + grippyHalfWidth, midy,                     paint);
+            drawHorizLine(canvas, midx - grippyHalfWidth, midx + grippyHalfWidth, midy + interGrippyOffset, paint);
+        } else {
+            drawVertLine(canvas, midx - interGrippyOffset, midy - grippyHalfWidth, midy + grippyHalfWidth, paint);
+            drawVertLine(canvas, midx,                     midy - grippyHalfWidth, midy + grippyHalfWidth, paint);
+            drawVertLine(canvas, midx + interGrippyOffset, midy - grippyHalfWidth, midy + grippyHalfWidth, paint);
+        }
     }
 }
 
diff --git a/WebCore/platform/chromium/TemporaryLinkStubs.cpp b/WebCore/platform/chromium/TemporaryLinkStubs.cpp
index f6e77d4..1f60d95 100644
--- a/WebCore/platform/chromium/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/chromium/TemporaryLinkStubs.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -36,11 +36,16 @@
 
 namespace WebCore {
 
-String signedPublicKeyAndChallengeString(unsigned, const String&, const KURL&) { notImplemented(); return String(); }
-void getSupportedKeySizes(Vector<String>&) { notImplemented(); }
+String KURL::fileSystemPath() const
+{
+    notImplemented();
+    return String();
+}
 
-String KURL::fileSystemPath() const { notImplemented(); return String(); }
-
-PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&) { notImplemented(); return 0; }
+PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&)
+{
+    notImplemented();
+    return 0;
+}
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index b1d1ef9..5b62b2c 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -334,6 +334,11 @@ namespace WebCore {
         void addPath(const Path&);
 
         void clip(const Path&);
+
+        // This clip function is used only by <canvas> code. It allows
+        // implementations to handle clipping on the canvas differently since
+        // the disipline is different.
+        void canvasClip(const Path&);
         void clipOut(const Path&);
 
         void scale(const FloatSize&);
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
index 5223e05..07ec04d 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -29,6 +29,7 @@
 #include "PlatformString.h"
 
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #include <OpenGL/OpenGL.h>
@@ -45,6 +46,7 @@ const Platform3DObject NullPlatform3DObject = 0;
 #endif
 
 namespace WebCore {
+    class CanvasActiveInfo;
     class CanvasArray;
     class CanvasBuffer;
     class CanvasUnsignedByteArray;
@@ -61,17 +63,23 @@ namespace WebCore {
     class HTMLVideoElement;
     class ImageData;
     class WebKitCSSMatrix;
-    
+
+    struct ActiveInfo {
+        String name;
+        unsigned type;
+        int size;
+    };
+
     // FIXME: ideally this would be used on all platforms.
 #if PLATFORM(CHROMIUM)
     class GraphicsContext3DInternal;
 #endif
 
-    class GraphicsContext3D : Noncopyable {
+    class GraphicsContext3D : public Noncopyable {
     public:
         enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
     
-        GraphicsContext3D();
+        static PassOwnPtr<GraphicsContext3D> create();
         virtual ~GraphicsContext3D();
 
 #if PLATFORM(MAC)
@@ -85,7 +93,6 @@ namespace WebCore {
         Platform3DObject platformTexture() const { return NullPlatform3DObject; }
 #endif
         void checkError() const;
-        
         void makeContextCurrent();
         
         // Helper to return the size in bytes of OpenGL data types
@@ -141,6 +148,9 @@ namespace WebCore {
         void frontFace(unsigned long mode);
         void generateMipmap(unsigned long target);
 
+        bool getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo&);
+        bool getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo&);
+
         int  getAttribLocation(CanvasProgram*, const String& name);
 
         bool getBoolean(unsigned long pname);
@@ -204,8 +214,7 @@ namespace WebCore {
         void pixelStorei(unsigned long pname, long param);
         void polygonOffset(double factor, double units);
         
-        // TBD
-        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        PassRefPtr<CanvasArray> readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type);
         
         void releaseShaderCompiler();
         void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
@@ -311,6 +320,8 @@ namespace WebCore {
         void deleteTexture(unsigned);        
         
     private:        
+        GraphicsContext3D();
+
         int m_currentWidth, m_currentHeight;
         
 #if PLATFORM(MAC)
diff --git a/WebCore/platform/graphics/GraphicsLayer.cpp b/WebCore/platform/graphics/GraphicsLayer.cpp
index b375bd3..c8582bb 100644
--- a/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -59,9 +59,7 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     : m_client(client)
     , m_anchorPoint(0.5f, 0.5f, 0)
     , m_opacity(1)
-#ifndef NDEBUG
     , m_zPosition(0)
-#endif
     , m_backgroundColorSet(false)
     , m_contentsOpaque(false)
     , m_preserves3D(false)
@@ -74,9 +72,7 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
     , m_maskLayer(0)
-#ifndef NDEBUG
     , m_repaintCount(0)
-#endif
 {
 }
 
@@ -86,6 +82,16 @@ GraphicsLayer::~GraphicsLayer()
     removeFromParent();
 }
 
+bool GraphicsLayer::hasAncestor(GraphicsLayer* ancestor) const
+{
+    for (GraphicsLayer* curr = parent(); curr; curr = curr->parent()) {
+        if (curr == ancestor)
+            return true;
+    }
+    
+    return false;
+}
+
 void GraphicsLayer::addChild(GraphicsLayer* childLayer)
 {
     ASSERT(childLayer != this);
@@ -219,7 +225,6 @@ void GraphicsLayer::resumeAnimations()
 {
 }
 
-#ifndef NDEBUG
 void GraphicsLayer::updateDebugIndicators()
 {
     if (GraphicsLayer::showDebugBorders()) {
@@ -241,7 +246,6 @@ void GraphicsLayer::setZPosition(float position)
 {
     m_zPosition = position;
 }
-#endif
 
 float GraphicsLayer::accumulatedOpacity() const
 {
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index 2924073..85eace0 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -172,6 +172,9 @@ public:
     GraphicsLayer* parent() const { return m_parent; };
     void setParent(GraphicsLayer* layer) { m_parent = layer; } // Internal use only.
     
+    // Returns true if the layer has the given layer as an ancestor (excluding self).
+    bool hasAncestor(GraphicsLayer*) const;
+    
     const Vector<GraphicsLayer*>& children() const { return m_children; }
 
     // Add child layers. If the child is already parented, it will be removed from its old parent.
@@ -273,10 +276,8 @@ public:
     
     void dumpLayer(TextStream&, int indent = 0) const;
 
-#ifndef NDEBUG
     int repaintCount() const { return m_repaintCount; }
     int incrementRepaintCount() { return ++m_repaintCount; }
-#endif
 
     // Report whether the underlying compositing system uses a top-down
     // or a bottom-up coordinate system.
@@ -291,7 +292,6 @@ public:
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation) { m_contentsOrientation = orientation; }
     CompositingCoordinatesOrientation contentsOrientation() const { return m_contentsOrientation; }
 
-#ifndef NDEBUG
     static bool showDebugBorders();
     static bool showRepaintCounter();
     
@@ -302,7 +302,6 @@ public:
     // z-position is the z-equivalent of position(). It's only used for debugging purposes.
     virtual float zPosition() const { return m_zPosition; }
     virtual void setZPosition(float);
-#endif
 
     virtual void distributeOpacity(float);
     virtual float accumulatedOpacity() const;
@@ -339,9 +338,7 @@ protected:
 
     Color m_backgroundColor;
     float m_opacity;
-#ifndef NDEBUG
     float m_zPosition;
-#endif
 
     bool m_backgroundColorSet : 1;
     bool m_contentsOpaque : 1;
@@ -362,9 +359,7 @@ protected:
 
     IntRect m_contentsRect;
 
-#ifndef NDEBUG
     int m_repaintCount;
-#endif
 };
 
 
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index de8afb3..8741c5e 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -931,6 +931,11 @@ void GraphicsContext::clip(const Path& path)
     m_data->clip(path);
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 1b843e4..1350bd3 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -849,6 +849,11 @@ void GraphicsContext::clip(const Path& path)
     m_data->clip(path);
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
diff --git a/WebCore/platform/graphics/chromium/FontLinux.cpp b/WebCore/platform/graphics/chromium/FontLinux.cpp
index dca0efb..a4526a8 100644
--- a/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -57,6 +57,23 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+static bool isCanvasMultiLayered(SkCanvas* canvas)
+{
+    SkCanvas::LayerIter layerIterator(canvas, false);
+    layerIterator.next();
+    return !layerIterator.done();
+}
+
+static bool adjustTextRenderMode(SkPaint* paint, bool isCanvasMultiLayered)
+{
+    // Our layers only have a single alpha channel. This means that subpixel
+    // rendered text cannot be compositied correctly when the layer is
+    // collapsed. Therefore, subpixel text is disabled when we are drawing
+    // onto a layer.
+    if (isCanvasMultiLayered)
+        paint->setLCDRenderText(false);
+}
+
 void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
                       const GlyphBuffer& glyphBuffer,  int from, int numGlyphs,
                       const FloatPoint& point) const {
@@ -84,12 +101,14 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
 
     SkCanvas* canvas = gc->platformContext()->canvas();
     int textMode = gc->platformContext()->getTextDrawingMode();
+    bool haveMultipleLayers = isCanvasMultiLayered(canvas);
 
     // We draw text up to two times (once for fill, once for stroke).
     if (textMode & cTextFill) {
         SkPaint paint;
         gc->platformContext()->setupPaintForFilling(&paint);
         font->platformData().setupPaint(&paint);
+        adjustTextRenderMode(&paint, haveMultipleLayers);
         paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
         paint.setColor(gc->fillColor().rgb());
         canvas->drawPosText(glyphs, numGlyphs << 1, pos, paint);
@@ -102,6 +121,7 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         SkPaint paint;
         gc->platformContext()->setupPaintForStroking(&paint, 0, 0);
         font->platformData().setupPaint(&paint);
+        adjustTextRenderMode(&paint, haveMultipleLayers);
         paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
         paint.setColor(gc->strokeColor().rgb());
 
@@ -472,15 +492,18 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
     }
 
     TextRunWalker walker(run, point.x(), this);
+    bool haveMultipleLayers = isCanvasMultiLayered(canvas);
 
     while (walker.nextScriptRun()) {
         if (fill) {
             walker.fontPlatformDataForScriptRun()->setupPaint(&fillPaint);
+            adjustTextRenderMode(&fillPaint, haveMultipleLayers);
             canvas->drawPosTextH(walker.glyphs(), walker.length() << 1, walker.xPositions(), point.y(), fillPaint);
         }
 
         if (stroke) {
             walker.fontPlatformDataForScriptRun()->setupPaint(&strokePaint);
+            adjustTextRenderMode(&strokePaint, haveMultipleLayers);
             canvas->drawPosTextH(walker.glyphs(), walker.length() << 1, walker.xPositions(), point.y(), strokePaint);
         }
     }
@@ -645,8 +668,6 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run,
 
     if (toX == -1 && !to)
         toX = rightEdge;
-    else if (!walker.rtl())
-        toX += truncateFixedPointToInteger(toAdvance);
 
     ASSERT(fromX != -1 && toX != -1);
 
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index 1e2e552..a2ed9bd 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -30,6 +30,7 @@
 #include "GraphicsContext.h"
 #include "ImageData.h"
 #include <math.h>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
@@ -92,8 +93,8 @@ inline void saturate(double& red, double& green, double& blue, const float& s)
 
 inline void huerotate(double& red, double& green, double& blue, const float& hue)
 {
-    double cosHue = cos(hue * M_PI / 180); 
-    double sinHue = sin(hue * M_PI / 180); 
+    double cosHue = cos(hue * piDouble / 180); 
+    double sinHue = sin(hue * piDouble / 180); 
     double r = red   * (0.213 + cosHue * 0.787 - sinHue * 0.213) +
                green * (0.715 - cosHue * 0.715 - sinHue * 0.715) +
                blue  * (0.072 - cosHue * 0.072 + sinHue * 0.928);
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 43e5edd..0d76d8d 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -92,11 +92,11 @@ void FEComponentTransfer::setAlphaFunction(const ComponentTransferFunction& func
     m_alphaFunc = func;
 }
 
-void identity(unsigned char*, const ComponentTransferFunction&)
+static void identity(unsigned char*, const ComponentTransferFunction&)
 {
 }
 
-void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     const Vector<float>& tableValues = transferFunction.tableValues;
     unsigned n = tableValues.size();
@@ -113,7 +113,7 @@ void table(unsigned char* values, const ComponentTransferFunction& transferFunct
     }
 }
 
-void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     const Vector<float>& tableValues = transferFunction.tableValues;
     unsigned n = tableValues.size();
@@ -128,7 +128,7 @@ void discrete(unsigned char* values, const ComponentTransferFunction& transferFu
     }
 }
 
-void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     for (unsigned i = 0; i < 256; ++i) {
         double val = transferFunction.slope * i + 255 * transferFunction.intercept;
@@ -137,7 +137,7 @@ void linear(unsigned char* values, const ComponentTransferFunction& transferFunc
     }
 }
 
-void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
+static void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
 {
     for (unsigned i = 0; i < 256; ++i) {
         double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), transferFunction.exponent) + transferFunction.offset);
diff --git a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
new file mode 100644
index 0000000..f480f10
--- /dev/null
+++ b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -0,0 +1,140 @@
+/*
+    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
+                  2004, 2005 Rob Buis <buis@kde.org>
+                  2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    aint with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(FILTERS)
+#include "FEGaussianBlur.h"
+
+#include "CanvasPixelArray.h"
+#include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
+    : FilterEffect()
+    , m_in(in)
+    , m_x(x)
+    , m_y(y)
+{
+}
+
+PassRefPtr<FEGaussianBlur> FEGaussianBlur::create(FilterEffect* in, const float& x, const float& y)
+{
+    return adoptRef(new FEGaussianBlur(in, x, y));
+}
+
+float FEGaussianBlur::stdDeviationX() const
+{
+    return m_x;
+}
+
+void FEGaussianBlur::setStdDeviationX(float x)
+{
+    m_x = x;
+}
+
+float FEGaussianBlur::stdDeviationY() const
+{
+    return m_y;
+}
+
+void FEGaussianBlur::setStdDeviationY(float y)
+{
+    m_y = y;
+}
+
+static void boxBlur(CanvasPixelArray*& srcPixelArray, CanvasPixelArray*& dstPixelArray,
+                 unsigned dx, int stride, int strideLine, int effectWidth, int effectHeight, bool alphaImage)
+{
+    int dxLeft = dx / 2;
+    int dxRight = dx - dxLeft;
+
+    for (int y = 0; y < effectHeight; ++y) {
+        int line = y * strideLine;
+        for (int channel = 3; channel >= 0; --channel) {
+            int sum = 0;
+            // Fill the kernel
+            int maxKernelSize = std::min(dxRight, effectWidth);
+            for (int i = 0; i < maxKernelSize; ++i)
+                sum += srcPixelArray->get(line + i * stride + channel);
+
+            // Blurring
+            for (int x = 0; x < effectWidth; ++x) {
+                int pixelByteOffset = line + x * stride + channel;
+                dstPixelArray->set(pixelByteOffset, static_cast<unsigned char>(sum / dx));
+                if (x >= dxLeft)
+                    sum -= srcPixelArray->get(pixelByteOffset - dxLeft * stride);
+                if (x + dxRight < effectWidth)
+                    sum += srcPixelArray->get(pixelByteOffset + dxRight * stride);
+            }
+            if (alphaImage) // Source image is black, it just has different alpha values
+                break;
+        }
+    }
+}
+
+void FEGaussianBlur::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    setIsAlphaImage(m_in->isAlphaImage());
+
+    if (m_x == 0 || m_y == 0)
+        return;
+
+    unsigned sdx = static_cast<unsigned>(floor(m_x * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+    unsigned sdy = static_cast<unsigned>(floor(m_y * 3 * sqrt(2 * piDouble) / 4.f + 0.5f));
+
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<ImageData> srcImageData(m_in->resultImage()->getPremultipliedImageData(effectDrawingRect));
+    CanvasPixelArray* srcPixelArray(srcImageData->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> tmpImageData = ImageData::create(imageRect.width(), imageRect.height());
+    CanvasPixelArray* tmpPixelArray(tmpImageData->data());
+
+    int stride = 4 * imageRect.width();
+    for (int i = 0; i < 3; ++i) {
+        boxBlur(srcPixelArray, tmpPixelArray, sdx, 4, stride, imageRect.width(), imageRect.height(), isAlphaImage());
+        boxBlur(tmpPixelArray, srcPixelArray, sdy, stride, 4, imageRect.height(), imageRect.width(), isAlphaImage());
+    }
+
+    resultImage()->putPremultipliedImageData(srcImageData.get(), imageRect, IntPoint());
+}
+
+void FEGaussianBlur::dump()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h b/WebCore/platform/graphics/filters/FEGaussianBlur.h
index 69f1cc5..ecdb9e3 100644
--- a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.h
+++ b/WebCore/platform/graphics/filters/FEGaussianBlur.h
@@ -19,10 +19,10 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef SVGFEGaussianBlur_h
-#define SVGFEGaussianBlur_h
+#ifndef FEGaussianBlur_h
+#define FEGaussianBlur_h
 
-#if ENABLE(SVG) && ENABLE(FILTERS)
+#if ENABLE(FILTERS)
 #include "FilterEffect.h"
 #include "Filter.h"
 
@@ -41,7 +41,6 @@ namespace WebCore {
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
         void apply(Filter*);
         void dump();
-        TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
         FEGaussianBlur(FilterEffect*, const float&, const float&);
@@ -53,6 +52,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(FILTERS)
+#endif // ENABLE(FILTERS)
 
-#endif // SVGFEGaussianBlur_h
+#endif // FEGaussianBlur_h
diff --git a/WebCore/platform/graphics/filters/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
index 5818e50..68900b5 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -25,14 +25,11 @@
 namespace WebCore {
 
 FilterEffect::FilterEffect()
-    : m_xBBoxMode(false)
-    , m_yBBoxMode(false)
-    , m_widthBBoxMode(false)
-    , m_heightBBoxMode(false)
-    , m_hasX(false)
+    : m_hasX(false)
     , m_hasY(false)
     , m_hasWidth(false)
     , m_hasHeight(false)
+    , m_alphaImage(false)
 {
 }
 
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
index e2b8a0e..b30e513 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -38,18 +38,6 @@ namespace WebCore {
     public:
         virtual ~FilterEffect();
 
-        bool xBoundingBoxMode() const { return m_xBBoxMode; }
-        void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-        bool yBoundingBoxMode() const { return m_yBBoxMode; }
-        void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
-        bool widthBoundingBoxMode() const { return m_widthBBoxMode; }
-        void setWidthBoundingBoxMode(bool bboxMode) { m_widthBBoxMode = bboxMode; }
-
-        bool heightBoundingBoxMode() const { return m_heightBBoxMode; }
-        void setHeightBoundingBoxMode(bool bboxMode) { m_heightBBoxMode = bboxMode; }
-
         void setUnionOfChildEffectSubregions(const FloatRect& uniteRect) { m_unionOfChildEffectSubregions = uniteRect; }
         FloatRect unionOfChildEffectSubregions() const { return m_unionOfChildEffectSubregions; }
 
@@ -79,6 +67,10 @@ namespace WebCore {
         FloatRect calculateDrawingRect(const FloatRect&);
         IntRect calculateDrawingIntRect(const FloatRect&);
 
+        // black image with different alpha values
+        bool isAlphaImage() { return m_alphaImage; }
+        void setIsAlphaImage(bool alphaImage) { m_alphaImage = alphaImage; }
+
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return filter->filterRegion(); }
         virtual FloatRect calculateEffectRect(Filter*);
         virtual void apply(Filter*) = 0;
@@ -102,6 +94,8 @@ namespace WebCore {
         bool m_hasWidth : 1;
         bool m_hasHeight : 1;
 
+        bool m_alphaImage;
+
         FloatRect m_subRegion;
         FloatRect m_unionOfChildEffectSubregions;
 
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 57436be..1b6309b 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -59,6 +59,8 @@ void SourceAlpha::apply(Filter* filter)
     if (!filterContext)
         return;
 
+    setIsAlphaImage(true);
+
     FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
     filterContext->save();
     filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
diff --git a/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp b/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
index a6c2dfb..567da74 100644
--- a/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
@@ -214,7 +214,7 @@ static gboolean webkit_data_src_uri_set_uri(GstURIHandler* handler, const gchar*
             GInputStream* stream = g_memory_input_stream_new_from_data(decoded_data,
                                                                        decoded_size,
                                                                        g_free);
-            g_object_set(src->kid, "stream", stream, 0);
+            g_object_set(src->kid, "stream", stream, NULL);
             g_object_unref(stream);
 
             if (src->uri) {
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
index 65c64b4..8d1d261 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
@@ -25,9 +25,10 @@
 #if ENABLE(VIDEO)
 
 #include "MediaPlayerPrivateGStreamer.h"
-#include "DataSourceGStreamer.h"
+
 
 #include "CString.h"
+#include "DataSourceGStreamer.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
 #include "KURL.h"
@@ -35,11 +36,10 @@
 #include "MediaPlayer.h"
 #include "NotImplemented.h"
 #include "ScrollView.h"
+#include "TimeRanges.h"
 #include "VideoSinkGStreamer.h"
 #include "Widget.h"
-#include "TimeRanges.h"
 
-#include <gst/base/gstbasesrc.h>
 #include <gst/gst.h>
 #include <gst/interfaces/mixer.h>
 #include <gst/interfaces/xoverlay.h>
@@ -52,16 +52,20 @@ using namespace std;
 
 namespace WebCore {
 
-gboolean mediaPlayerPrivateErrorCallback(GstBus* bus, GstMessage* message, gpointer data)
+gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data)
 {
-    if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_ERROR) {
-        GOwnPtr<GError> err;
-        GOwnPtr<gchar> debug;
+    GOwnPtr<GError> err;
+    GOwnPtr<gchar> debug;
+    MediaPlayer::NetworkState error;
+    MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+    gint percent = 0;
 
+    switch (GST_MESSAGE_TYPE(message)) {
+    case GST_MESSAGE_ERROR:
         gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
         LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
 
-        MediaPlayer::NetworkState error = MediaPlayer::Empty;
+        error = MediaPlayer::Empty;
         if (err->domain == GST_CORE_ERROR || err->domain == GST_LIBRARY_ERROR)
             error = MediaPlayer::DecodeError;
         else if (err->domain == GST_RESOURCE_ERROR)
@@ -69,44 +73,32 @@ gboolean mediaPlayerPrivateErrorCallback(GstBus* bus, GstMessage* message, gpoin
         else if (err->domain == GST_STREAM_ERROR)
             error = MediaPlayer::NetworkError;
 
-        MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
         if (mp)
             mp->loadingFailed(error);
-    }
-    return true;
-}
-
-gboolean mediaPlayerPrivateEOSCallback(GstBus* bus, GstMessage* message, gpointer data)
-{
-    if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_EOS) {
+        break;
+    case GST_MESSAGE_EOS:
         LOG_VERBOSE(Media, "End of Stream");
-        MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
         mp->didEnd();
-    }
-    return true;
-}
-
-gboolean mediaPlayerPrivateStateCallback(GstBus* bus, GstMessage* message, gpointer data)
-{
-    if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_STATE_CHANGED) {
-        MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+        break;
+    case GST_MESSAGE_STATE_CHANGED:
         mp->updateStates();
-    }
-    return true;
-}
-
-gboolean mediaPlayerPrivateBufferingCallback(GstBus* bus, GstMessage* message, gpointer data)
-{
-    if (GST_MESSAGE_TYPE(message) == GST_MESSAGE_BUFFERING) {
-        gint percent = 0;
+        break;
+    case GST_MESSAGE_BUFFERING:
         gst_message_parse_buffering(message, &percent);
         LOG_VERBOSE(Media, "Buffering %d", percent);
+        break;
+    default:
+        LOG_VERBOSE(Media, "Unhandled GStreamer message type: %s",
+                    GST_MESSAGE_TYPE_NAME(message));
+        break;
     }
     return true;
 }
 
-static void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, MediaPlayerPrivate* playerPrivate)
+void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivate* playerPrivate)
 {
+    g_return_if_fail(GST_IS_BUFFER(buffer));
+    gst_buffer_replace(&playerPrivate->m_buffer, buffer);
     playerPrivate->repaint();
 }
 
@@ -123,7 +115,8 @@ void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
 
 static bool gstInitialized = false;
 
-static void do_gst_init() {
+static void do_gst_init()
+{
     // FIXME: We should pass the arguments from the command line
     if (!gstInitialized) {
         gst_init(0, 0);
@@ -139,50 +132,33 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_playBin(0)
     , m_videoSink(0)
     , m_source(0)
-    , m_rate(1.0f)
     , m_endTime(numeric_limits<float>::infinity())
-    , m_volume(0.5f)
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
     , m_startedPlaying(false)
     , m_isStreaming(false)
     , m_size(IntSize())
-    , m_visible(true)
+    , m_buffer(0)
     , m_paused(true)
     , m_seeking(false)
     , m_errorOccured(false)
 {
     do_gst_init();
-
-    // FIXME: The size shouldn't be fixed here, this is just a quick hack.
-    m_surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, 640, 480);
-}
-
-static gboolean idleUnref(gpointer data)
-{
-    g_object_unref(reinterpret_cast<GObject*>(data));
-    return FALSE;
 }
 
 MediaPlayerPrivate::~MediaPlayerPrivate()
 {
-    if (m_surface)
-        cairo_surface_destroy(m_surface);
+    if (m_buffer)
+        gst_buffer_unref(m_buffer);
+    m_buffer = 0;
 
     if (m_playBin) {
         gst_element_set_state(m_playBin, GST_STATE_NULL);
         gst_object_unref(GST_OBJECT(m_playBin));
     }
 
-    // FIXME: We should find a better way to handle the lifetime of this object; this is
-    // needed because the object is sometimes being destroyed inbetween a call to
-    // webkit_video_sink_render, and the idle it schedules. Adding a ref in
-    // webkit_video_sink_render that would be balanced by the idle is not an option,
-    // because in some cases the destruction of the sink may happen in time for the idle
-    // to be removed from the queue, so it may not run. It would also cause lots of ref
-    // counting churn (render/idle are called many times). This is an ugly race.
     if (m_videoSink) {
-        g_idle_add(idleUnref, m_videoSink);
+        g_object_unref(m_videoSink);
         m_videoSink = 0;
     }
 }
@@ -226,24 +202,14 @@ float MediaPlayerPrivate::duration() const
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-#if !GST_CHECK_VERSION(0, 10, 23)
-    // We try to get the duration, but we do not trust the
-    // return value of the query function only; the problem we are
-    // trying to work-around here is that pipelines in stream mode may
-    // not be able to figure out the duration, but still return true!
-    // See https://bugs.webkit.org/show_bug.cgi?id=24639 which has been
-    // fixed in gst-plugins-base 0.10.23
-    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeLength <= 0) {
-#else
-    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength)) {
-#endif
+    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || timeLength == GST_CLOCK_TIME_NONE) {
         LOG_VERBOSE(Media, "Time duration query failed.");
         return numeric_limits<float>::infinity();
     }
 
     LOG_VERBOSE(Media, "Duration: %" GST_TIME_FORMAT, GST_TIME_ARGS(timeLength));
 
-    return (float) (timeLength / 1000000000.0);
+    return (float) ((guint64) timeLength / 1000000000.0);
     // FIXME: handle 3.14.9.5 properly
 }
 
@@ -288,7 +254,7 @@ void MediaPlayerPrivate::seek(float time)
         return;
 
     LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(sec));
-    if (!gst_element_seek( m_playBin, m_rate,
+    if (!gst_element_seek(m_playBin, m_player->rate(),
             GST_FORMAT_TIME,
             (GstSeekFlags)(GST_SEEK_FLAG_FLUSH),
             GST_SEEK_TYPE_SET, sec,
@@ -340,14 +306,17 @@ IntSize MediaPlayerPrivate::naturalSize() const
     // https://bugzilla.gnome.org/show_bug.cgi?id=596326
     int width = 0, height = 0;
     if (GstPad* pad = gst_element_get_static_pad(m_videoSink, "sink")) {
-        gst_video_get_size(GST_PAD(pad), &width, &height);
         GstCaps* caps = GST_PAD_CAPS(pad);
         gfloat pixelAspectRatio;
         gint pixelAspectRatioNumerator, pixelAspectRatioDenominator;
 
-        if (!gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
-                                                     &pixelAspectRatioDenominator))
-            pixelAspectRatioNumerator = pixelAspectRatioDenominator = 1;
+        if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps) ||
+            !gst_video_format_parse_caps(caps, NULL, &width, &height) ||
+            !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
+                                                           &pixelAspectRatioDenominator)) {
+            gst_object_unref(GST_OBJECT(pad));
+            return IntSize();
+        }
 
         pixelAspectRatio = (gfloat) pixelAspectRatioNumerator / (gfloat) pixelAspectRatioDenominator;
         width *= pixelAspectRatio;
@@ -376,21 +345,10 @@ bool MediaPlayerPrivate::hasAudio() const
 
 void MediaPlayerPrivate::setVolume(float volume)
 {
-    m_volume = volume;
-    LOG_VERBOSE(Media, "Volume to %f", volume);
-
     if (!m_playBin)
         return;
 
-    g_object_set(G_OBJECT(m_playBin), "volume", m_volume, NULL);
-}
-
-void MediaPlayerPrivate::setMuted(bool mute)
-{
-    if (!m_playBin)
-        return;
-
-    g_object_set(G_OBJECT(m_playBin), "mute", mute, NULL);
+    g_object_set(G_OBJECT(m_playBin), "volume", static_cast<double>(volume), NULL);
 }
 
 void MediaPlayerPrivate::setRate(float rate)
@@ -403,7 +361,6 @@ void MediaPlayerPrivate::setRate(float rate)
     if (m_isStreaming)
         return;
 
-    m_rate = rate;
     LOG_VERBOSE(Media, "Set Rate to %f", rate);
     seek(currentTime());
 }
@@ -495,7 +452,11 @@ unsigned MediaPlayerPrivate::totalBytes() const
 
 void MediaPlayerPrivate::cancelLoad()
 {
-    notImplemented();
+    if (m_networkState < MediaPlayer::Loading || m_networkState == MediaPlayer::Loaded)
+        return;
+
+    if (m_playBin)
+        gst_element_set_state(m_playBin, GST_STATE_NULL);
 }
 
 void MediaPlayerPrivate::updateStates()
@@ -525,14 +486,15 @@ void MediaPlayerPrivate::updateStates()
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
 
-        if (state == GST_STATE_READY) {
-            m_readyState = MediaPlayer::HaveEnoughData;
-        } else if (state == GST_STATE_PAUSED)
+        if (state == GST_STATE_READY)
+            m_readyState = MediaPlayer::HaveNothing;
+        else if (state == GST_STATE_PAUSED)
             m_readyState = MediaPlayer::HaveEnoughData;
 
-        if (state == GST_STATE_PLAYING)
+        if (state == GST_STATE_PLAYING) {
+            m_readyState = MediaPlayer::HaveEnoughData;
             m_paused = false;
-        else
+        } else
             m_paused = true;
 
         if (m_seeking) {
@@ -563,9 +525,9 @@ void MediaPlayerPrivate::updateStates()
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
 
-        if (state == GST_STATE_READY) {
-            m_readyState = MediaPlayer::HaveFutureData;
-        } else if (state == GST_STATE_PAUSED)
+        if (state == GST_STATE_READY)
+            m_readyState = MediaPlayer::HaveNothing;
+        else if (state == GST_STATE_PAUSED)
             m_readyState = MediaPlayer::HaveCurrentData;
 
         m_networkState = MediaPlayer::Loading;
@@ -639,23 +601,11 @@ void MediaPlayerPrivate::loadingFailed(MediaPlayer::NetworkState error)
 
 void MediaPlayerPrivate::setSize(const IntSize& size)
 {
-    // Destroy and re-create the cairo surface only if the size
-    // changed.
-    if (size != m_size) {
-        if (m_surface)
-            cairo_surface_destroy(m_surface);
-        m_surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, size.width(),
-                                               size.height());
-        g_object_set(m_videoSink, "surface", m_surface, 0);
-    }
-
     m_size = size;
-
 }
 
 void MediaPlayerPrivate::setVisible(bool visible)
 {
-    m_visible = visible;
 }
 
 void MediaPlayerPrivate::repaint()
@@ -668,20 +618,65 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled())
         return;
 
-    if (!m_visible)
+    if (!m_player->visible())
         return;
+    if (!m_buffer)
+        return;
+
+    int width = 0, height = 0;
+    int pixelAspectRatioNumerator = 0;
+    int pixelAspectRatioDenominator = 0;
+    double doublePixelAspectRatioNumerator = 0;
+    double doublePixelAspectRatioDenominator = 0;
+    double displayWidth;
+    double displayHeight;
+    double scale, gapHeight, gapWidth;
+
+    GstCaps *caps = gst_buffer_get_caps(m_buffer);
+
+    if (!gst_video_format_parse_caps(caps, NULL, &width, &height) ||
+        !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator, &pixelAspectRatioDenominator)) {
+      gst_caps_unref(caps);
+      return;
+    }
+
+    displayWidth = width;
+    displayHeight = height;
+    doublePixelAspectRatioNumerator = pixelAspectRatioNumerator;
+    doublePixelAspectRatioDenominator = pixelAspectRatioDenominator;
 
     cairo_t* cr = context->platformContext();
+    cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(m_buffer),
+                                                               CAIRO_FORMAT_RGB24,
+                                                               width, height,
+                                                               4 * width);
 
     cairo_save(cr);
     cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
 
+    displayWidth *= doublePixelAspectRatioNumerator / doublePixelAspectRatioDenominator;
+    displayHeight *= doublePixelAspectRatioDenominator / doublePixelAspectRatioNumerator;
+
+    scale = MIN (rect.width () / displayWidth, rect.height () / displayHeight);
+    displayWidth *= scale;
+    displayHeight *= scale;
+
+    // Calculate gap between border an picture
+    gapWidth = (rect.width() - displayWidth) / 2.0;
+    gapHeight = (rect.height() - displayHeight) / 2.0;
+
     // paint the rectangle on the context and draw the surface inside.
-    cairo_translate(cr, rect.x(), rect.y());
+    cairo_translate(cr, rect.x() + gapWidth, rect.y() + gapHeight);
     cairo_rectangle(cr, 0, 0, rect.width(), rect.height());
-    cairo_set_source_surface(cr, m_surface, 0, 0);
+    cairo_scale(cr, doublePixelAspectRatioNumerator / doublePixelAspectRatioDenominator,
+                doublePixelAspectRatioDenominator / doublePixelAspectRatioNumerator);
+    cairo_scale(cr, scale, scale);
+    cairo_set_source_surface(cr, src, 0, 0);
     cairo_fill(cr);
     cairo_restore(cr);
+
+    cairo_surface_destroy(src);
+    gst_caps_unref(caps);
 }
 
 static HashSet<String> mimeTypeCache()
@@ -805,25 +800,18 @@ void MediaPlayerPrivate::createGSTPlayBin(String url)
 
     GstBus* bus = gst_pipeline_get_bus(GST_PIPELINE(m_playBin));
     gst_bus_add_signal_watch(bus);
-    g_signal_connect(bus, "message::error", G_CALLBACK(mediaPlayerPrivateErrorCallback), this);
-    g_signal_connect(bus, "message::eos", G_CALLBACK(mediaPlayerPrivateEOSCallback), this);
-    g_signal_connect(bus, "message::state-changed", G_CALLBACK(mediaPlayerPrivateStateCallback), this);
-    g_signal_connect(bus, "message::buffering", G_CALLBACK(mediaPlayerPrivateBufferingCallback), this);
+    g_signal_connect(bus, "message", G_CALLBACK(mediaPlayerPrivateMessageCallback), this);
     gst_object_unref(bus);
 
-    g_object_set(G_OBJECT(m_playBin), "uri", url.utf8().data(), NULL);
-
-    m_videoSink = webkit_video_sink_new(m_surface);
+    g_object_set(G_OBJECT(m_playBin), "uri", url.utf8().data(),
+        "volume", static_cast<double>(m_player->volume()), NULL);
 
-    // This ref is to protect the sink from being destroyed before we stop the idle it
-    // creates internally. See the comment in ~MediaPlayerPrivate.
-    g_object_ref(m_videoSink);
+    m_videoSink = webkit_video_sink_new();
 
+    g_object_ref_sink(m_videoSink);
     g_object_set(m_playBin, "video-sink", m_videoSink, NULL);
 
     g_signal_connect(m_videoSink, "repaint-requested", G_CALLBACK(mediaPlayerPrivateRepaintCallback), this);
-
-    setVolume(m_volume);
 }
 
 }
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
index d305759..54da420 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
@@ -30,8 +30,10 @@
 #include <cairo.h>
 #include <glib.h>
 
-typedef struct _GstElement GstElement;
+typedef struct _WebKitVideoSink WebKitVideoSink;
+typedef struct _GstBuffer GstBuffer;
 typedef struct _GstMessage GstMessage;
+typedef struct _GstElement GstElement;
 typedef struct _GstBus GstBus;
 
 namespace WebCore {
@@ -41,14 +43,11 @@ namespace WebCore {
     class IntRect;
     class String;
 
-    gboolean mediaPlayerPrivateErrorCallback(GstBus* bus, GstMessage* message, gpointer data);
-    gboolean mediaPlayerPrivateEOSCallback(GstBus* bus, GstMessage* message, gpointer data);
-    gboolean mediaPlayerPrivateStateCallback(GstBus* bus, GstMessage* message, gpointer data);
+    gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data);
 
     class MediaPlayerPrivate : public MediaPlayerPrivateInterface {
-        friend gboolean mediaPlayerPrivateErrorCallback(GstBus* bus, GstMessage* message, gpointer data);
-        friend gboolean mediaPlayerPrivateEOSCallback(GstBus* bus, GstMessage* message, gpointer data);
-        friend gboolean mediaPlayerPrivateStateCallback(GstBus* bus, GstMessage* message, gpointer data);
+        friend gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpointer data);
+        friend void mediaPlayerPrivateRepaintCallback(WebKitVideoSink*, GstBuffer *buffer, MediaPlayerPrivate* playerPrivate);
 
         public:
             static void registerMediaEngine(MediaEngineRegistrar);
@@ -74,7 +73,6 @@ namespace WebCore {
 
             void setRate(float);
             void setVolume(float);
-            void setMuted(bool);
 
             int dataRate() const;
 
@@ -126,17 +124,14 @@ namespace WebCore {
             GstElement* m_playBin;
             GstElement* m_videoSink;
             GstElement* m_source;
-            float m_rate;
             float m_endTime;
             bool m_isEndReached;
-            double m_volume;
             MediaPlayer::NetworkState m_networkState;
             MediaPlayer::ReadyState m_readyState;
             bool m_startedPlaying;
             mutable bool m_isStreaming;
             IntSize m_size;
-            bool m_visible;
-            cairo_surface_t* m_surface;
+            GstBuffer* m_buffer;
 
             bool m_paused;
             bool m_seeking;
diff --git a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
index fb86fe9..b5e1a8b 100644
--- a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
@@ -21,8 +21,9 @@
  * SECTION:webkit-video-sink
  * @short_description: GStreamer video sink
  *
- * #WebKitVideoSink is a GStreamer sink element that sends
- * data to a #cairo_surface_t.
+ * #WebKitVideoSink is a GStreamer sink element that triggers
+ * repaints in the WebKit GStreamer media player for the
+ * current video buffer.
  */
 
 #include "config.h"
@@ -57,22 +58,26 @@ enum {
 };
 
 enum {
-    PROP_0,
-    PROP_SURFACE
+    PROP_0
 };
 
 static guint webkit_video_sink_signals[LAST_SIGNAL] = { 0, };
 
 struct _WebKitVideoSinkPrivate {
-    cairo_surface_t* surface;
-    GAsyncQueue* async_queue;
-    gboolean rgb_ordering;
-    int width;
-    int height;
-    int fps_n;
-    int fps_d;
-    int par_n;
-    int par_d;
+    GstBuffer* buffer;
+    guint timeout_id;
+    GMutex* buffer_mutex;
+    GCond* data_cond;
+
+    // If this is TRUE all processing should finish ASAP
+    // This is necessary because there could be a race between
+    // unlock() and render(), where unlock() wins, signals the
+    // GCond, then render() tries to render a frame although
+    // everything else isn't running anymore. This will lead
+    // to deadlocks because render() holds the stream lock.
+    //
+    // Protected by the buffer mutex
+    gboolean unlocked;
 };
 
 #define _do_init(bla) \
@@ -83,8 +88,8 @@ struct _WebKitVideoSinkPrivate {
 
 GST_BOILERPLATE_FULL(WebKitVideoSink,
                      webkit_video_sink,
-                     GstBaseSink,
-                     GST_TYPE_BASE_SINK,
+                     GstVideoSink,
+                     GST_TYPE_VIDEO_SINK,
                      _do_init);
 
 static void
@@ -102,59 +107,37 @@ webkit_video_sink_init(WebKitVideoSink* sink, WebKitVideoSinkClass* klass)
     WebKitVideoSinkPrivate* priv;
 
     sink->priv = priv = G_TYPE_INSTANCE_GET_PRIVATE(sink, WEBKIT_TYPE_VIDEO_SINK, WebKitVideoSinkPrivate);
-    priv->async_queue = g_async_queue_new();
+    priv->data_cond = g_cond_new();
+    priv->buffer_mutex = g_mutex_new();
 }
 
 static gboolean
-webkit_video_sink_idle_func(gpointer data)
+webkit_video_sink_timeout_func(gpointer data)
 {
     WebKitVideoSink* sink = reinterpret_cast<WebKitVideoSink*>(data);
     WebKitVideoSinkPrivate* priv = sink->priv;
     GstBuffer* buffer;
-    GstCaps* caps;
-    GstVideoFormat format;
-    gint par_n, par_d;
-    gfloat par;
-    gint bwidth, bheight;
 
-    if (!priv->async_queue)
-        return FALSE;
+    g_mutex_lock(priv->buffer_mutex);
+    buffer = priv->buffer;
+    priv->buffer = 0;
+    priv->timeout_id = 0;
 
-    buffer = (GstBuffer*)g_async_queue_try_pop(priv->async_queue);
-    if (!buffer || G_UNLIKELY(!GST_IS_BUFFER(buffer)))
+    if (!buffer || priv->unlocked || G_UNLIKELY(!GST_IS_BUFFER(buffer))) {
+        g_cond_signal(priv->data_cond);
+        g_mutex_unlock(priv->buffer_mutex);
         return FALSE;
+    }
 
-    caps = GST_BUFFER_CAPS(buffer);
-    if (!gst_video_format_parse_caps(caps, &format, &bwidth, &bheight)) {
-        GST_ERROR_OBJECT(sink, "Unknown video format in buffer caps '%s'",
-                         gst_caps_to_string(caps));
-        return FALSE;
+    if (G_UNLIKELY(!GST_BUFFER_CAPS(buffer))) {
+        buffer = gst_buffer_make_metadata_writable(buffer);
+        gst_buffer_set_caps(buffer, GST_PAD_CAPS(GST_BASE_SINK_PAD(sink)));
     }
 
-    if (!gst_video_parse_caps_pixel_aspect_ratio(caps, &par_n, &par_d))
-        par_n = par_d = 1;
-
-    par = (gfloat) par_n / (gfloat) par_d;
-
-    // TODO: consider priv->rgb_ordering?
-    cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(buffer),
-                                                               CAIRO_FORMAT_RGB24,
-                                                               bwidth, bheight,
-                                                               4 * bwidth);
-
-    // TODO: We copy the data twice right now. This could be easily improved.
-    cairo_t* cr = cairo_create(priv->surface);
-    cairo_scale(cr, par, 1.0 / par);
-    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
-    cairo_set_source_surface(cr, src, 0, 0);
-    cairo_surface_destroy(src);
-    cairo_rectangle(cr, 0, 0, priv->width, priv->height);
-    cairo_fill(cr);
-    cairo_destroy(cr);
+    g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0, buffer);
     gst_buffer_unref(buffer);
-    g_async_queue_unref(priv->async_queue);
-
-    g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0);
+    g_cond_signal(priv->data_cond);
+    g_mutex_unlock(priv->buffer_mutex);
 
     return FALSE;
 }
@@ -165,53 +148,24 @@ webkit_video_sink_render(GstBaseSink* bsink, GstBuffer* buffer)
     WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(bsink);
     WebKitVideoSinkPrivate* priv = sink->priv;
 
-    g_async_queue_ref(priv->async_queue);
-    g_async_queue_push(priv->async_queue, gst_buffer_ref(buffer));
-    g_idle_add_full(G_PRIORITY_HIGH_IDLE, webkit_video_sink_idle_func, sink, 0);
-
-    return GST_FLOW_OK;
-}
-
-static gboolean
-webkit_video_sink_set_caps(GstBaseSink* bsink, GstCaps* caps)
-{
-    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(bsink);
-    WebKitVideoSinkPrivate* priv = sink->priv;
-    GstStructure* structure;
-    gboolean ret;
-    gint width, height, fps_n, fps_d;
-    int red_mask;
-
-    GstCaps* intersection = gst_caps_intersect(gst_static_pad_template_get_caps(&sinktemplate), caps);
+    g_mutex_lock(priv->buffer_mutex);
 
-    if (gst_caps_is_empty(intersection))
-        return FALSE;
-
-    gst_caps_unref(intersection);
-
-    structure = gst_caps_get_structure(caps, 0);
-
-    ret = gst_structure_get_int(structure, "width", &width);
-    ret &= gst_structure_get_int(structure, "height", &height);
-
-    /* We dont yet use fps but handy to have */
-    ret &= gst_structure_get_fraction(structure, "framerate",
-                                      &fps_n, &fps_d);
-    g_return_val_if_fail(ret, FALSE);
-
-    priv->width = width;
-    priv->height = height;
-    priv->fps_n = fps_n;
-    priv->fps_d = fps_d;
+    if (priv->unlocked) {
+        g_mutex_unlock(priv->buffer_mutex);
+        return GST_FLOW_OK;
+    }
 
-    if (!gst_structure_get_fraction(structure, "pixel-aspect-ratio",
-                                    &priv->par_n, &priv->par_d))
-        priv->par_n = priv->par_d = 1;
+    priv->buffer = gst_buffer_ref(buffer);
 
-    gst_structure_get_int(structure, "red_mask", &red_mask);
-    priv->rgb_ordering = (red_mask == static_cast<int>(0xff000000));
+    // Use HIGH_IDLE+20 priority, like Gtk+ for redrawing operations.
+    priv->timeout_id = g_timeout_add_full(G_PRIORITY_HIGH_IDLE + 20, 0,
+                                          webkit_video_sink_timeout_func,
+                                          gst_object_ref(sink),
+                                          (GDestroyNotify)gst_object_unref);
 
-    return TRUE;
+    g_cond_wait(priv->data_cond, priv->buffer_mutex);
+    g_mutex_unlock(priv->buffer_mutex);
+    return GST_FLOW_OK;
 }
 
 static void
@@ -220,56 +174,58 @@ webkit_video_sink_dispose(GObject* object)
     WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(object);
     WebKitVideoSinkPrivate* priv = sink->priv;
 
-    if (priv->surface) {
-        cairo_surface_destroy(priv->surface);
-        priv->surface = 0;
+    if (priv->data_cond) {
+        g_cond_free(priv->data_cond);
+        priv->data_cond = 0;
     }
 
-    if (priv->async_queue) {
-        g_async_queue_unref(priv->async_queue);
-        priv->async_queue = 0;
+    if (priv->buffer_mutex) {
+        g_mutex_free(priv->buffer_mutex);
+        priv->buffer_mutex = 0;
     }
 
     G_OBJECT_CLASS(parent_class)->dispose(object);
 }
 
 static void
-webkit_video_sink_finalize(GObject* object)
+unlock_buffer_mutex(WebKitVideoSinkPrivate* priv)
 {
-    G_OBJECT_CLASS(parent_class)->finalize(object);
+    g_mutex_lock(priv->buffer_mutex);
+
+    if (priv->buffer) {
+        gst_buffer_unref(priv->buffer);
+        priv->buffer = 0;
+    }
+
+    priv->unlocked = TRUE;
+
+    g_cond_signal(priv->data_cond);
+    g_mutex_unlock(priv->buffer_mutex);
 }
 
-static void
-webkit_video_sink_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
+static gboolean
+webkit_video_sink_unlock(GstBaseSink* object)
 {
     WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(object);
-    WebKitVideoSinkPrivate* priv = sink->priv;
 
-    switch (prop_id) {
-    case PROP_SURFACE:
-        if (priv->surface)
-            cairo_surface_destroy(priv->surface);
-        priv->surface = cairo_surface_reference((cairo_surface_t*)g_value_get_pointer(value));
-        break;
-    default:
-        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
-        break;
-    }
+    unlock_buffer_mutex(sink->priv);
+
+    return GST_CALL_PARENT_WITH_DEFAULT(GST_BASE_SINK_CLASS, unlock,
+                                        (object), TRUE);
 }
 
-static void
-webkit_video_sink_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
+static gboolean
+webkit_video_sink_unlock_stop(GstBaseSink* object)
 {
     WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(object);
+    WebKitVideoSinkPrivate* priv = sink->priv;
 
-    switch (prop_id) {
-    case PROP_SURFACE:
-        g_value_set_pointer(value, sink->priv->surface);
-        break;
-    default:
-        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
-        break;
-    }
+    g_mutex_lock(priv->buffer_mutex);
+    priv->unlocked = FALSE;
+    g_mutex_unlock(priv->buffer_mutex);
+
+    return GST_CALL_PARENT_WITH_DEFAULT(GST_BASE_SINK_CLASS, unlock_stop,
+                                        (object), TRUE);
 }
 
 static gboolean
@@ -277,20 +233,46 @@ webkit_video_sink_stop(GstBaseSink* base_sink)
 {
     WebKitVideoSinkPrivate* priv = WEBKIT_VIDEO_SINK(base_sink)->priv;
 
-    g_async_queue_lock(priv->async_queue);
-
-    /* Remove all remaining objects from the queue */
-    while (GstBuffer* buffer = (GstBuffer*)g_async_queue_try_pop_unlocked(priv->async_queue))
-        gst_buffer_unref(buffer);
-
-    g_async_queue_unlock(priv->async_queue);
+    unlock_buffer_mutex(priv);
+    return TRUE;
+}
 
-    g_idle_remove_by_data(base_sink);
+static gboolean
+webkit_video_sink_start(GstBaseSink* base_sink)
+{
+    WebKitVideoSinkPrivate* priv = WEBKIT_VIDEO_SINK(base_sink)->priv;
 
+    g_mutex_lock(priv->buffer_mutex);
+    priv->unlocked = FALSE;
+    g_mutex_unlock(priv->buffer_mutex);
     return TRUE;
 }
 
 static void
+marshal_VOID__MINIOBJECT(GClosure * closure, GValue * return_value,
+                         guint n_param_values, const GValue * param_values,
+                         gpointer invocation_hint, gpointer marshal_data)
+{
+  typedef void (*marshalfunc_VOID__MINIOBJECT) (gpointer obj, gpointer arg1, gpointer data2);
+  marshalfunc_VOID__MINIOBJECT callback;
+  GCClosure *cc = (GCClosure *) closure;
+  gpointer data1, data2;
+
+  g_return_if_fail(n_param_values == 2);
+
+  if (G_CCLOSURE_SWAP_DATA(closure)) {
+      data1 = closure->data;
+      data2 = g_value_peek_pointer(param_values + 0);
+  } else {
+      data1 = g_value_peek_pointer(param_values + 0);
+      data2 = closure->data;
+  }
+  callback = (marshalfunc_VOID__MINIOBJECT) (marshal_data ? marshal_data : cc->callback);
+
+  callback(data1, gst_value_get_mini_object(param_values + 1), data2);
+}
+
+static void
 webkit_video_sink_class_init(WebKitVideoSinkClass* klass)
 {
     GObjectClass* gobject_class = G_OBJECT_CLASS(klass);
@@ -298,16 +280,14 @@ webkit_video_sink_class_init(WebKitVideoSinkClass* klass)
 
     g_type_class_add_private(klass, sizeof(WebKitVideoSinkPrivate));
 
-    gobject_class->set_property = webkit_video_sink_set_property;
-    gobject_class->get_property = webkit_video_sink_get_property;
-
     gobject_class->dispose = webkit_video_sink_dispose;
-    gobject_class->finalize = webkit_video_sink_finalize;
 
+    gstbase_sink_class->unlock = webkit_video_sink_unlock;
+    gstbase_sink_class->unlock_stop = webkit_video_sink_unlock_stop;
     gstbase_sink_class->render = webkit_video_sink_render;
     gstbase_sink_class->preroll = webkit_video_sink_render;
     gstbase_sink_class->stop = webkit_video_sink_stop;
-    gstbase_sink_class->set_caps = webkit_video_sink_set_caps;
+    gstbase_sink_class->start = webkit_video_sink_start;
 
     webkit_video_sink_signals[REPAINT_REQUESTED] = g_signal_new("repaint-requested",
             G_TYPE_FROM_CLASS(klass),
@@ -315,37 +295,20 @@ webkit_video_sink_class_init(WebKitVideoSinkClass* klass)
             0,
             0,
             0,
-            g_cclosure_marshal_VOID__VOID,
-            G_TYPE_NONE, 0);
-
-    g_object_class_install_property(
-        gobject_class, PROP_SURFACE,
-        g_param_spec_pointer("surface", "surface", "Target cairo_surface_t*",
-                             (GParamFlags)(G_PARAM_READWRITE)));
+            marshal_VOID__MINIOBJECT,
+            G_TYPE_NONE, 1, GST_TYPE_BUFFER);
 }
 
 /**
  * webkit_video_sink_new:
- * @surface: a #cairo_surface_t
  *
- * Creates a new GStreamer video sink which uses @surface as the target
- * for sinking a video stream from GStreamer.
+ * Creates a new GStreamer video sink.
  *
  * Return value: a #GstElement for the newly created video sink
  */
 GstElement*
-webkit_video_sink_new(cairo_surface_t* surface)
+webkit_video_sink_new(void)
 {
-    return (GstElement*)g_object_new(WEBKIT_TYPE_VIDEO_SINK, "surface", surface, 0);
+    return (GstElement*)g_object_new(WEBKIT_TYPE_VIDEO_SINK, 0);
 }
 
-void
-webkit_video_sink_set_surface(WebKitVideoSink* sink, cairo_surface_t* surface)
-{
-    WebKitVideoSinkPrivate* priv;
-
-    sink->priv = priv = G_TYPE_INSTANCE_GET_PRIVATE(sink, WEBKIT_TYPE_VIDEO_SINK, WebKitVideoSinkPrivate);
-    if (priv->surface)
-        cairo_surface_destroy(priv->surface);
-    priv->surface = cairo_surface_reference(surface);
-}
diff --git a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.h b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.h
index be2c94c..7ea7d91 100644
--- a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.h
+++ b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.h
@@ -22,7 +22,7 @@
 
 #include <cairo.h>
 #include <glib-object.h>
-#include <gst/base/gstbasesink.h>
+#include <gst/video/gstvideosink.h>
 
 G_BEGIN_DECLS
 
@@ -54,13 +54,13 @@ typedef struct _WebKitVideoSinkPrivate WebKitVideoSinkPrivate;
 
 struct _WebKitVideoSink {
     /*< private >*/
-    GstBaseSink parent;
+    GstVideoSink parent;
     WebKitVideoSinkPrivate *priv;
 };
 
 struct _WebKitVideoSinkClass {
     /*< private >*/
-    GstBaseSinkClass parent_class;
+    GstVideoSinkClass parent_class;
 
     /* Future padding */
     void (* _webkit_reserved1)(void);
@@ -72,9 +72,7 @@ struct _WebKitVideoSinkClass {
 };
 
 GType       webkit_video_sink_get_type(void) G_GNUC_CONST;
-GstElement *webkit_video_sink_new(cairo_surface_t *surface);
-
-void webkit_video_sink_set_surface(WebKitVideoSink *sink, cairo_surface_t *surface);
+GstElement *webkit_video_sink_new(void);
 
 G_END_DECLS
 
diff --git a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
index d785ef4..c23b8a9 100644
--- a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
@@ -369,6 +369,11 @@ void GraphicsContext::clip(const Path& path)
     m_data->m_view->ConstrainClippingRegion(path.platformPath());
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
diff --git a/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp b/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
index 34941c0..adb7573 100644
--- a/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
@@ -39,6 +39,8 @@
 #include <unicode/unorm.h>
 
 
+extern int charUnicodeToUTF8HACK(unsigned short, char*);
+
 namespace WebCore {
 
 void SimpleFontData::platformInit()
@@ -93,15 +95,15 @@ void SimpleFontData::determinePitch()
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
-    const char charArray[1] = { glyph };
-    float escapements[1];
+    if (!m_platformData.font())
+        return 0;
 
-    if (m_platformData.font()) {
-        m_platformData.font()->GetEscapements(charArray, 1, escapements);
-        return escapements[0] * m_platformData.font()->Size();
-    }
+    char charArray[4];
+    float escapements[1];
 
-    return 0;
+    charUnicodeToUTF8HACK(glyph, charArray);
+    m_platformData.font()->GetEscapements(charArray, 1, escapements);
+    return escapements[0] * m_platformData.font()->Size();
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/mac/Canvas3DLayer.h b/WebCore/platform/graphics/mac/Canvas3DLayer.h
index 6c65676..122ef39 100644
--- a/WebCore/platform/graphics/mac/Canvas3DLayer.h
+++ b/WebCore/platform/graphics/mac/Canvas3DLayer.h
@@ -41,7 +41,9 @@ namespace WebCore {
     GLuint m_texture;
 }
 
--(id)initWithContext:(CGLContextObj)context texture:(GLuint)texture;
+- (id)initWithContext:(CGLContextObj)context texture:(GLuint)texture;
+
+- (CGImageRef)copyImageSnapshotWithColorSpace:(CGColorSpaceRef)colorSpace;
 
 @end
 
diff --git a/WebCore/platform/graphics/mac/Canvas3DLayer.mm b/WebCore/platform/graphics/mac/Canvas3DLayer.mm
index 545c58b..94819d4 100644
--- a/WebCore/platform/graphics/mac/Canvas3DLayer.mm
+++ b/WebCore/platform/graphics/mac/Canvas3DLayer.mm
@@ -33,6 +33,8 @@
 #import "GraphicsLayer.h"
 #import <QuartzCore/QuartzCore.h>
 #import <OpenGL/OpenGL.h>
+#import <wtf/RetainPtr.h>
+#include <wtf/FastMalloc.h>
 
 using namespace WebCore;
 
@@ -48,19 +50,14 @@ using namespace WebCore;
 
 -(CGLPixelFormatObj)copyCGLPixelFormatForDisplayMask:(uint32_t)mask
 {
-    CGLPixelFormatAttribute attribs[] =
-    {
-        (CGLPixelFormatAttribute) kCGLPFAAccelerated,
-        (CGLPixelFormatAttribute) kCGLPFAColorSize, (CGLPixelFormatAttribute) 32,
-        (CGLPixelFormatAttribute) kCGLPFADisplayMask, (CGLPixelFormatAttribute) mask,
-        (CGLPixelFormatAttribute) 0
-    };
-    
-    CGLPixelFormatObj pixelFormatObj;
-    GLint numPixelFormats;
- 
-    CGLChoosePixelFormat(attribs, &pixelFormatObj, &numPixelFormats);
-    return pixelFormatObj;
+    // FIXME: The mask param tells you which display (on a multi-display system)
+    // is to be used. But since we are now getting the pixel format from the 
+    // Canvas CGL context, we don't use it. This seems to do the right thing on
+    // one multi-display system. But there may be cases where this is not the case.
+    // If needed we will have to set the display mask in the Canvas CGLContext and
+    // make sure it matches.
+    UNUSED_PARAM(mask);
+    return CGLRetainPixelFormat(CGLGetPixelFormat(m_contextObj));
 }
 
 -(CGLContextObj)copyCGLContextForPixelFormat:(CGLPixelFormatObj)pixelFormat
@@ -72,6 +69,10 @@ using namespace WebCore;
 
 -(void)drawInCGLContext:(CGLContextObj)glContext pixelFormat:(CGLPixelFormatObj)pixelFormat forLayerTime:(CFTimeInterval)timeInterval displayTime:(const CVTimeStamp *)timeStamp
 {
+    CGLSetCurrentContext(m_contextObj);
+    glFinish();
+    CGLSetCurrentContext(glContext);
+
     CGRect frame = [self frame];
         
     // draw the FBO into the layer
@@ -103,6 +104,42 @@ using namespace WebCore;
     [super drawInCGLContext:glContext pixelFormat:pixelFormat forLayerTime:timeInterval displayTime:timeStamp];
 }
 
+static void freeData(void *, const void *data, size_t /* size */)
+{
+    fastFree(const_cast<void *>(data));
+}
+
+-(CGImageRef)copyImageSnapshotWithColorSpace:(CGColorSpaceRef)colorSpace
+{
+    CGLSetCurrentContext(m_contextObj);
+
+    RetainPtr<CGColorSpaceRef> imageColorSpace = colorSpace;
+    if (!imageColorSpace)
+        imageColorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
+
+    CGRect layerBounds = CGRectIntegral([self bounds]);
+    
+    size_t width = layerBounds.size.width;
+    size_t height = layerBounds.size.height;
+
+    size_t rowBytes = (width * 4 + 15) & ~15;
+    size_t dataSize = rowBytes * height;
+    void* data = fastMalloc(dataSize);
+    if (!data)
+        return 0;
+
+    glPixelStorei(GL_PACK_ROW_LENGTH, rowBytes / 4);
+    glReadPixels(0, 0, width, height, GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV, data);
+
+    CGDataProviderRef provider = CGDataProviderCreateWithData(0, data, dataSize, freeData);
+    CGImageRef image = CGImageCreate(width, height, 8, 32, rowBytes, imageColorSpace.get(),
+                                                 kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host,
+                                                 provider, 0, true,
+                                                 kCGRenderingIntentDefault);
+    CGDataProviderRelease(provider);
+    return image;
+}
+
 @end
 
 @implementation Canvas3DLayer(WebLayerAdditions)
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
index cd66445..47617d8 100644
--- a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
@@ -30,9 +30,10 @@
 #include "GraphicsContext3D.h"
 
 #include "CachedImage.h"
+#include "CanvasActiveInfo.h"
+#include "CanvasArray.h"
 #include "CanvasBuffer.h"
 #include "CanvasFramebuffer.h"
-#include "CanvasArray.h"
 #include "CanvasFloatArray.h"
 #include "CanvasIntArray.h"
 #include "CanvasObject.h"
@@ -49,29 +50,91 @@
 #include "WebKitCSSMatrix.h"
 
 #include <CoreGraphics/CGBitmapContext.h>
+#include <OpenGL/CGLRenderers.h>
 
 namespace WebCore {
 
-GraphicsContext3D::GraphicsContext3D()
+static void setPixelFormat(Vector<CGLPixelFormatAttribute>& attribs, int colorBits, int depthBits, bool accelerated, bool supersample, bool closest)
 {
-    CGLPixelFormatAttribute attribs[] =
-    {
-        (CGLPixelFormatAttribute) kCGLPFAAccelerated,
-        (CGLPixelFormatAttribute) kCGLPFAColorSize, (CGLPixelFormatAttribute) 32,
-        (CGLPixelFormatAttribute) kCGLPFADepthSize, (CGLPixelFormatAttribute) 32,
-        (CGLPixelFormatAttribute) kCGLPFASupersample,
-        (CGLPixelFormatAttribute) 0
-    };
+    attribs.clear();
     
-    CGLPixelFormatObj pixelFormatObj;
-    GLint numPixelFormats;
+    attribs.append(kCGLPFAColorSize);
+    attribs.append(static_cast<CGLPixelFormatAttribute>(colorBits));
+    attribs.append(kCGLPFADepthSize);
+    attribs.append(static_cast<CGLPixelFormatAttribute>(depthBits));
     
-    CGLChoosePixelFormat(attribs, &pixelFormatObj, &numPixelFormats);
-    
-    CGLCreateContext(pixelFormatObj, 0, &m_contextObj);
+    if (accelerated)
+        attribs.append(kCGLPFAAccelerated);
+    else {
+        attribs.append(kCGLPFARendererID);
+        attribs.append(static_cast<CGLPixelFormatAttribute>(kCGLRendererGenericFloatID));
+    }
+        
+    if (supersample)
+        attribs.append(kCGLPFASupersample);
+        
+    if (closest)
+        attribs.append(kCGLPFAClosestPolicy);
+        
+    attribs.append(static_cast<CGLPixelFormatAttribute>(0));
+}
+
+PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create()
+{
+    OwnPtr<GraphicsContext3D> context(new GraphicsContext3D());
+    return context->m_contextObj ? context.release() : 0;
+}
+
+GraphicsContext3D::GraphicsContext3D()
+    : m_contextObj(0)
+    , m_texture(0)
+    , m_fbo(0)
+    , m_depthBuffer(0)
+{
+    Vector<CGLPixelFormatAttribute> attribs;
+    CGLPixelFormatObj pixelFormatObj = 0;
+    GLint numPixelFormats = 0;
+    
+    // We will try:
+    //
+    //  1) 32 bit RGBA/32 bit depth/accelerated/supersampled
+    //  2) 32 bit RGBA/32 bit depth/accelerated
+    //  3) 32 bit RGBA/16 bit depth/accelerated
+    //  4) closest to 32 bit RGBA/16 bit depth/software renderer
+    //
+    //  If none of that works, we simply fail and set m_contextObj to 0.
+    
+    setPixelFormat(attribs, 32, 32, true, true, false);
+    CGLChoosePixelFormat(attribs.data(), &pixelFormatObj, &numPixelFormats);
+    if (numPixelFormats == 0) {
+        setPixelFormat(attribs, 32, 32, true, false, false);
+        CGLChoosePixelFormat(attribs.data(), &pixelFormatObj, &numPixelFormats);
+        
+        if (numPixelFormats == 0) {
+            setPixelFormat(attribs, 32, 16, true, false, false);
+            CGLChoosePixelFormat(attribs.data(), &pixelFormatObj, &numPixelFormats);
+        
+            if (numPixelFormats == 0) {
+                setPixelFormat(attribs, 32, 16, false, false, true);
+                CGLChoosePixelFormat(attribs.data(), &pixelFormatObj, &numPixelFormats);
+        
+                if (numPixelFormats == 0) {
+                    // Could not find an acceptable renderer - fail
+                    return;
+                }
+            }
+        }
+    }
     
+    CGLError err = CGLCreateContext(pixelFormatObj, 0, &m_contextObj);
     CGLDestroyPixelFormat(pixelFormatObj);
     
+    if (err != kCGLNoError || !m_contextObj) {
+        // Could not create the context - fail
+        m_contextObj = 0;
+        return;
+    }
+
     // Set the current context to the one given to us.
     CGLSetCurrentContext(m_contextObj);
     
@@ -102,12 +165,14 @@ GraphicsContext3D::GraphicsContext3D()
 
 GraphicsContext3D::~GraphicsContext3D()
 {
-    CGLSetCurrentContext(m_contextObj);
-    ::glDeleteRenderbuffersEXT(1, & m_depthBuffer);
-    ::glDeleteTextures(1, &m_texture);
-    ::glDeleteFramebuffersEXT(1, &m_fbo);
-    CGLSetCurrentContext(0);
-    CGLDestroyContext(m_contextObj);
+    if (m_contextObj) {
+        CGLSetCurrentContext(m_contextObj);
+        ::glDeleteRenderbuffersEXT(1, & m_depthBuffer);
+        ::glDeleteTextures(1, &m_texture);
+        ::glDeleteFramebuffersEXT(1, &m_fbo);
+        CGLSetCurrentContext(0);
+        CGLDestroyContext(m_contextObj);
+    }
 }
 
 void GraphicsContext3D::checkError() const
@@ -135,7 +200,7 @@ void GraphicsContext3D::endPaint()
 
 void GraphicsContext3D::reshape(int width, int height)
 {
-    if (width == m_currentWidth && height == m_currentHeight)
+    if (width == m_currentWidth && height == m_currentHeight || !m_contextObj)
         return;
     
     m_currentWidth = width;
@@ -167,6 +232,9 @@ void GraphicsContext3D::reshape(int width, int height)
 
 static inline void ensureContext(CGLContextObj context)
 {
+    if (!context)
+        return;
+        
     CGLContextObj currentContext = CGLGetCurrentContext();
     if (currentContext != context)
         CGLSetCurrentContext(context);
@@ -442,6 +510,46 @@ void GraphicsContext3D::generateMipmap(unsigned long target)
     ::glGenerateMipmapEXT(target);
 }
 
+bool GraphicsContext3D::getActiveAttrib(CanvasProgram* program, unsigned long index, ActiveInfo& info)
+{
+    if (!program->object())
+        return false;
+    ensureContext(m_contextObj);
+    GLint maxAttributeSize = 0;
+    ::glGetProgramiv(static_cast<GLuint>(program->object()), GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxAttributeSize);
+    GLchar name[maxAttributeSize]; // GL_ACTIVE_ATTRIBUTE_MAX_LENGTH includes null termination
+    GLsizei nameLength = 0;
+    GLint size = 0;
+    GLenum type = 0;
+    ::glGetActiveAttrib(static_cast<GLuint>(program->object()), index, maxAttributeSize, &nameLength, &size, &type, name);
+    if (!nameLength)
+        return false;
+    info.name = String(name, nameLength);
+    info.type = type;
+    info.size = size;
+    return true;
+}
+    
+bool GraphicsContext3D::getActiveUniform(CanvasProgram* program, unsigned long index, ActiveInfo& info)
+{
+    if (!program->object())
+        return false;
+    ensureContext(m_contextObj);
+    GLint maxUniformSize = 0;
+    ::glGetProgramiv(static_cast<GLuint>(program->object()), GL_ACTIVE_UNIFORM_MAX_LENGTH, &maxUniformSize);
+    GLchar name[maxUniformSize]; // GL_ACTIVE_UNIFORM_MAX_LENGTH includes null termination
+    GLsizei nameLength = 0;
+    GLint size = 0;
+    GLenum type = 0;
+    ::glGetActiveUniform(static_cast<GLuint>(program->object()), index, maxUniformSize, &nameLength, &size, &type, name);
+    if (!nameLength)
+        return false;
+    info.name = String(name, nameLength);
+    info.type = type;
+    info.size = size;
+    return true;
+}
+
 int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& name)
 {
     if (!program)
@@ -556,6 +664,22 @@ void GraphicsContext3D::polygonOffset(double factor, double units)
     ::glPolygonOffset(static_cast<float>(factor), static_cast<float>(units));
 }
 
+PassRefPtr<CanvasArray> GraphicsContext3D::readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type)
+{
+    ensureContext(m_contextObj);
+    
+    // FIXME: For now we only accept GL_UNSIGNED_BYTE/GL_RGBA. In reality OpenGL ES 2.0 accepts that pair and one other
+    // as specified by GL_IMPLEMENTATION_COLOR_READ_FORMAT and GL_IMPLEMENTATION_COLOR_READ_TYPE. But for now we will
+    // not accept those.
+    // FIXME: Also, we should throw when an unacceptable value is passed
+    if (type != GL_UNSIGNED_BYTE || format != GL_RGBA)
+        return 0;
+        
+    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(width * height * 4);
+    ::glReadPixels(x, y, width, height, format, type, (GLvoid*) array->data());
+    return array;    
+}
+
 void GraphicsContext3D::releaseShaderCompiler()
 {
     // FIXME: This is not implemented on desktop OpenGL. We need to have ifdefs for the different GL variants
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index d0e1108..8cf51b4 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -110,10 +110,8 @@ public:
     
     virtual PlatformLayer* platformLayer() const;
 
-#ifndef NDEBUG
     virtual void setDebugBackgroundColor(const Color&);
     virtual void setDebugBorder(const Color&, float borderWidth);
-#endif
 
     virtual void setGeometryOrientation(CompositingCoordinatesOrientation);
 
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index e9960f1..b351956 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -274,7 +274,6 @@ static CAMediaTimingFunction* getCAMediaTimingFunction(const TimingFunction& tim
     return 0;
 }
 
-#ifndef NDEBUG
 static void setLayerBorderColor(PlatformLayer* layer, const Color& color)
 {
     CGColorRef borderColor = createCGColor(color);
@@ -286,7 +285,6 @@ static void clearBorderColor(PlatformLayer* layer)
 {
     [layer setBorderColor:nil];
 }
-#endif
 
 static void setLayerBackgroundColor(PlatformLayer* layer, const Color& color)
 {
@@ -317,7 +315,6 @@ GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayer::compositingCoord
     return CompositingCoordinatesBottomUp;
 }
 
-#ifndef NDEBUG
 bool GraphicsLayer::showDebugBorders()
 {
     static bool showDebugBorders = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebCoreLayerBorders"];
@@ -329,7 +326,6 @@ bool GraphicsLayer::showRepaintCounter()
     static bool showRepaintCounter = [[NSUserDefaults standardUserDefaults] boolForKey:@"WebCoreLayerRepaintCounter"];
     return showRepaintCounter;
 }
-#endif
 
 static NSDictionary* nullActionsDictionary()
 {
@@ -373,9 +369,7 @@ GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
     setContentsOrientation(defaultContentsOrientation());
 #endif
 
-#ifndef NDEBUG
     updateDebugIndicators();
-#endif
 
     m_animationDelegate.adoptNS([[WebAnimationDelegate alloc] init]);
     [m_animationDelegate.get() setLayer:this];
@@ -964,9 +958,7 @@ void GraphicsLayerCA::updateChildrenTransform()
 void GraphicsLayerCA::updateMasksToBounds()
 {
     [m_layer.get() setMasksToBounds:m_masksToBounds];
-#ifndef NDEBUG
     updateDebugIndicators();
-#endif
 }
 
 void GraphicsLayerCA::updateContentsOpaque()
@@ -1051,9 +1043,7 @@ void GraphicsLayerCA::updateLayerDrawsContent()
     else
         [m_layer.get() setContents:nil];
 
-#ifndef NDEBUG
     updateDebugIndicators();
-#endif
 }
 
 void GraphicsLayerCA::updateLayerBackgroundColor()
@@ -1245,6 +1235,21 @@ void GraphicsLayerCA::setAnimationOnLayer(CAPropertyAnimation* caAnim, AnimatedP
     [layer addAnimation:caAnim forKey:animationName];
 }
 
+// Workaround for <rdar://problem/7311367>
+static void bug7311367Workaround(CALayer* transformLayer, const TransformationMatrix& transform)
+{
+    if (!transformLayer)
+        return;
+
+    CATransform3D caTransform;
+    copyTransform(caTransform, transform);
+    caTransform.m41 += 1;
+    [transformLayer setTransform:caTransform];
+
+    caTransform.m41 -= 1;
+    [transformLayer setTransform:caTransform];
+}
+
 bool GraphicsLayerCA::removeAnimationFromLayer(AnimatedPropertyID property, int index)
 {
     PlatformLayer* layer = animatedLayer(property);
@@ -1255,10 +1260,11 @@ bool GraphicsLayerCA::removeAnimationFromLayer(AnimatedPropertyID property, int
         return false;
     
     [layer removeAnimationForKey:animationName];
+    
+    bug7311367Workaround(m_transformLayer.get(), m_transform);
     return true;
 }
 
-
 static void copyAnimationProperties(CAPropertyAnimation* from, CAPropertyAnimation* to)
 {
     [to setBeginTime:[from beginTime]];
@@ -1679,7 +1685,6 @@ PlatformLayer* GraphicsLayerCA::platformLayer() const
     return primaryLayer();
 }
 
-#ifndef NDEBUG
 void GraphicsLayerCA::setDebugBackgroundColor(const Color& color)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS
@@ -1706,7 +1711,6 @@ void GraphicsLayerCA::setDebugBorder(const Color& color, float borderWidth)
     
     END_BLOCK_OBJC_EXCEPTIONS
 }
-#endif // NDEBUG
 
 bool GraphicsLayerCA::requiresTiledLayer(const FloatSize& size) const
 {
@@ -1784,9 +1788,7 @@ void GraphicsLayerCA::swapFromOrToTiledLayer(bool useTiledLayer)
     // need to tell new layer to draw itself
     setNeedsDisplay();
     
-#ifndef NDEBUG
     updateDebugIndicators();
-#endif
 }
 
 GraphicsLayer::CompositingCoordinatesOrientation GraphicsLayerCA::defaultContentsOrientation() const
@@ -1830,12 +1832,10 @@ void GraphicsLayerCA::setupContentsLayer(CALayer* contentsLayer)
     } else
         [contentsLayer setAnchorPoint:CGPointZero];
 
-#ifndef NDEBUG
     if (showDebugBorders()) {
         setLayerBorderColor(contentsLayer, Color(0, 0, 128, 180));
         [contentsLayer setBorderWidth:1.0f];
     }
-#endif
 }
 
 void GraphicsLayerCA::setOpacityInternal(float accumulatedOpacity)
diff --git a/WebCore/platform/graphics/mac/WebLayer.mm b/WebCore/platform/graphics/mac/WebLayer.mm
index 2647466..56b28e6 100644
--- a/WebCore/platform/graphics/mac/WebLayer.mm
+++ b/WebCore/platform/graphics/mac/WebLayer.mm
@@ -80,7 +80,6 @@ using namespace WebCore;
     }
 #endif
 
-#ifndef NDEBUG
     if (layerContents->showRepaintCounter()) {
         bool isTiledLayer = [layer isKindOfClass:[CATiledLayer class]];
 
@@ -107,7 +106,6 @@ using namespace WebCore;
         
         CGContextRestoreGState(context);        
     }
-#endif
 
     CGContextRestoreGState(context);
 }
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index fa7b070..57a481a 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -1053,6 +1053,11 @@ void GraphicsContext::clip(const Path& path)
     m_data->p()->setClipPath(*path.platformPath(), Qt::IntersectClip);
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 3a27fe3..f8403b7 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -43,22 +43,13 @@ ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
     if (data.size() < 4)
         return 0;
 
-    QByteArray bytes = QByteArray::fromRawData(data.data(), data.size());
-    QBuffer buffer(&bytes);
-    if (!buffer.open(QBuffer::ReadOnly))
-        return 0;
-
-    QByteArray imageFormat = QImageReader::imageFormat(&buffer);
-    if (imageFormat.isEmpty())
-        return 0; // Image format not supported
-
-    return new ImageDecoderQt(imageFormat);
+    return new ImageDecoderQt;
 }
 
-ImageDecoderQt::ImageDecoderQt(const QByteArray& imageFormat)
-    : m_buffer(0)
+ImageDecoderQt::ImageDecoderQt()
+    :  m_buffer(0)
     , m_reader(0)
-    , m_repetitionCount(-1)
+    , m_repetitionCount(cAnimationNone)
 {
 }
 
@@ -73,13 +64,13 @@ void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
     if (m_failed)
         return;
 
-    // Cache our own new data.
-    ImageDecoder::setData(data, allDataReceived);
-
     // No progressive loading possible
     if (!allDataReceived)
         return;
 
+    // Cache our own new data.
+    ImageDecoder::setData(data, allDataReceived);
+
     // We expect to be only called once with allDataReceived
     ASSERT(!m_buffer);
     ASSERT(!m_reader);
@@ -89,15 +80,12 @@ void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
     m_buffer = new QBuffer;
     m_buffer->setData(imageData);
     m_buffer->open(QBuffer::ReadOnly);
-    m_reader = new QImageReader(m_buffer);
-
-    if (!m_reader->canRead())
-        failRead();
+    m_reader = new QImageReader(m_buffer, m_format);
 }
 
 bool ImageDecoderQt::isSizeAvailable()
 {
-    if (!m_failed && !ImageDecoder::isSizeAvailable() && m_reader)
+    if (!ImageDecoder::isSizeAvailable() && m_reader)
         internalDecodeSize();
 
     return ImageDecoder::isSizeAvailable();
@@ -134,14 +122,16 @@ int ImageDecoderQt::repetitionCount() const
 
 String ImageDecoderQt::filenameExtension() const
 {
-    return m_format;
+    return String(m_format.constData(), m_format.length());
 };
 
 RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
 {
-    // this information might not have been set
+    // In case the ImageDecoderQt got recreated we don't know
+    // yet how many images we are going to have and need to
+    // find that out now.
     int count = m_frameBufferCache.size();
-    if (count == 0) {
+    if (!m_failed && count == 0) {
         internalDecodeSize();
         count = frameCount();
     }
@@ -171,7 +161,12 @@ void ImageDecoderQt::internalDecodeSize()
 {
     ASSERT(m_reader);
 
+    // If we have a QSize() something failed
     QSize size = m_reader->size();
+    if (size.isEmpty())
+        return failRead();
+
+    m_format = m_reader->format();
     setSize(size.width(), size.height());
 }
 
@@ -213,9 +208,15 @@ void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
     buffer->setDecodedImage(img);
 }
 
-// We will parse everything and we have no idea how
-// many images we have... We will have to find out the
-// hard way.
+// The QImageIOHandler is not able to tell us how many frames
+// we have and we need to parse every image. We do this by
+// increasing the m_frameBufferCache by one and try to parse
+// the image. We stop when QImage::read fails and then need
+// to resize the m_frameBufferCache to the final size and update
+// the m_failed. In case we failed to decode the first image
+// we want to keep m_failed set to true.
+
+// TODO: Do not increment the m_frameBufferCache.size() by one but more than one
 void ImageDecoderQt::forceLoadEverything()
 {
     int imageCount = 0;
@@ -225,9 +226,12 @@ void ImageDecoderQt::forceLoadEverything()
         internalHandleCurrentImage(imageCount - 1);
     } while(!m_failed);
 
-    // reset the failed state and resize the vector...
+    // If we failed decoding the first image we actually
+    // have no images and need to keep m_failed set to
+    // true otherwise we want to reset it and forget about
+    // the last attempt to decode a image.
     m_frameBufferCache.resize(imageCount - 1);
-    m_failed = false;
+    m_failed = imageCount == 1;
 }
 
 void ImageDecoderQt::failRead()
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.h b/WebCore/platform/graphics/qt/ImageDecoderQt.h
index 7b3b686..d11b938 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -40,7 +40,7 @@ namespace WebCore {
 class ImageDecoderQt : public ImageDecoder
 {
 public:
-    ImageDecoderQt(const QByteArray& imageFormat);
+    ImageDecoderQt();
     ~ImageDecoderQt();
 
     virtual void setData(SharedBuffer* data, bool allDataReceived);
@@ -65,7 +65,7 @@ private:
     void failRead();
 
 private:
-    String m_format;
+    QByteArray m_format;
     QBuffer* m_buffer;
     QImageReader* m_reader;
     mutable int m_repetitionCount;
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index c9f1349..889c41b 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -296,7 +296,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
         r.inset(SkIntToScalar(thickness), SkIntToScalar(thickness));
         path.addOval(r, SkPath::kCCW_Direction);
     }
-    platformContext()->canvas()->clipPath(path);
+    platformContext()->clipPathAntiAliased(path);
 }
 
 void GraphicsContext::addPath(const Path& path)
@@ -356,6 +356,18 @@ void GraphicsContext::clip(const Path& path)
     if (!isPathSkiaSafe(getCTM(), p))
         return;
 
+    platformContext()->clipPathAntiAliased(p);
+}
+
+void GraphicsContext::canvasClip(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    const SkPath& p = *path.platformPath();
+    if (!isPathSkiaSafe(getCTM(), p))
+        return;
+
     platformContext()->canvas()->clipPath(p);
 }
 
@@ -407,7 +419,7 @@ void GraphicsContext::clipPath(WindRule clipRule)
         return;
 
     path.setFillType(clipRule == RULE_EVENODD ? SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType);
-    platformContext()->canvas()->clipPath(path);
+    platformContext()->clipPathAntiAliased(path);
 }
 
 void GraphicsContext::clipToImageBuffer(const FloatRect& rect,
diff --git a/WebCore/platform/graphics/skia/PathSkia.cpp b/WebCore/platform/graphics/skia/PathSkia.cpp
index 5ac14b9..2cbb759 100644
--- a/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -123,26 +123,31 @@ void Path::addArc(const FloatPoint& p, float r, float sa, float ea, bool anticlo
     SkScalar cx = WebCoreFloatToSkScalar(p.x());
     SkScalar cy = WebCoreFloatToSkScalar(p.y());
     SkScalar radius = WebCoreFloatToSkScalar(r);
+    SkScalar s360 = SkIntToScalar(360);
 
     SkRect oval;
     oval.set(cx - radius, cy - radius, cx + radius, cy + radius);
 
     float sweep = ea - sa;
-    // check for a circle
-    if (sweep >= 2 * piFloat || sweep <= -2 * piFloat)
+    SkScalar startDegrees = WebCoreFloatToSkScalar(sa * 180 / piFloat);
+    SkScalar sweepDegrees = WebCoreFloatToSkScalar(sweep * 180 / piFloat);
+    // Check for a circle.
+    if (sweepDegrees >= s360 || sweepDegrees <= -s360) {
+        // Move to the start position (0 sweep means we add a single point).
+        m_path->arcTo(oval, startDegrees, 0, false);
+        // Draw the circle.
         m_path->addOval(oval);
-    else {
-        SkScalar startDegrees = WebCoreFloatToSkScalar(sa * 180 / piFloat);
-        SkScalar sweepDegrees = WebCoreFloatToSkScalar(sweep * 180 / piFloat);
-
+        // Force a moveTo the end position.
+        m_path->arcTo(oval, startDegrees + sweepDegrees, 0, true);
+    } else {
         // Counterclockwise arcs should be drawn with negative sweeps, while
         // clockwise arcs should be drawn with positive sweeps. Check to see
         // if the situation is reversed and correct it by adding or subtracting
         // a full circle
         if (anticlockwise && sweepDegrees > 0) {
-            sweepDegrees -= SkIntToScalar(360);
+            sweepDegrees -= s360;
         } else if (!anticlockwise && sweepDegrees < 0) {
-            sweepDegrees += SkIntToScalar(360);
+            sweepDegrees += s360;
         }
 
         m_path->arcTo(oval, startDegrees, sweepDegrees, false);
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 1fb62fc..a079da0 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -45,6 +45,7 @@
 #include "SkDashPathEffect.h"
 
 #include <wtf/MathExtras.h>
+#include <wtf/Vector.h>
 
 namespace WebCore 
 {
@@ -95,6 +96,10 @@ struct PlatformContextSkia::State {
     WebCore::FloatRect m_clip;
 #endif
 
+    // This is a list of clipping paths which are currently active, in the
+    // order in which they were pushed.
+    WTF::Vector<SkPath> m_antiAliasClipPaths;
+
 private:
     // Not supported.
     void operator=(const State&);
@@ -110,8 +115,8 @@ PlatformContextSkia::State::State()
     , m_fillShader(0)
     , m_strokeStyle(WebCore::SolidStroke)
     , m_strokeColor(WebCore::Color::black)
-    , m_strokeThickness(0)
     , m_strokeShader(0)
+    , m_strokeThickness(0)
     , m_dashRatio(3)
     , m_miterLimit(4)
     , m_lineCap(SkPaint::kDefault_Cap)
@@ -130,8 +135,8 @@ PlatformContextSkia::State::State(const State& other)
     , m_fillShader(other.m_fillShader)
     , m_strokeStyle(other.m_strokeStyle)
     , m_strokeColor(other.m_strokeColor)
-    , m_strokeThickness(other.m_strokeThickness)
     , m_strokeShader(other.m_strokeShader)
+    , m_strokeThickness(other.m_strokeThickness)
     , m_dashRatio(other.m_dashRatio)
     , m_miterLimit(other.m_miterLimit)
     , m_lineCap(other.m_lineCap)
@@ -249,6 +254,21 @@ void PlatformContextSkia::beginLayerClippedToImage(const WebCore::FloatRect& rec
 }
 #endif
 
+void PlatformContextSkia::clipPathAntiAliased(const SkPath& clipPath)
+{
+    // If we are currently tracking any anti-alias clip paths, then we already
+    // have a layer in place and don't need to add another.
+    bool haveLayerOutstanding = m_state->m_antiAliasClipPaths.size();
+
+    // See comments in applyAntiAliasedClipPaths about how this works.
+    m_state->m_antiAliasClipPaths.append(clipPath);
+
+    if (!haveLayerOutstanding) {
+        SkRect bounds = clipPath.getBounds();
+        canvas()->saveLayerAlpha(&bounds, 255, static_cast<SkCanvas::SaveFlags>(SkCanvas::kHasAlphaLayer_SaveFlag | SkCanvas::kFullColorLayer_SaveFlag | SkCanvas::kClipToLayer_SaveFlag));
+    }
+}
+
 void PlatformContextSkia::restore()
 {
 #if defined(__linux__) || PLATFORM(WIN_OS)
@@ -258,6 +278,9 @@ void PlatformContextSkia::restore()
     }
 #endif
 
+    if (!m_state->m_antiAliasClipPaths.isEmpty())
+        applyAntiAliasedClipPaths(m_state->m_antiAliasClipPaths);
+
     m_stateStack.removeLast();
     m_state = &m_stateStack.last();
 
@@ -549,3 +572,40 @@ void PlatformContextSkia::applyClipFromImage(const WebCore::FloatRect& rect, con
     m_canvas->drawBitmap(imageBuffer, SkFloatToScalar(rect.x()), SkFloatToScalar(rect.y()), &paint);
 }
 #endif
+
+void PlatformContextSkia::applyAntiAliasedClipPaths(WTF::Vector<SkPath>& paths)
+{
+    // Anti-aliased clipping:
+    //
+    // Skia's clipping is 1-bit only. Consider what would happen if it were 8-bit:
+    // We have a square canvas, filled with white and we declare a circular
+    // clipping path. Then we fill twice with a black rectangle. The fractional
+    // pixels would first get the correct color (white * alpha + black * (1 -
+    // alpha)), but the second fill would apply the alpha to the already
+    // modified color and the result would be too dark.
+    //
+    // This, anti-aliased clipping needs to be performed after the drawing has
+    // been done. In order to do this, we create a new layer of the canvas in
+    // clipPathAntiAliased and store the clipping path. All drawing is done to
+    // the layer's bitmap while it's in effect. When WebKit calls restore() to
+    // undo the clipping, this function is called.
+    //
+    // Here, we walk the list of clipping paths backwards and, for each, we
+    // clear outside of the clipping path. We only need a single extra layer
+    // for any number of clipping paths.
+    //
+    // When we call restore on the SkCanvas, the layer's bitmap is composed
+    // into the layer below and we end up with correct, anti-aliased clipping.
+
+    SkPaint paint;
+    paint.setXfermodeMode(SkXfermode::kClear_Mode);
+    paint.setAntiAlias(true);
+    paint.setStyle(SkPaint::kFill_Style);
+
+    for (size_t i = paths.size() - 1; i < paths.size(); --i) {
+        paths[i].setFillType(SkPath::kInverseWinding_FillType);
+        m_canvas->drawPath(paths[i], paint);
+    }
+
+    m_canvas->restore();
+}
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.h b/WebCore/platform/graphics/skia/PlatformContextSkia.h
index 0c87fc2..53590bf 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -92,6 +92,7 @@ public:
     void beginLayerClippedToImage(const WebCore::FloatRect&,
                                   const WebCore::ImageBuffer*);
 #endif
+    void clipPathAntiAliased(const SkPath&);
 
     // Sets up the common flags on a paint for antialiasing, effects, etc.
     // This is implicitly called by setupPaintFill and setupPaintStroke, but
@@ -172,6 +173,7 @@ private:
     // m_canvas that are also in imageBuffer.
     void applyClipFromImage(const WebCore::FloatRect&, const SkBitmap&);
 #endif
+    void applyAntiAliasedClipPaths(WTF::Vector<SkPath>& paths);
 
     // Defines drawing style.
     struct State;
diff --git a/WebCore/platform/graphics/skia/SkiaUtils.cpp b/WebCore/platform/graphics/skia/SkiaUtils.cpp
index bb15aa2..377ca06 100644
--- a/WebCore/platform/graphics/skia/SkiaUtils.cpp
+++ b/WebCore/platform/graphics/skia/SkiaUtils.cpp
@@ -200,8 +200,13 @@ bool SkPathContainsPoint(SkPath* originalPath, const FloatPoint& point, SkPath::
 
     SkRect bounds = originalPath->getBounds();
 
-    // We can immediately return false if the point is outside the bounding rect
-    if (!bounds.contains(SkFloatToScalar(point.x()), SkFloatToScalar(point.y())))
+    // We can immediately return false if the point is outside the bounding
+    // rect.  We don't use bounds.contains() here, since it would exclude
+    // points on the right and bottom edges of the bounding rect, and we want
+    // to include them.
+    SkScalar fX = SkFloatToScalar(point.x());
+    SkScalar fY = SkFloatToScalar(point.y());
+    if (fX < bounds.fLeft || fX > bounds.fRight || fY < bounds.fTop || fY > bounds.fBottom)
         return false;
 
     originalPath->setFillType(ft);
@@ -225,7 +230,7 @@ bool SkPathContainsPoint(SkPath* originalPath, const FloatPoint& point, SkPath::
 
     int x = static_cast<int>(floorf(point.x() / scale));
     int y = static_cast<int>(floorf(point.y() / scale));
-    clip.setRect(x, y, x + 1, y + 1);
+    clip.setRect(x - 1, y - 1, x + 1, y + 1);
 
     bool contains = rgn.setPath(*path, clip);
 
diff --git a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 26b22af..e845d85 100644
--- a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -34,11 +34,11 @@
 #include "Font.h"
 #include "FontCache.h"
 #include "FontDescription.h"
-#include "MathExtras.h"
 #include <cairo.h>
 #include <cairo-win32.h>
 #include <mlang.h>
 #include <tchar.h>
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 
diff --git a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
index c114c0e..f308840 100644
--- a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
+++ b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
@@ -1219,6 +1219,11 @@ void GraphicsContext::clip(const Path& path)
     notImplemented();
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipOut(const Path&)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 686fb07..39f14f4 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -344,6 +344,11 @@ void GraphicsContext::clip(const Path&)
     notImplemented();
 }
 
+void GraphicsContext::canvasClip(const Path& path)
+{
+    clip(path);
+}
+
 void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
 {
     notImplemented();
diff --git a/WebCore/platform/gtk/KeyEventGtk.cpp b/WebCore/platform/gtk/KeyEventGtk.cpp
index 4186c2f..3931eff 100644
--- a/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/WebCore/platform/gtk/KeyEventGtk.cpp
@@ -200,6 +200,7 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode)
         case GDK_Control_R:
             return VK_CONTROL; // (11) CTRL key
         case GDK_Menu:
+            return VK_APPS;  // (5D) Applications key (Natural keyboard)
         case GDK_Alt_L:
         case GDK_Alt_R:
             return VK_MENU; // (12) ALT key
@@ -370,7 +371,6 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode)
             return VK_LWIN; // (5B) Left Windows key (Microsoft Natural keyboard)
         case GDK_Meta_R:
             return VK_RWIN; // (5C) Right Windows key (Natural keyboard)
-            // VK_APPS (5D) Applications key (Natural keyboard)
             // VK_SLEEP (5F) Computer Sleep key
             // VK_SEPARATOR (6C) Separator key
             // VK_SUBTRACT (6D) Subtract key
diff --git a/WebCore/platform/gtk/Language.cpp b/WebCore/platform/gtk/Language.cpp
index 171cd84..fea2df6 100644
--- a/WebCore/platform/gtk/Language.cpp
+++ b/WebCore/platform/gtk/Language.cpp
@@ -21,16 +21,37 @@
 #include "Language.h"
 
 #include "CString.h"
+#include "GOwnPtr.h"
 #include "PlatformString.h"
 
 #include <gtk/gtk.h>
+#include <locale.h>
 #include <pango/pango.h>
 
 namespace WebCore {
 
+// Using pango_language_get_default() here is not an option, because
+// it doesn't support changing the locale in runtime, so it returns
+// always the same value.
 String defaultLanguage()
 {
-    return pango_language_to_string(gtk_get_default_language());
+    char* localeDefault = setlocale(LC_CTYPE, NULL);
+
+    if (!localeDefault)
+        return String("c");
+
+    GOwnPtr<gchar> normalizedDefault(g_ascii_strdown(localeDefault, -1));
+    char* ptr = strchr(normalizedDefault.get(), '_');
+
+    if(ptr)
+        *ptr = '-';
+
+    ptr = strchr(normalizedDefault.get(), '.');
+
+    if(ptr)
+        *ptr = '\0';
+
+    return String(normalizedDefault.get());
 }
 
 }
diff --git a/WebCore/platform/mac/ClipboardMac.mm b/WebCore/platform/mac/ClipboardMac.mm
index 78fb659..f4321ad 100644
--- a/WebCore/platform/mac/ClipboardMac.mm
+++ b/WebCore/platform/mac/ClipboardMac.mm
@@ -107,11 +107,15 @@ static String utiTypeFromCocoaType(NSString *type)
 static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([cocoaType isEqualToString:NSStringPboardType])
+    if ([cocoaType isEqualToString:NSStringPboardType]) {
         resultTypes.add("text/plain");
-    else if ([cocoaType isEqualToString:NSURLPboardType])
+        return;
+    }
+    if ([cocoaType isEqualToString:NSURLPboardType]) {
         resultTypes.add("text/uri-list");
-    else if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+        return;
+    }
+    if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
         // If file list is empty, add nothing.
         // Note that there is a chance that the file list count could have changed since we grabbed the types array.
         // However, this is not really an issue for us doing a sanity check here.
@@ -122,12 +126,15 @@ static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSSt
             resultTypes.add("text/uri-list");
             resultTypes.add("Files");
         }
-    } else if (String utiType = utiTypeFromCocoaType(cocoaType))
+        return;
+    }
+    String utiType = utiTypeFromCocoaType(cocoaType);
+    if (!utiType.isEmpty()) {
         resultTypes.add(utiType);
-    else {
-        // No mapping, just pass the whole string though
-        resultTypes.add(cocoaType);
+        return;
     }
+    // No mapping, just pass the whole string though
+    resultTypes.add(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
diff --git a/WebCore/platform/network/Credential.cpp b/WebCore/platform/network/Credential.cpp
index caca785..f905743 100644
--- a/WebCore/platform/network/Credential.cpp
+++ b/WebCore/platform/network/Credential.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 Credential::Credential()
     : m_user("")
     , m_password("")
+    , m_persistence(CredentialPersistenceNone)
 {
 }
    
@@ -44,7 +45,7 @@ Credential::Credential(const String& user, const String& password, CredentialPer
 {
 }
 
-bool Credential::isEmpty()
+bool Credential::isEmpty() const
 {
     return m_user.isEmpty() && m_password.isEmpty();
 }
diff --git a/WebCore/platform/network/Credential.h b/WebCore/platform/network/Credential.h
index ca4a45a..0471fbc 100644
--- a/WebCore/platform/network/Credential.h
+++ b/WebCore/platform/network/Credential.h
@@ -41,7 +41,7 @@ public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
     
-    bool isEmpty();
+    bool isEmpty() const;
     
     const String& user() const;
     const String& password() const;
diff --git a/WebCore/platform/network/CredentialStorage.cpp b/WebCore/platform/network/CredentialStorage.cpp
index 407ed5b..ec78372 100644
--- a/WebCore/platform/network/CredentialStorage.cpp
+++ b/WebCore/platform/network/CredentialStorage.cpp
@@ -43,13 +43,19 @@ static ProtectionSpaceToCredentialMap& protectionSpaceToCredentialMap()
     return map;
 }
 
-typedef HashMap<String, HashMap<String, Credential> > OriginToDefaultBasicCredentialMap;
-static OriginToDefaultBasicCredentialMap& originToDefaultBasicCredentialMap()
+static HashSet<String>& originsWithCredentials()
 {
-    DEFINE_STATIC_LOCAL(OriginToDefaultBasicCredentialMap, map, ());
+    DEFINE_STATIC_LOCAL(HashSet<String>, set, ());
+    return set;
+}
+
+typedef HashMap<String, ProtectionSpace> PathToDefaultProtectionSpaceMap;
+static PathToDefaultProtectionSpaceMap& pathToDefaultProtectionSpaceMap()
+{
+    DEFINE_STATIC_LOCAL(PathToDefaultProtectionSpaceMap, map, ());
     return map;
 }
-    
+
 static String originStringFromURL(const KURL& url)
 {
     if (url.port())
@@ -58,32 +64,37 @@ static String originStringFromURL(const KURL& url)
     return url.protocol() + "://" + url.host() + "/";
 }
 
+static String protectionSpaceMapKeyFromURL(const KURL& url)
+{
+    ASSERT(url.isValid());
+
+    // Remove the last path component that is not a directory to determine the subtree for which credentials will apply.
+    // We keep a leading slash, but remove a trailing one.
+    String directoryURL = url.string().substring(0, url.pathEnd());
+    unsigned directoryURLPathStart = url.pathStart();
+    ASSERT(directoryURL[directoryURLPathStart] == '/');
+    if (directoryURL.length() > directoryURLPathStart + 1) {
+        int index = directoryURL.reverseFind('/');
+        ASSERT(index > 0);
+        directoryURL = directoryURL.substring(0, (static_cast<unsigned>(index) != directoryURLPathStart) ? index : directoryURLPathStart + 1);
+    }
+    ASSERT(directoryURL.length() == directoryURLPathStart + 1 || directoryURL[directoryURL.length() - 1] != '/');
+
+    return directoryURL;
+}
+
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
     ASSERT(url.protocolInHTTPFamily());
     ASSERT(url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
-    
+    originsWithCredentials().add(originStringFromURL(url));
+
     ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
-    if (url.protocolInHTTPFamily() && (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault)) {
-        String origin = originStringFromURL(url);
-        
-        HashMap<String, Credential> pathToCredentialMap;
-        pair<HashMap<String, HashMap<String, Credential> >::iterator, bool> result = originToDefaultBasicCredentialMap().add(origin, pathToCredentialMap);
-        
-        // Remove the last path component that is not a directory to determine the subpath for which this credential applies.
-        // We keep a leading slash, but remove a trailing one.
-        String path = url.path();
-        ASSERT(path.length() > 0);
-        ASSERT(path[0] == '/');
-        if (path.length() > 1) {
-            int index = path.reverseFind('/');
-            path = path.substring(0, index ? index : 1);
-        }
-        ASSERT(path.length() == 1 || path[path.length() - 1] != '/');
-        
-        result.first->second.set(path, credential);
+    if (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault) {
+        // The map can contain both a path and its subpath - while redundant, this makes lookups faster.
+        pathToDefaultProtectionSpaceMap().set(protectionSpaceMapKeyFromURL(url), protectionSpace);
     }
 }
 
@@ -92,33 +103,53 @@ Credential CredentialStorage::get(const ProtectionSpace& protectionSpace)
     return protectionSpaceToCredentialMap().get(protectionSpace);
 }
 
-Credential CredentialStorage::getDefaultAuthenticationCredential(const KURL& url)
+static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForURL(const KURL& url)
 {
     ASSERT(url.protocolInHTTPFamily());
-    String origin = originStringFromURL(url);
-    const HashMap<String, Credential>& pathToCredentialMap(originToDefaultBasicCredentialMap().get(origin));
-    if (pathToCredentialMap.isEmpty())
-        return Credential();
-    
-    // Check to see if there is a stored credential for the subpath ancestry of this url.
-    String path = url.path();
-    Credential credential = pathToCredentialMap.get(path);
-    while (credential.isEmpty() && !path.isNull()) {
-        int index = path.reverseFind('/');
-        if (index == 0) {
-            credential = pathToCredentialMap.get("/");
-            break;
-        } else if (index == -1) {
-            // This case should never happen, as all HTTP URL paths should start with a leading /
-            ASSERT_NOT_REACHED();
-            credential = pathToCredentialMap.get(path);
-            break;
-        } else {
-            path = path.substring(0, index);
-            credential = pathToCredentialMap.get(path);
-        }
+    ASSERT(url.isValid());
+
+    PathToDefaultProtectionSpaceMap& map = pathToDefaultProtectionSpaceMap();
+
+    // Don't spend time iterating the path for origins that don't have any credentials.
+    if (!originsWithCredentials().contains(originStringFromURL(url)))
+        return map.end();
+
+    String directoryURL = protectionSpaceMapKeyFromURL(url);
+    unsigned directoryURLPathStart = url.pathStart();
+    while (true) {
+        PathToDefaultProtectionSpaceMap::iterator iter = map.find(directoryURL);
+        if (iter != map.end())
+            return iter;
+
+        if (directoryURL.length() == directoryURLPathStart + 1)  // path is "/" already, cannot shorten it any more
+            return map.end();
+
+        int index = directoryURL.reverseFind('/', -2);
+        ASSERT(index > 0);
+        directoryURL = directoryURL.substring(0, (static_cast<unsigned>(index) == directoryURLPathStart) ? index + 1 : index);
+        ASSERT(directoryURL.length() > directoryURLPathStart);
+        ASSERT(directoryURL.length() == directoryURLPathStart + 1 || directoryURL[directoryURL.length() - 1] != '/');
     }
-    return credential;
+}
+
+bool CredentialStorage::set(const Credential& credential, const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.isValid());
+    PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
+    if (iter == pathToDefaultProtectionSpaceMap().end())
+        return false;
+    ASSERT(originsWithCredentials().contains(originStringFromURL(url)));
+    protectionSpaceToCredentialMap().set(iter->second, credential);
+    return true;
+}
+
+Credential CredentialStorage::get(const KURL& url)
+{
+    PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
+    if (iter == pathToDefaultProtectionSpaceMap().end())
+        return Credential();
+    return protectionSpaceToCredentialMap().get(iter->second);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/CredentialStorage.h b/WebCore/platform/network/CredentialStorage.h
index 737efa6..5086f69 100644
--- a/WebCore/platform/network/CredentialStorage.h
+++ b/WebCore/platform/network/CredentialStorage.h
@@ -36,7 +36,11 @@ class CredentialStorage {
 public:
     static void set(const Credential&, const ProtectionSpace&, const KURL&);
     static Credential get(const ProtectionSpace&);
-    static Credential getDefaultAuthenticationCredential(const KURL&);
+
+    // These methods work for authentication schemes that support sending credentials without waiting for a request. E.g., for HTTP Basic authentication scheme
+    // a client should assume that all paths at or deeper than the depth of a known protected resource share are within the same protection space.
+    static bool set(const Credential&, const KURL&); // Returns true if the URL corresponds to a known protection space, so credentials could be updated.
+    static Credential get(const KURL&);
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/FormDataBuilder.cpp b/WebCore/platform/network/FormDataBuilder.cpp
index 27bdee3..04c7527 100644
--- a/WebCore/platform/network/FormDataBuilder.cpp
+++ b/WebCore/platform/network/FormDataBuilder.cpp
@@ -108,6 +108,34 @@ static inline void append(Vector<char>& buffer, const CString& string)
     buffer.append(string.data(), string.length());
 }
 
+static void appendQuotedString(Vector<char>& buffer, const CString& string)
+{
+    // Append a string as a quoted value, escaping quotes and line breaks.
+    // FIXME: Is it correct to use percent escaping here? Other browsers do not encode these characters yet,
+    // so we should test popular servers to find out if there is an encoding form they can handle.
+    unsigned length = string.length();
+    for (unsigned i = 0; i < length; ++i) {
+        unsigned char c = string.data()[i];
+
+        switch (c) {
+        case  0x0a:
+            append(buffer, "%0A");
+            break;
+        case 0x0d:
+            append(buffer, "%0D");
+            break;
+        case '"':
+            append(buffer, "%22");
+            break;
+        case '%':
+            append(buffer, "%25");
+            break;
+        default:
+            append(buffer, c);
+        }
+    }
+}
+
 Vector<char> FormDataBuilder::generateUniqueBoundaryString()
 {
     Vector<char> boundary;
@@ -161,8 +189,10 @@ void FormDataBuilder::beginMultiPartHeader(Vector<char>& buffer, const CString&
 {
     addBoundaryToMultiPartHeader(buffer, boundary);
 
+    // FIXME: This loses data irreversibly if the input name includes characters you can't encode
+    // in the website's character set.
     append(buffer, "Content-Disposition: form-data; name=\"");
-    append(buffer, name);
+    appendQuotedString(buffer, name);
     append(buffer, '"');
 }
 
@@ -179,12 +209,10 @@ void FormDataBuilder::addBoundaryToMultiPartHeader(Vector<char>& buffer, const C
 
 void FormDataBuilder::addFilenameToMultiPartHeader(Vector<char>& buffer, const TextEncoding& encoding, const String& filename)
 {
-    // FIXME: This won't work if the filename includes a " mark,
-    // or control characters like CR or LF. This also does strange
-    // things if the filename includes characters you can't encode
+    // FIXME: This loses data irreversibly if the filename includes characters you can't encode
     // in the website's character set.
     append(buffer, "; filename=\"");
-    append(buffer, encoding.encode(filename.characters(), filename.length(), QuestionMarksForUnencodables));
+    appendQuotedString(buffer, encoding.encode(filename.characters(), filename.length(), QuestionMarksForUnencodables));
     append(buffer, '"');
 }
 
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index ee11bcb..8ab72c1 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -218,6 +218,26 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
         m_platformRequestUpdated = false;
 }
 
+void ResourceRequestBase::clearHTTPReferrer()
+{
+    updateResourceRequest(); 
+
+    m_httpHeaderFields.remove("Referer");
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
+}
+
+void ResourceRequestBase::clearHTTPOrigin()
+{
+    updateResourceRequest(); 
+
+    m_httpHeaderFields.remove("Origin");
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
+}
+
 void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(const String& encoding1, const String& encoding2, const String& encoding3)
 {
     updateResourceRequest(); 
@@ -358,7 +378,11 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
+<<<<<<< HEAD:WebCore/platform/network/ResourceRequestBase.cpp
 #if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP) && !PLATFORM(ANDROID)
+=======
+#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP) && !PLATFORM(CHROMIUM)
+>>>>>>> webkit.org at r50258.:WebCore/platform/network/ResourceRequestBase.cpp
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 348e6b3..84a7bd0 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -88,11 +88,11 @@ namespace WebCore {
         
         String httpReferrer() const { return httpHeaderField("Referer"); }
         void setHTTPReferrer(const String& httpReferrer) { setHTTPHeaderField("Referer", httpReferrer); }
-        void clearHTTPReferrer() { m_httpHeaderFields.remove("Referer"); }
+        void clearHTTPReferrer();
         
         String httpOrigin() const { return httpHeaderField("Origin"); }
         void setHTTPOrigin(const String& httpOrigin) { setHTTPHeaderField("Origin", httpOrigin); }
-        void clearHTTPOrigin() { m_httpHeaderFields.remove("Origin"); }
+        void clearHTTPOrigin();
 
         String httpUserAgent() const { return httpHeaderField("User-Agent"); }
         void setHTTPUserAgent(const String& httpUserAgent) { setHTTPHeaderField("User-Agent", httpUserAgent); }
diff --git a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index ea5fcc6..38a9705 100644
--- a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -156,7 +156,11 @@ CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfReque
     }
     if (request.isNull())
         request = cfRequest;
-    
+
+    // Should not set Referer after a redirect from a secure resource to non-secure one.
+    if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https"))
+        request.clearHTTPReferrer();
+
     handle->willSendRequest(request, cfRedirectResponse);
 
     if (request.isNull())
@@ -401,8 +405,18 @@ bool ResourceHandle::start(Frame* frame)
 
     // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
     // try and reuse the credential preemptively, as allowed by RFC 2617.
-    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily())
-        d->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(d->m_request.url());
+    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily()) {
+        if (d->m_user.isEmpty() && d->m_pass.isEmpty()) {
+            // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+            // try and reuse the credential preemptively, as allowed by RFC 2617.
+            d->m_initialCredential = CredentialStorage::get(d->m_request.url());
+        } else {
+            // If there is already a protection space known for the URL, update stored credentials before sending a request.
+            // This makes it possible to implement logout by sending an XMLHttpRequest with known incorrect credentials, and aborting it immediately
+            // (so that an authentication dialog doesn't pop up).
+            CredentialStorage::set(Credential(d->m_user, d->m_pass, CredentialPersistenceNone), d->m_request.url());
+        }
+    }
         
     if (!d->m_initialCredential.isEmpty()) {
         String authHeader = "Basic " + encodeBasicAuthorization(d->m_initialCredential.user(), d->m_initialCredential.password());
@@ -769,7 +783,7 @@ RetainPtr<CFDataRef> WebCoreSynchronousLoader::load(const ResourceRequest& reque
         // try and reuse the credential preemptively, as allowed by RFC 2617.
         ResourceRequest requestWithInitialCredential(request);
         if (loader.m_allowStoredCredentials && url.protocolInHTTPFamily())
-            loader.m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(url);
+            loader.m_initialCredential = CredentialStorage::get(url);
 
         if (!loader.m_initialCredential.isEmpty()) {
             String authHeader = "Basic " + encodeBasicAuthorization(loader.m_initialCredential.user(), loader.m_initialCredential.password());
diff --git a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index bba3d3e..cc0220e 100644
--- a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -39,9 +39,11 @@ typedef CFArrayRef (*CFURLRequestCopyContentDispositionEncodingFallbackArrayFunc
 
 static HMODULE findCFNetworkModule()
 {
-    if (HMODULE module = GetModuleHandleA("CFNetwork"))
-        return module;
+#ifndef DEBUG_ALL
+    return GetModuleHandleA("CFNetwork");
+#else
     return GetModuleHandleA("CFNetwork_debug");
+#endif
 }
 
 static CFURLRequestSetContentDispositionEncodingFallbackArrayFunction findCFURLRequestSetContentDispositionEncodingFallbackArrayFunction()
@@ -76,11 +78,18 @@ CFURLRequestRef ResourceRequest::cfURLRequest() const
     return m_cfRequest.get();
 }
 
-static inline void addHeadersFromHashMap(CFMutableURLRequestRef request, const HTTPHeaderMap& requestHeaders) 
+static inline void setHeaderFields(CFMutableURLRequestRef request, const HTTPHeaderMap& requestHeaders) 
 {
-    if (!requestHeaders.size())
-        return;
-        
+    // Remove existing headers first, as some of them may no longer be present in the map.
+    RetainPtr<CFDictionaryRef> oldHeaderFields(AdoptCF, CFURLRequestCopyAllHTTPHeaderFields(request));
+    CFIndex oldHeaderFieldCount = CFDictionaryGetCount(oldHeaderFields.get());
+    if (oldHeaderFieldCount) {
+        Vector<CFStringRef> oldHeaderFieldNames(oldHeaderFieldCount);
+        CFDictionaryGetKeysAndValues(oldHeaderFields.get(), reinterpret_cast<const void**>(&oldHeaderFieldNames[0]), 0);
+        for (CFIndex i = 0; i < oldHeaderFieldCount; ++i)
+            CFURLRequestSetHTTPHeaderFieldValue(request, oldHeaderFieldNames[i], 0);
+    }
+
     HTTPHeaderMap::const_iterator end = requestHeaders.end();
     for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(); it != end; ++it) {
         CFStringRef key = it->first.createCFString();
@@ -110,7 +119,7 @@ void ResourceRequest::doUpdatePlatformRequest()
     RetainPtr<CFStringRef> requestMethod(AdoptCF, httpMethod().createCFString());
     CFURLRequestSetHTTPRequestMethod(cfRequest, requestMethod.get());
 
-    addHeadersFromHashMap(cfRequest, httpHeaderFields());
+    setHeaderFields(cfRequest, httpHeaderFields());
     WebCore::setHTTPBody(cfRequest, httpBody());
     CFURLRequestSetShouldHandleHTTPCookies(cfRequest, allowCookies());
 
@@ -148,6 +157,7 @@ void ResourceRequest::doUpdateResourceRequest()
     }
     m_allowCookies = CFURLRequestShouldHandleHTTPCookies(m_cfRequest.get());
 
+    m_httpHeaderFields.clear();
     if (CFDictionaryRef headers = CFURLRequestCopyAllHTTPHeaderFields(m_cfRequest.get())) {
         CFIndex headerCount = CFDictionaryGetCount(headers);
         Vector<const void*, 128> keys(headerCount);
diff --git a/WebCore/platform/network/chromium/ResourceRequest.cpp b/WebCore/platform/network/chromium/ResourceRequest.cpp
new file mode 100644
index 0000000..76d1288
--- /dev/null
+++ b/WebCore/platform/network/chromium/ResourceRequest.cpp
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Google, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+namespace WebCore {
+
+// This is used by the loader to control the number of issued parallel load requests. 
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    return 6;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/curl/ResourceHandleCurl.cpp b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
index 5469ec9..5464e07 100644
--- a/WebCore/platform/network/curl/ResourceHandleCurl.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
@@ -156,7 +156,7 @@ void ResourceHandle::setDefersLoading(bool defers)
     if (d->m_defersLoading == defers)
         return;
 
-#if LIBCURL_VERSION_NUM > 0x071200
+#if LIBCURL_VERSION_NUM > 0x071800
     if (!d->m_handle)
         d->m_defersLoading = defers;
     else if (defers) {
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index 14c6f31..d8a812f 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -409,6 +409,25 @@ void ResourceHandleManager::downloadTimerCallback(Timer<ResourceHandleManager>*
         m_downloadTimer.startOneShot(pollTimeSeconds);
 }
 
+void ResourceHandleManager::setProxyInfo(const String& host,
+                                         unsigned long port,
+                                         ProxyType type,
+                                         const String& username,
+                                         const String& password)
+{
+    m_proxyType = type;
+
+    if (!host.length()) {
+        m_proxy = String("");
+    } else {
+        String userPass;
+        if (username.length() || password.length())
+            userPass = username + ":" + password + "@";
+
+        m_proxy = String("http://") + userPass + host + ":" + String::number(port);
+    }
+}
+
 void ResourceHandleManager::removeFromCurl(ResourceHandle* job)
 {
     ResourceHandleInternal* d = job->getInternal();
@@ -678,7 +697,7 @@ void ResourceHandleManager::initializeHandle(ResourceHandle* job)
 
     d->m_handle = curl_easy_init();
 
-#if LIBCURL_VERSION_NUM > 0x071200
+#if LIBCURL_VERSION_NUM > 0x071800
     if (d->m_defersLoading) {
         CURLcode error = curl_easy_pause(d->m_handle, CURLPAUSE_ALL);
         // If we did not pause the handle, we would ASSERT in the
@@ -753,6 +772,17 @@ void ResourceHandleManager::initializeHandle(ResourceHandle* job)
         curl_easy_setopt(d->m_handle, CURLOPT_HTTPHEADER, headers);
         d->m_customHeaders = headers;
     }
+    // curl CURLOPT_USERPWD expects username:password
+    if (d->m_user.length() || d->m_pass.length()) {
+        String userpass = d->m_user + ":" + d->m_pass;
+        curl_easy_setopt(d->m_handle, CURLOPT_USERPWD, userpass.utf8().data());
+    }
+
+    // Set proxy options if we have them.
+    if (m_proxy.length()) {
+        curl_easy_setopt(d->m_handle, CURLOPT_PROXY, m_proxy.utf8().data());
+        curl_easy_setopt(d->m_handle, CURLOPT_PROXYTYPE, m_proxyType);
+    }
 }
 
 void ResourceHandleManager::cancel(ResourceHandle* job)
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.h b/WebCore/platform/network/curl/ResourceHandleManager.h
index 89b27d7..4d73d87 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.h
+++ b/WebCore/platform/network/curl/ResourceHandleManager.h
@@ -28,8 +28,9 @@
 #ifndef ResourceHandleManager_h
 #define ResourceHandleManager_h
 
-#include "Frame.h"
 #include "CString.h"
+#include "Frame.h"
+#include "PlatformString.h"
 #include "Timer.h"
 #include "ResourceHandleClient.h"
 
@@ -45,6 +46,13 @@ namespace WebCore {
 
 class ResourceHandleManager {
 public:
+    enum ProxyType {
+        HTTP = CURLPROXY_HTTP,
+        Socks4 = CURLPROXY_SOCKS4,
+        Socks4A = CURLPROXY_SOCKS4A,
+        Socks5 = CURLPROXY_SOCKS5,
+        Socks5Hostname = CURLPROXY_SOCKS5_HOSTNAME
+    };
     static ResourceHandleManager* sharedInstance();
     void add(ResourceHandle*);
     void cancel(ResourceHandle*);
@@ -55,6 +63,12 @@ public:
     void setupPOST(ResourceHandle*, struct curl_slist**);
     void setupPUT(ResourceHandle*, struct curl_slist**);
 
+    void setProxyInfo(const String& host = "",
+                      unsigned long port = 0,
+                      ProxyType type = HTTP,
+                      const String& username = "",
+                      const String& password = "");
+
 private:
     ResourceHandleManager();
     ~ResourceHandleManager();
@@ -74,6 +88,9 @@ private:
     Vector<ResourceHandle*> m_resourceHandleList;
     const CString m_certificatePath;
     int m_runningJobs;
+    
+    String m_proxy;
+    ProxyType m_proxyType;
 };
 
 }
diff --git a/WebCore/platform/network/mac/AuthenticationMac.mm b/WebCore/platform/network/mac/AuthenticationMac.mm
index 355931d..93725d5 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -150,6 +150,9 @@ NSURLProtectionSpace *mac(const ProtectionSpace& coreSpace)
 
 NSURLCredential *mac(const Credential& coreCredential)
 {
+    if (coreCredential.isEmpty())
+        return nil;
+
     NSURLCredentialPersistence persistence = NSURLCredentialPersistenceNone;
     switch (coreCredential.persistence()) {
         case CredentialPersistenceNone:
diff --git a/WebCore/platform/network/mac/ResourceHandleMac.mm b/WebCore/platform/network/mac/ResourceHandleMac.mm
index ec60079..3630b30 100644
--- a/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -119,6 +119,7 @@ public:
     }
 };
 
+#ifndef BUILDING_ON_TIGER
 static String encodeBasicAuthorization(const String& user, const String& password)
 {
     CString unencodedString = (user + ":" + password).utf8();
@@ -128,6 +129,7 @@ static String encodeBasicAuthorization(const String& user, const String& passwor
     base64Encode(unencoded, encoded);
     return String(encoded.data(), encoded.size());
 }
+#endif
 
 ResourceHandleInternal::~ResourceHandleInternal()
 {
@@ -175,23 +177,38 @@ bool ResourceHandle::start(Frame* frame)
     } else 
         delegate = ResourceHandle::delegate();
 
-    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !d->m_request.url().protocolInHTTPFamily()) {
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty())
+#ifndef BUILDING_ON_TIGER
+     && !d->m_request.url().protocolInHTTPFamily() // On Tiger, always pass credentials in URL, so that they get stored even if the request gets cancelled right away.
+#endif
+    ) {
         // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
         KURL urlWithCredentials(d->m_request.url());
         urlWithCredentials.setUser(d->m_user);
         urlWithCredentials.setPass(d->m_pass);
         d->m_request.setURL(urlWithCredentials);
     }
-    
-    // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
-    // try and reuse the credential preemptively, as allowed by RFC 2617.
-    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily())
-        d->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(d->m_request.url());
+
+#ifndef BUILDING_ON_TIGER
+    if ((!client() || client()->shouldUseCredentialStorage(this)) && d->m_request.url().protocolInHTTPFamily()) {
+        if (d->m_user.isEmpty() && d->m_pass.isEmpty()) {
+            // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+            // try and reuse the credential preemptively, as allowed by RFC 2617.
+            d->m_initialCredential = CredentialStorage::get(d->m_request.url());
+        } else {
+            // If there is already a protection space known for the URL, update stored credentials before sending a request.
+            // This makes it possible to implement logout by sending an XMLHttpRequest with known incorrect credentials, and aborting it immediately
+            // (so that an authentication dialog doesn't pop up).
+            CredentialStorage::set(Credential(d->m_user, d->m_pass, CredentialPersistenceNone), d->m_request.url());
+        }
+    }
         
     if (!d->m_initialCredential.isEmpty()) {
+        // FIXME: Support Digest authentication, and Proxy-Authorization.
         String authHeader = "Basic " + encodeBasicAuthorization(d->m_initialCredential.user(), d->m_initialCredential.password());
         d->m_request.addHTTPHeaderField("Authorization", authHeader);
     }
+#endif
 
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         associateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream], this);
@@ -471,7 +488,7 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
     if (!d->m_user.isNull() && !d->m_pass.isNull()) {
         NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:d->m_user
                                                                    password:d->m_pass
-                                                                persistence:NSURLCredentialPersistenceNone];
+                                                                persistence:NSURLCredentialPersistenceForSession];
         d->m_currentMacChallenge = challenge.nsURLAuthenticationChallenge();
         d->m_currentWebChallenge = challenge;
         receivedCredential(challenge, core(credential));
@@ -482,6 +499,7 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
         return;
     }
 
+#ifndef BUILDING_ON_TIGER
     if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
         Credential credential = CredentialStorage::get(challenge.protectionSpace());
         if (!credential.isEmpty() && credential != d->m_initialCredential) {
@@ -490,6 +508,7 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
             return;
         }
     }
+#endif
 
     d->m_currentMacChallenge = challenge.nsURLAuthenticationChallenge();
     NSURLAuthenticationChallenge *webChallenge = [[NSURLAuthenticationChallenge alloc] initWithAuthenticationChallenge:d->m_currentMacChallenge 
@@ -521,11 +540,6 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
     if (credential.persistence() == CredentialPersistenceNone) {
         // NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use session persistence.
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceForSession);
-        KURL urlToStore;
-        if (challenge.failureResponse().httpStatusCode() == 401)
-            urlToStore = d->m_request.url();
-        CredentialStorage::set(webCredential, core([d->m_currentMacChallenge protectionSpace]), urlToStore);
-        
         [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
     } else
 #else
@@ -620,6 +634,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
 
     CallbackGuard guard;
     ResourceRequest request = newRequest;
+
+    // Should not set Referer after a redirect from a secure resource to non-secure one.
+    if (!request.url().protocolIs("https") && protocolIs(request.httpReferrer(), "https"))
+        request.clearHTTPReferrer();
+
     m_handle->willSendRequest(request, redirectResponse);
 
     if (!ResourceHandle::didSendBodyDataDelegateExists()) {
@@ -1055,7 +1074,7 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
         // try and reuse the credential preemptively, as allowed by RFC 2617.
         ResourceRequest requestWithInitialCredentials = request;
         if (allowStoredCredentials && url.protocolInHTTPFamily())
-            delegate->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(url);
+            delegate->m_initialCredential = CredentialStorage::get(url);
             
         if (!delegate->m_initialCredential.isEmpty()) {
             String authHeader = "Basic " + encodeBasicAuthorization(delegate->m_initialCredential.user(), delegate->m_initialCredential.password());
diff --git a/WebCore/platform/network/mac/ResourceRequestMac.mm b/WebCore/platform/network/mac/ResourceRequestMac.mm
index c4355b2..c2ad7d1 100644
--- a/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -66,6 +66,7 @@ void ResourceRequest::doUpdateResourceRequest()
     NSDictionary *headers = [m_nsRequest.get() allHTTPHeaderFields];
     NSEnumerator *e = [headers keyEnumerator];
     NSString *name;
+    m_httpHeaderFields.clear();
     while ((name = [e nextObject]))
         m_httpHeaderFields.set(name, [headers objectForKey:name]);
 
@@ -114,7 +115,11 @@ void ResourceRequest::doUpdatePlatformRequest()
     if (!httpMethod().isEmpty())
         [nsRequest setHTTPMethod:httpMethod()];
     [nsRequest setHTTPShouldHandleCookies:allowCookies()];
-    
+
+    // Cannot just use setAllHTTPHeaderFields here, because it does not remove headers.
+    NSArray *oldHeaderFieldNames = [[nsRequest allHTTPHeaderFields] allKeys];
+    for (unsigned i = [oldHeaderFieldNames count]; i != 0; --i)
+        [nsRequest setValue:nil forHTTPHeaderField:[oldHeaderFieldNames objectAtIndex:i - 1]];
     HTTPHeaderMap::const_iterator end = httpHeaderFields().end();
     for (HTTPHeaderMap::const_iterator it = httpHeaderFields().begin(); it != end; ++it)
         [nsRequest setValue:it->second forHTTPHeaderField:it->first];
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 7a3703d..ed5e024 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -112,23 +112,11 @@ qint64 FormDataIODevice::writeData(const char*, qint64)
     return -1;
 }
 
-void FormDataIODevice::setParent(QNetworkReply* reply)
-{
-    QIODevice::setParent(reply);
-
-    connect(reply, SIGNAL(finished()), SLOT(slotFinished()), Qt::QueuedConnection);
-}
-
 bool FormDataIODevice::isSequential() const
 {
     return true;
 }
 
-void FormDataIODevice::slotFinished()
-{
-    deleteLater();
-}
-
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
     , m_reply(0)
@@ -187,8 +175,8 @@ void QNetworkReplyHandler::abort()
         QNetworkReply* reply = release();
         reply->abort();
         reply->deleteLater();
-        deleteLater();
     }
+    deleteLater();
 }
 
 QNetworkReply* QNetworkReplyHandler::release()
@@ -200,6 +188,7 @@ QNetworkReply* QNetworkReplyHandler::release()
         // posted meta call events that were the result of a signal emission
         // don't reach the slots in our instance.
         QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
+        m_reply->setParent(0);
         m_reply = 0;
     }
     return reply;
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 545119e..fccc4a6 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -96,16 +96,12 @@ public:
     FormDataIODevice(FormData*);
     ~FormDataIODevice();
 
-    void setParent(QNetworkReply*);
     bool isSequential() const;
 
 protected:
     qint64 readData(char*, qint64);
     qint64 writeData(const char*, qint64);
 
-private Q_SLOTS:
-    void slotFinished();
-
 private:
     void moveToNextElement();
 
diff --git a/WebCore/platform/qt/CursorQt.cpp b/WebCore/platform/qt/CursorQt.cpp
index aad84be..3fc83f9 100644
--- a/WebCore/platform/qt/CursorQt.cpp
+++ b/WebCore/platform/qt/CursorQt.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2006 George Staikos <staikos@kde.org>
  * Copyright (C) 2006 Charles Samuels <charles@kde.org>
- * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2008, 2009 Holger Hans Peter Freyther
  *
  * All rights reserved.
  *
@@ -92,14 +92,14 @@ protected:
         , SplitVCursor(Qt::SplitVCursor)
         , NoDropCursor(Qt::ForbiddenCursor)
         , BlankCursor(Qt::BlankCursor)
-        , ZoomInCursor(QPixmap(QLatin1String(":/webkit/resources/zoomInCursor.png")))
-        , ZoomOutCursor(QPixmap(QLatin1String(":/webkit/resources/zoomOutCursor.png")))
-        , VerticalTextCursor(QPixmap(QLatin1String(":/webkit/resources/verticalTextCursor.png")))
-        , CellCursor(QPixmap(QLatin1String(":/webkit/resources/cellCursor.png")))
-        , ContextMenuCursor(QPixmap(QLatin1String(":/webkit/resources/contextMenuCursor.png")))
-        , CopyCursor(QPixmap(QLatin1String(":/webkit/resources/copyCursor.png")))
-        , ProgressCursor(QPixmap(QLatin1String(":/webkit/resources/progressCursor.png")))
-        , AliasCursor(QPixmap(QLatin1String(":/webkit/resources/aliasCursor.png")))
+        , ZoomInCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/zoomInCursor.png")), 7, 7))
+        , ZoomOutCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/zoomOutCursor.png")), 7, 7))
+        , VerticalTextCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/verticalTextCursor.png")), 7, 7))
+        , CellCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/cellCursor.png")), 7, 7))
+        , ContextMenuCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/contextMenuCursor.png")), 3, 2))
+        , CopyCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/copyCursor.png")), 3, 2))
+        , ProgressCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/progressCursor.png")), 3, 2))
+        , AliasCursor(QCursor(QPixmap(QLatin1String(":/webkit/resources/aliasCursor.png")), 11, 3))
 
 #endif
     {
diff --git a/WebCore/platform/qt/Localizations.cpp b/WebCore/platform/qt/Localizations.cpp
index 77cac57..ca3ca9d 100644
--- a/WebCore/platform/qt/Localizations.cpp
+++ b/WebCore/platform/qt/Localizations.cpp
@@ -33,6 +33,7 @@
 #include "PlatformString.h"
 
 #include <QCoreApplication>
+#include <QLocale>
 
 namespace WebCore {
 
@@ -53,7 +54,8 @@ String resetButtonDefaultLabel()
 
 String defaultLanguage()
 {
-    return "en";
+    QLocale locale;
+    return locale.name().replace("_", "-");
 }
 
 String searchableIndexIntroduction()
diff --git a/WebCore/platform/qt/PlatformScreenQt.cpp b/WebCore/platform/qt/PlatformScreenQt.cpp
index 7ba8350..8221760 100644
--- a/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -62,7 +62,7 @@ int screenDepthPerComponent(Widget* w)
         QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
 
         if (client) {
-            QWidget* view = QWidget::find(client->winId());
+            QWidget* view = client->ownerWidget();
             if (view)
                 return view->depth();
         }
diff --git a/WebCore/platform/qt/PopupMenuQt.cpp b/WebCore/platform/qt/PopupMenuQt.cpp
index b44f2ec..f6ec4f7 100644
--- a/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/WebCore/platform/qt/PopupMenuQt.cpp
@@ -92,7 +92,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     rect.moveTopLeft(v->contentsToWindow(r.topLeft()));
     rect.setHeight(m_popup->sizeHint().height());
 
-    m_popup->setParent(QWidget::find(client->winId()));
+    m_popup->setParent(client->ownerWidget());
     m_popup->setGeometry(rect);
     m_popup->setCurrentIndex(index);
     m_popup->exec();
diff --git a/WebCore/platform/qt/QWebPageClient.h b/WebCore/platform/qt/QWebPageClient.h
index 09f7886..28ef724 100644
--- a/WebCore/platform/qt/QWebPageClient.h
+++ b/WebCore/platform/qt/QWebPageClient.h
@@ -32,7 +32,10 @@ class QWebPageClient {
 public:
     virtual void scroll(int dx, int dy, const QRect&) = 0;
     virtual void update(const QRect&) = 0;
-
+    virtual void setInputMethodEnabled(bool enable) = 0;
+#if QT_VERSION >= 0x040600
+    virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable) = 0;
+#endif
     inline void resetCursor()
     {
 #ifndef QT_NO_CURSOR
@@ -52,8 +55,9 @@ public:
 #endif
     }
 
+    virtual QPalette palette() const = 0;
     virtual int screenNumber() const = 0;
-    virtual WId winId() const = 0;
+    virtual QWidget* ownerWidget() const = 0;
 
     virtual QObject* pluginParent() const = 0;
 
diff --git a/WebCore/platform/qt/WheelEventQt.cpp b/WebCore/platform/qt/WheelEventQt.cpp
index 66118e1..9cc27ab 100644
--- a/WebCore/platform/qt/WheelEventQt.cpp
+++ b/WebCore/platform/qt/WheelEventQt.cpp
@@ -32,11 +32,11 @@ namespace WebCore {
 void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
 {
     if (orientation == Qt::Horizontal) {
-        m_deltaX = (delta / 120);
+        m_deltaX = (delta / 120.0f);
         m_deltaY = 0;
     } else {
         m_deltaX = 0;
-        m_deltaY = (delta / 120);
+        m_deltaY = (delta / 120.0f);
     }
 
     m_wheelTicksX = m_deltaX;
diff --git a/WebCore/platform/sql/SQLiteDatabase.h b/WebCore/platform/sql/SQLiteDatabase.h
index d313435..9982254 100644
--- a/WebCore/platform/sql/SQLiteDatabase.h
+++ b/WebCore/platform/sql/SQLiteDatabase.h
@@ -24,8 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SQLDatabase_h
-#define SQLDatabase_h
+#ifndef SQLiteDatabase_h
+#define SQLiteDatabase_h
 
 #include "PlatformString.h"
 #include <wtf/Threading.h>
diff --git a/WebCore/platform/text/AtomicString.cpp b/WebCore/platform/text/AtomicString.cpp
index 409439e..17d7832 100644
--- a/WebCore/platform/text/AtomicString.cpp
+++ b/WebCore/platform/text/AtomicString.cpp
@@ -65,7 +65,9 @@ struct CStringTranslator {
 
     static void translate(StringImpl*& location, const char* const& c, unsigned hash)
     {
-        location = new StringImpl(c, strlen(c), hash); 
+        location = StringImpl::create(c).releaseRef(); 
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -140,7 +142,9 @@ struct UCharBufferTranslator {
 
     static void translate(StringImpl*& location, const UCharBuffer& buf, unsigned hash)
     {
-        location = new StringImpl(buf.s, buf.length, hash); 
+        location = StringImpl::create(buf.s, buf.length).releaseRef(); 
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -164,7 +168,9 @@ struct HashAndCharactersTranslator {
 
     static void translate(StringImpl*& location, const HashAndCharacters& buffer, unsigned hash)
     {
-        location = new StringImpl(buffer.characters, buffer.length, hash); 
+        location = StringImpl::create(buffer.characters, buffer.length).releaseRef();
+        location->setHash(hash);
+        location->setInTable();
     }
 };
 
@@ -222,6 +228,16 @@ void AtomicString::remove(StringImpl* r)
 {
     stringTable().remove(r);
 }
+    
+AtomicString AtomicString::lower() const
+{
+    // Note: This is a hot function in the Dromaeo benchmark.
+    StringImpl* impl = this->impl();
+    RefPtr<StringImpl> newImpl = impl->lower();
+    if (LIKELY(newImpl == impl))
+        return *this;
+    return AtomicString(newImpl);
+}
 
 #if USE(JSC)
 PassRefPtr<StringImpl> AtomicString::add(const JSC::Identifier& identifier)
diff --git a/WebCore/platform/text/AtomicString.h b/WebCore/platform/text/AtomicString.h
index 3307a2d..8805f4c 100644
--- a/WebCore/platform/text/AtomicString.h
+++ b/WebCore/platform/text/AtomicString.h
@@ -83,6 +83,9 @@ public:
     bool endsWith(const String& s, bool caseSensitive = true) const
         { return m_string.endsWith(s, caseSensitive); }
     
+    AtomicString lower() const;
+    AtomicString upper() const { return AtomicString(impl()->upper()); }
+    
     int toInt(bool* ok = 0) const { return m_string.toInt(ok); }
     double toDouble(bool* ok = 0) const { return m_string.toDouble(ok); }
     float toFloat(bool* ok = 0) const { return m_string.toFloat(ok); }
diff --git a/WebCore/platform/text/String.cpp b/WebCore/platform/text/String.cpp
index bef2674..44582a9 100644
--- a/WebCore/platform/text/String.cpp
+++ b/WebCore/platform/text/String.cpp
@@ -441,7 +441,7 @@ String String::number(unsigned long n)
 
 String String::number(long long n)
 {
-#if PLATFORM(WIN_OS)
+#if PLATFORM(WIN_OS) && !PLATFORM(QT)
     return String::format("%I64i", n);
 #else
     return String::format("%lli", n);
@@ -450,7 +450,7 @@ String String::number(long long n)
 
 String String::number(unsigned long long n)
 {
-#if PLATFORM(WIN_OS)
+#if PLATFORM(WIN_OS) && !PLATFORM(QT)
     return String::format("%I64u", n);
 #else
     return String::format("%llu", n);
diff --git a/WebCore/platform/text/StringImpl.cpp b/WebCore/platform/text/StringImpl.cpp
index c3ab4be..5cf4ced 100644
--- a/WebCore/platform/text/StringImpl.cpp
+++ b/WebCore/platform/text/StringImpl.cpp
@@ -89,7 +89,7 @@ StringImpl::StringImpl()
     hash();
 }
 
-inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
+inline StringImpl::StringImpl(const UChar* characters, unsigned length)
     : m_data(characters)
     , m_length(length)
     , m_hash(0)
@@ -98,41 +98,6 @@ inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
     ASSERT(length);
 }
 
-// This constructor is only for use by AtomicString.
-StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
-    : m_data(0)
-    , m_length(length)
-    , m_hash(hash)
-{
-    ASSERT(hash);
-    ASSERT(characters);
-    ASSERT(length);
-
-    setInTable();
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-// This constructor is only for use by AtomicString.
-StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
-    : m_data(0)
-    , m_length(length)
-    , m_hash(hash)
-{
-    ASSERT(hash);
-    ASSERT(characters);
-    ASSERT(length);
-
-    setInTable();
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
-}
-
 StringImpl::~StringImpl()
 {
     if (inTable())
@@ -184,46 +149,38 @@ UChar32 StringImpl::characterStartingAt(unsigned i)
     return 0;
 }
 
-bool StringImpl::isLower()
+PassRefPtr<StringImpl> StringImpl::lower()
 {
-    // Do a faster loop for the case where all the characters are ASCII.
-    bool allLower = true;
+    // Note: This is a hot function in the Dromaeo benchmark, specifically the
+    // no-op code path up through the first 'return' statement.
+    
+    // First scan the string for uppercase and non-ASCII characters:
     UChar ored = 0;
-    for (unsigned i = 0; i < m_length; i++) {
-        UChar c = m_data[i];
-        allLower = allLower && isASCIILower(c);
-        ored |= c;
+    bool noUpper = true;
+    const UChar *end = m_data + m_length;
+    for (const UChar* chp = m_data; chp != end; chp++) {
+        if (UNLIKELY(isASCIIUpper(*chp)))
+            noUpper = false;
+        ored |= *chp;
     }
-    if (!(ored & ~0x7F))
-        return allLower;
-
-    // Do a slower check for cases that include non-ASCII characters.
-    allLower = true;
-    unsigned i = 0;
-    while (i < m_length) {
-        UChar32 character;
-        U16_NEXT(m_data, i, m_length, character)
-        allLower = allLower && Unicode::isLower(character);
-    }
-    return allLower;
-}
+    
+    // Nothing to do if the string is all ASCII with no uppercase.
+    if (noUpper && !(ored & ~0x7F))
+        return this;
 
-PassRefPtr<StringImpl> StringImpl::lower()
-{
-    UChar* data;
-    PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
+    UChar* data;
+    RefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
 
-    // Do a faster loop for the case where all the characters are ASCII.
-    UChar ored = 0;
-    for (int i = 0; i < length; i++) {
-        UChar c = m_data[i];
-        ored |= c;
-        data[i] = toASCIILower(c);
-    }
-    if (!(ored & ~0x7F))
+    if (!(ored & ~0x7F)) {
+        // Do a faster loop for the case where all the characters are ASCII.
+        for (int i = 0; i < length; i++) {
+            UChar c = m_data[i];
+            data[i] = toASCIILower(c);
+        }
         return newImpl;
-
+    }
+    
     // Do a slower implementation for cases that include non-ASCII characters.
     bool error;
     int32_t realLength = Unicode::toLower(data, length, m_data, m_length, &error);
@@ -238,6 +195,9 @@ PassRefPtr<StringImpl> StringImpl::lower()
 
 PassRefPtr<StringImpl> StringImpl::upper()
 {
+    // This function could be optimized for no-op cases the way lower() is,
+    // but in empirical testing, few actual calls to upper() are no-ops, so
+    // it wouldn't be worth the extra time for pre-scanning.
     UChar* data;
     PassRefPtr<StringImpl> newImpl = createUninitialized(m_length, data);
     int32_t length = m_length;
@@ -322,6 +282,8 @@ PassRefPtr<StringImpl> StringImpl::stripWhiteSpace()
     while (end && isSpaceOrNewline(m_data[end]))
         end--;
 
+    if (!start && end == m_length - 1)
+        return this;
     return create(m_data + start, end + 1 - start);
 }
 
@@ -364,12 +326,16 @@ PassRefPtr<StringImpl> StringImpl::simplifyWhiteSpace()
     const UChar* from = m_data;
     const UChar* fromend = from + m_length;
     int outc = 0;
+    bool changedToSpace = false;
     
     UChar* to = data.characters();
     
     while (true) {
-        while (from != fromend && isSpaceOrNewline(*from))
+        while (from != fromend && isSpaceOrNewline(*from)) {
+            if (*from != ' ')
+                changedToSpace = true;
             from++;
+        }
         while (from != fromend && !isSpaceOrNewline(*from))
             to[outc++] = *from++;
         if (from != fromend)
@@ -381,6 +347,9 @@ PassRefPtr<StringImpl> StringImpl::simplifyWhiteSpace()
     if (outc > 0 && to[outc - 1] == ' ')
         outc--;
     
+    if (static_cast<unsigned>(outc) == m_length && !changedToSpace)
+        return this;
+    
     data.shrink(outc);
     
     return adopt(data);
@@ -933,7 +902,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(StringBuffer& buffer)
     unsigned length = buffer.length();
     if (length == 0)
         return empty();
-    return adoptRef(new StringImpl(buffer.release(), length, AdoptBuffer()));
+    return adoptRef(new StringImpl(buffer.release(), length));
 }
 
 PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
@@ -941,7 +910,7 @@ PassRefPtr<StringImpl> StringImpl::adopt(Vector<UChar>& vector)
     size_t size = vector.size();
     if (size == 0)
         return empty();
-    return adoptRef(new StringImpl(vector.releaseBuffer(), size, AdoptBuffer()));
+    return adoptRef(new StringImpl(vector.releaseBuffer(), size));
 }
 
 PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*& data)
@@ -957,7 +926,7 @@ PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*&
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
     StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
     data = reinterpret_cast<UChar*>(string + 1);
-    string = new (string) StringImpl(data, length, AdoptBuffer());
+    string = new (string) StringImpl(data, length);
     return adoptRef(string);
 }
 
@@ -998,7 +967,7 @@ PassRefPtr<StringImpl> StringImpl::create(const JSC::UString& str)
 {
     SharedUChar* sharedBuffer = const_cast<JSC::UString*>(&str)->rep()->sharedBuffer();
     if (sharedBuffer) {
-        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(str.data()), str.size(), AdoptBuffer()));
+        PassRefPtr<StringImpl> impl = adoptRef(new StringImpl(str.data(), str.size()));
         sharedBuffer->ref();
         impl->m_sharedBufferAndFlags.set(sharedBuffer);
         return impl;
@@ -1043,7 +1012,7 @@ PassRefPtr<StringImpl> StringImpl::crossThreadString()
 {
     SharedUChar* shared = sharedBuffer();
     if (shared) {
-        RefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(m_data), m_length, AdoptBuffer()));
+        RefPtr<StringImpl> impl = adoptRef(new StringImpl(m_data, m_length));
         impl->m_sharedBufferAndFlags.set(shared->crossThreadCopy().releaseRef());
         return impl.release();
     }
diff --git a/WebCore/platform/text/StringImpl.h b/WebCore/platform/text/StringImpl.h
index f3256cc..dac25b2 100644
--- a/WebCore/platform/text/StringImpl.h
+++ b/WebCore/platform/text/StringImpl.h
@@ -47,7 +47,6 @@ typedef const struct __CFString * CFStringRef;
 
 namespace WebCore {
 
-class AtomicString;
 class StringBuffer;
 
 struct CStringTranslator;
@@ -60,21 +59,19 @@ enum TextCaseSensitivity { TextCaseSensitive, TextCaseInsensitive };
 typedef bool (*CharacterMatchFunctionPtr)(UChar);
 
 class StringImpl : public RefCounted<StringImpl> {
-    friend class AtomicString;
     friend struct CStringTranslator;
     friend struct HashAndCharactersTranslator;
     friend struct UCharBufferTranslator;
 private:
     friend class ThreadGlobalData;
     StringImpl();
+    
+    // This adopts the UChar* without copying the buffer.
+    StringImpl(const UChar*, unsigned length);
 
-    struct AdoptBuffer { };
-    StringImpl(UChar*, unsigned length, AdoptBuffer);
-
-    // For AtomicString.
-    StringImpl(const UChar*, unsigned length, unsigned hash);
-    StringImpl(const char*, unsigned length, unsigned hash);
-
+    // For use only by AtomicString's XXXTranslator helpers.
+    void setHash(unsigned hash) { ASSERT(!m_hash); m_hash = hash; }
+    
     typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
 
 public:
@@ -138,7 +135,6 @@ public:
     double toDouble(bool* ok = 0);
     float toFloat(bool* ok = 0);
 
-    bool isLower();
     PassRefPtr<StringImpl> lower();
     PassRefPtr<StringImpl> upper();
     PassRefPtr<StringImpl> secure(UChar aChar);
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index 5d82511..d3e2965 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -129,6 +129,10 @@ static TextEncodingNameMap* textEncodingNameMap;
 static TextCodecMap* textCodecMap;
 static bool didExtendTextCodecMaps;
 
+static const char* const textEncodingNameBlacklist[] = {
+    "UTF-7"
+};
+
 #if ERROR_DISABLED
 
 static inline void checkExistingName(const char*, const char*) { }
@@ -171,6 +175,30 @@ static void addToTextCodecMap(const char* name, NewTextCodecFunction function, c
     textCodecMap->add(atomicName, TextCodecFactory(function, additionalData));
 }
 
+static void pruneBlacklistedCodecs()
+{
+    size_t blacklistedCodecListLength = sizeof(textEncodingNameBlacklist) / sizeof(textEncodingNameBlacklist[0]);
+    for (size_t i = 0; i < blacklistedCodecListLength; ++i) {
+        const char* atomicName = textEncodingNameMap->get(textEncodingNameBlacklist[i]);
+        if (!atomicName)
+            continue;
+
+        Vector<const char*> names;
+        TextEncodingNameMap::const_iterator it = textEncodingNameMap->begin();
+        TextEncodingNameMap::const_iterator end = textEncodingNameMap->end();
+        for (; it != end; ++it) {
+            if (it->second == atomicName)
+                names.append(it->first);
+        }
+
+        size_t length = names.size();
+        for (size_t j = 0; j < length; ++j)
+            textEncodingNameMap->remove(names[j]);
+
+        textCodecMap->remove(atomicName);
+    }
+}
+
 static void buildBaseTextCodecMaps()
 {
     ASSERT(isMainThread());
@@ -221,6 +249,8 @@ static void extendTextCodecMaps()
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
 #endif
+
+    pruneBlacklistedCodecs();
 }
 
 PassOwnPtr<TextCodec> newTextCodec(const TextEncoding& encoding)
diff --git a/WebCore/platform/win/ClipboardWin.cpp b/WebCore/platform/win/ClipboardWin.cpp
index b2e8e3e..b75ce46 100644
--- a/WebCore/platform/win/ClipboardWin.cpp
+++ b/WebCore/platform/win/ClipboardWin.cpp
@@ -577,8 +577,32 @@ HashSet<String> ClipboardWin::types() const
 
 PassRefPtr<FileList> ClipboardWin::files() const
 {
-    notImplemented();
-    return 0;
+    RefPtr<FileList> files = FileList::create();
+    if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
+        return files.release();
+
+    if (!m_dataObject)
+        return files.release();
+
+    STGMEDIUM medium;
+    if (FAILED(m_dataObject->GetData(cfHDropFormat(), &medium)))
+        return files.release();
+
+    HDROP hdrop = reinterpret_cast<HDROP>(GlobalLock(medium.hGlobal));
+    if (!hdrop)
+        return files.release();
+
+    WCHAR filename[MAX_PATH];
+    UINT fileCount = DragQueryFileW(hdrop, 0xFFFFFFFF, 0, 0);
+    for (UINT i = 0; i < fileCount; i++) {
+        if (!DragQueryFileW(hdrop, i, filename, ARRAYSIZE(filename)))
+            continue;
+        files->append(File::create(reinterpret_cast<UChar*>(filename)));
+    }
+
+    GlobalUnlock(medium.hGlobal);
+    ReleaseStgMedium(&medium);
+    return files.release();
 }
 
 void ClipboardWin::setDragImage(CachedImage* image, Node *node, const IntPoint &loc)
diff --git a/WebCore/platform/win/ScrollbarThemeSafari.cpp b/WebCore/platform/win/ScrollbarThemeSafari.cpp
index 06a6533..4e979f2 100644
--- a/WebCore/platform/win/ScrollbarThemeSafari.cpp
+++ b/WebCore/platform/win/ScrollbarThemeSafari.cpp
@@ -73,7 +73,7 @@ static int cButtonHitInset[] = { 3, 2 };
 static int cButtonLength[] = { 14, 10 };
 static int cThumbMinLength[] = { 26, 20 };
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp b/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp
index 653f142..23dea6b 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/fontprops.cpp
@@ -30,6 +30,7 @@
 
 #include <wx/defs.h>
 #include <wx/gdicmn.h>
+#include <wx/graphics.h>
 
 #ifdef BUILDING_ON_TIGER
 void (*wkGetFontMetrics)(CGFontRef, int* ascent, int* descent, int* lineGap, unsigned* unitsPerEm);
@@ -91,98 +92,21 @@ m_ascent(0), m_descent(0), m_lineGap(0), m_lineSpacing(0), m_xHeight(0)
 void GetTextExtent( const wxFont& font, const wxString& str, wxCoord *width, wxCoord *height,
                             wxCoord *descent, wxCoord *externalLeading )
 {
-    ATSUStyle* ATSUIStyle;
-
-    if ( font.Ok() )
+    wxGraphicsContext * const gc = wxGraphicsContext::Create();
+    gc->SetFont(font, *wxBLACK); // colour doesn't matter but must be specified
+    struct GCTextExtent
     {
-        OSStatus status ;
-
-        status = ATSUCreateAndCopyStyle( (ATSUStyle) font.MacGetATSUStyle() , (ATSUStyle*) &ATSUIStyle ) ;
-
-        wxASSERT_MSG( status == noErr, wxT("couldn't create ATSU style") ) ;
-
-        // we need the scale here ...
-
-        Fixed atsuSize = IntToFixed( int( /*m_scaleY*/ 1 * font.GetPointSize()) ) ;
-        //RGBColor atsuColor = MAC_WXCOLORREF( m_textForegroundColor.GetPixel() ) ;
-        ATSUAttributeTag atsuTags[] =
-        {
-                kATSUSizeTag //,
-        //        kATSUColorTag ,
-        } ;
-        ByteCount atsuSizes[sizeof(atsuTags) / sizeof(ATSUAttributeTag)] =
-        {
-                sizeof( Fixed ) //,
-        //        sizeof( RGBColor ) ,
-        } ;
-        ATSUAttributeValuePtr atsuValues[sizeof(atsuTags) / sizeof(ATSUAttributeTag)] =
-        {
-                &atsuSize //,
-        //        &atsuColor ,
-        } ;
-
-        status = ::ATSUSetAttributes(
-            (ATSUStyle)ATSUIStyle, sizeof(atsuTags) / sizeof(ATSUAttributeTag) ,
-            atsuTags, atsuSizes, atsuValues);
-
-        wxASSERT_MSG( status == noErr , wxT("couldn't modify ATSU style") ) ;
-    }
-    
-    wxCHECK_RET( ATSUIStyle != NULL, wxT("GetTextExtent - no valid font set") ) ;
-
-    OSStatus status = noErr ;
-
-    ATSUTextLayout atsuLayout ;
-    UniCharCount chars = str.length() ;
-    UniChar* ubuf = NULL ;
-
-#if SIZEOF_WCHAR_T == 4
-    wxMBConvUTF16 converter ;
-#if wxUSE_UNICODE
-    size_t unicharlen = converter.WC2MB( NULL , str.wc_str() , 0 ) ;
-    ubuf = (UniChar*) malloc( unicharlen + 2 ) ;
-    converter.WC2MB( (char*) ubuf , str.wc_str(), unicharlen + 2 ) ;
-#else
-    const wxWCharBuffer wchar = str.wc_str( wxConvLocal ) ;
-    size_t unicharlen = converter.WC2MB( NULL , wchar.data() , 0 ) ;
-    ubuf = (UniChar*) malloc( unicharlen + 2 ) ;
-    converter.WC2MB( (char*) ubuf , wchar.data() , unicharlen + 2 ) ;
-#endif
-    chars = unicharlen / 2 ;
-#else
-#if wxUSE_UNICODE
-    ubuf = (UniChar*) str.wc_str() ;
-#else
-    wxWCharBuffer wchar = str.wc_str( wxConvLocal ) ;
-    chars = wxWcslen( wchar.data() ) ;
-    ubuf = (UniChar*) wchar.data() ;
-#endif
-#endif
-
-    status = ::ATSUCreateTextLayoutWithTextPtr( (UniCharArrayPtr) ubuf , 0 , chars , chars , 1 ,
-        &chars , (ATSUStyle*) &ATSUIStyle , &atsuLayout ) ;
-
-    wxASSERT_MSG( status == noErr , wxT("couldn't create the layout of the text") );
-
-    ATSUTextMeasurement textBefore, textAfter ;
-    ATSUTextMeasurement textAscent, textDescent ;
-
-    status = ::ATSUGetUnjustifiedBounds( atsuLayout, kATSUFromTextBeginning, kATSUToTextEnd,
-        &textBefore , &textAfter, &textAscent , &textDescent );
-
+        wxDouble width, height, descent, externalLeading;
+    } e;
+    gc->GetTextExtent(str, &e.width, &e.height, &e.descent, &e.externalLeading);
+    if ( width )
+        *width = wxCoord(e.width + .5);
     if ( height )
-        *height = FixedToInt(textAscent + textDescent) ;
+        *height = wxCoord(e.height + .5);
     if ( descent )
-        *descent = FixedToInt(textDescent) ;
+        *descent = wxCoord(e.descent + .5);
     if ( externalLeading )
-        *externalLeading = 0 ;
-    if ( width )
-        *width = FixedToInt(textAfter - textBefore) ;
-
-#if SIZEOF_WCHAR_T == 4
-    free( ubuf ) ;
-#endif
+        *externalLeading = wxCoord(e.externalLeading + .5);
 
-    ::ATSUDisposeTextLayout(atsuLayout);
-    ::ATSUDisposeStyle((ATSUStyle)ATSUIStyle);
+    delete gc;
 }
diff --git a/WebCore/plugins/PluginDataNone.cpp b/WebCore/plugins/PluginDataNone.cpp
index 28e3967..3b98383 100644
--- a/WebCore/plugins/PluginDataNone.cpp
+++ b/WebCore/plugins/PluginDataNone.cpp
@@ -27,18 +27,14 @@
 #include "config.h"
 #include "PluginData.h"
 
-#include "NotImplemented.h"
-
 namespace WebCore {
 
 void PluginData::initPlugins()
 {
-    notImplemented();
 }
 
 void PluginData::refresh()
 {
-    notImplemented();
 }
 
 };
diff --git a/WebCore/plugins/PluginDatabase.cpp b/WebCore/plugins/PluginDatabase.cpp
index f7304df..25e6000 100644
--- a/WebCore/plugins/PluginDatabase.cpp
+++ b/WebCore/plugins/PluginDatabase.cpp
@@ -325,7 +325,7 @@ void PluginDatabase::clear()
     m_preferredPlugins.clear();
 }
 
-#if !PLATFORM(WIN_OS) || PLATFORM(WX)
+#if (!PLATFORM(SYMBIAN)) && (!PLATFORM(WIN_OS) || PLATFORM(WX) || !ENABLE(NETSCAPE_PLUGIN_API))
 // For Safari/Win the following three methods are implemented
 // in PluginDatabaseWin.cpp, but if we can use WebCore constructs
 // for the logic we should perhaps move it here under XP_WIN?
@@ -438,6 +438,6 @@ void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
     }
 }
 
-#endif // !PLATFORM(WIN_OS)
+#endif // !PLATFORM(SYMBIAN) && !PLATFORM(WIN_OS)
 
 }
diff --git a/WebCore/plugins/PluginPackage.cpp b/WebCore/plugins/PluginPackage.cpp
index 258cbb7..06aedd9 100644
--- a/WebCore/plugins/PluginPackage.cpp
+++ b/WebCore/plugins/PluginPackage.cpp
@@ -119,6 +119,7 @@ PluginPackage::PluginPackage(const String& path, const time_t& lastModified)
     m_parentDirectory = m_path.left(m_path.length() - m_fileName.length() - 1);
 }
 
+#if !PLATFORM(SYMBIAN)
 void PluginPackage::unload()
 {
     if (!m_isLoaded)
@@ -131,6 +132,7 @@ void PluginPackage::unload()
 
     unloadWithoutShutdown();
 }
+#endif //!PLATFORM(SYMBIAN)
 
 void PluginPackage::unloadWithoutShutdown()
 {
@@ -323,15 +325,24 @@ bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
 {
     return a.m_description == b.m_description;
 }
+#endif
 
 int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
 {
     // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
     // the passed version
+
+#if PLATFORM(WIN_OS)
+    if (m_moduleVersion.mostSig != compareVersion.mostSig)
+        return m_moduleVersion.mostSig > compareVersion.mostSig ? 1 : -1;
+    if (m_moduleVersion.leastSig != compareVersion.leastSig)
+        return m_moduleVersion.leastSig > compareVersion.leastSig ? 1 : -1;
+#else    
     if (m_moduleVersion != compareVersion)
         return m_moduleVersion > compareVersion ? 1 : -1;
+#endif
+
     return 0;
 }
-#endif
 
 }
diff --git a/WebCore/plugins/PluginPackage.h b/WebCore/plugins/PluginPackage.h
index 2055391..c46c7eb 100644
--- a/WebCore/plugins/PluginPackage.h
+++ b/WebCore/plugins/PluginPackage.h
@@ -39,6 +39,11 @@
 #include <nativehelper/jni.h>
 #endif
 
+#if PLATFORM(SYMBIAN)
+class QPluginLoader;
+class NPInterface;
+#endif
+
 namespace WebCore {
     typedef HashMap<String, String> MIMEToDescriptionsMap;
     typedef HashMap<String, Vector<String> > MIMEToExtensionsMap;
@@ -73,9 +78,17 @@ namespace WebCore {
         int compare(const PluginPackage&) const;
         PluginQuirkSet quirks() const { return m_quirks; }
         const PlatformModuleVersion& version() const { return m_moduleVersion; }
+#if PLATFORM(SYMBIAN)
+        NPInterface* npInterface() const { return m_npInterface; }
+#endif // PLATFORM(SYMBIAN)
 
     private:
         PluginPackage(const String& path, const time_t& lastModified);
+
+#if PLATFORM(SYMBIAN)
+        NPInterface* m_npInterface;
+        QPluginLoader* m_pluginLoader;
+#endif // PLATFORM(SYMBIAN)
         bool fetchInfo();
         bool isPluginBlacklisted();
         void determineQuirks(const String& mimeType);
diff --git a/WebCore/plugins/PluginPackageNone.cpp b/WebCore/plugins/PluginPackageNone.cpp
index 487450a..b943d88 100644
--- a/WebCore/plugins/PluginPackageNone.cpp
+++ b/WebCore/plugins/PluginPackageNone.cpp
@@ -26,52 +26,20 @@
 #include "config.h"
 #include "PluginPackage.h"
 
-#include "CString.h"
-#include "MIMETypeRegistry.h"
-#include "NotImplemented.h"
-#include "npruntime_impl.h"
-#include "PluginDatabase.h"
-#include "PluginDebug.h"
-
 namespace WebCore {
 
 void PluginPackage::determineQuirks(const String&)
 {
-    notImplemented();
 }
 
 bool PluginPackage::fetchInfo()
 {
-    notImplemented();
     return false;
 }
 
 bool PluginPackage::load()
 {
-    notImplemented();
-    return false;
-}
-
-#if !ENABLE(PLUGIN_PACKAGE_SIMPLE_HASH)
-unsigned PluginPackage::hash() const
-{ 
-    notImplemented();
-
-    return 0;
-}
-
-bool PluginPackage::equal(const PluginPackage&, const PluginPackage&)
-{
-    notImplemented();
     return false;
 }
 
-int PluginPackage::compareFileVersion(const PlatformModuleVersion&) const
-{
-    notImplemented();
-    return 0;
-}
-
-#endif
-
 }
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index 13d8511..3632774 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -138,8 +138,8 @@ void PluginView::setFrameRect(const IntRect& rect)
 
     updatePluginWidget();
 
-#if PLATFORM(WIN_OS)
-    // On Windows, always call plugin to change geometry.
+#if PLATFORM(WIN_OS) || PLATFORM(SYMBIAN)
+    // On Windows and Symbian, always call plugin to change geometry.
     setNPWindowRect(rect);
 #elif XP_UNIX
     // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
@@ -162,6 +162,7 @@ void PluginView::handleEvent(Event* event)
         handleMouseEvent(static_cast<MouseEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
 #if defined(ANDROID_PLUGINS)
     else if (event->isTouchEvent())
         handleTouchEvent(static_cast<TouchEvent*>(event));
@@ -171,6 +172,9 @@ void PluginView::handleEvent(Event* event)
         handleFocusEvent(true);
 #endif
 #if defined(Q_WS_X11)
+=======
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
+>>>>>>> webkit.org at r50258.:WebCore/plugins/PluginView.cpp
     else if (event->type() == eventNames().DOMFocusOutEvent)
         handleFocusOutEvent();
     else if (event->type() == eventNames().DOMFocusInEvent)
@@ -426,7 +430,7 @@ static bool getString(ScriptController* proxy, JSValue result, String& string)
         return false;
     JSLock lock(JSC::SilenceAssertionsOnly);
 
-    ExecState* exec = proxy->globalObject()->globalExec();
+    ExecState* exec = proxy->globalObject(pluginWorld())->globalExec();
     UString ustring = result.toString(exec);
     exec->clearException();
 
@@ -486,7 +490,7 @@ void PluginView::performRequest(PluginRequest* request)
 #if USE(JSC)
     // Executing a script can cause the plugin view to be destroyed, so we keep a reference to the parent frame.
     RefPtr<Frame> parentFrame = m_parentFrame;
-    JSValue result = m_parentFrame->loader()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
+    JSValue result = m_parentFrame->script()->executeScript(jsString, request->shouldAllowPopups()).jsValue();
 
     if (targetFrameName.isNull()) {
         String resultString;
@@ -891,7 +895,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
 #endif
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
     , m_hasPendingGeometryChange(false)
     , m_drawable(0)
     , m_visual(0)
@@ -901,6 +905,8 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_loadManually(loadManually)
     , m_manualStream(0)
     , m_isJavaScriptPaused(false)
+    , m_isHalted(false)
+    , m_hasBeenHalted(false)
 {
 #if defined(ANDROID_PLUGINS)
     platformInit();
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index b385d41..c805352 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -72,6 +72,7 @@ class NPObject;
 namespace WebCore {
     class Element;
     class Frame;
+    class Image;
     class KeyboardEvent;
     class MouseEvent;
 #ifdef ANDROID_PLUGINS
@@ -222,6 +223,9 @@ namespace WebCore {
         virtual void restart();
         virtual Node* node() const;
 
+        bool isHalted() const { return m_isHalted; }
+        bool hasBeenHalted() const { return m_hasBeenHalted; }
+
         static bool isCallingPlugin();
 
 #ifdef ANDROID_PLUGINS
@@ -251,7 +255,7 @@ namespace WebCore {
         void invalidateWindowlessPluginRect(const IntRect&);
 
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
-        void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&) const;
+        void paintWindowedPluginIntoContext(GraphicsContext*, const IntRect&);
         static HDC WINAPI hookedBeginPaint(HWND, PAINTSTRUCT*);
         static BOOL WINAPI hookedEndPaint(HWND, const PAINTSTRUCT*);
 #endif
@@ -283,22 +287,32 @@ namespace WebCore {
 
         void handleKeyboardEvent(KeyboardEvent*);
         void handleMouseEvent(MouseEvent*);
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
         void handleFocusInEvent();
         void handleFocusOutEvent();
 #endif
 
+<<<<<<< HEAD:WebCore/plugins/PluginView.h
 #ifdef ANDROID_PLUGINS
         void handleFocusEvent(bool hasFocus);
         void handleTouchEvent(TouchEvent*);
         // called at the end of the base constructor
         void platformInit();
+=======
+#if PLATFORM(WIN_OS)
+        void paintIntoTransformedContext(HDC);
+        PassRefPtr<Image> snapshot();
+>>>>>>> webkit.org at r50258.:WebCore/plugins/PluginView.h
 #endif
+<<<<<<< HEAD:WebCore/plugins/PluginView.h
 #ifdef PLUGIN_PLATFORM_SETVALUE
         // called if the default setValue does not recognize the variable
         NPError platformSetValue(NPPVariable variable, void* value);
 #endif
         
+=======
+
+>>>>>>> webkit.org at r50258.:WebCore/plugins/PluginView.h
         int m_mode;
         int m_paramCount;
         char** m_paramNames;
@@ -358,7 +372,7 @@ public:
 
 private:
 
-#if defined(XP_UNIX) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11) || PLATFORM(SYMBIAN)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
@@ -371,7 +385,7 @@ private:
         Point globalMousePosForPlugin() const;
 #endif
 
-#if defined(Q_WS_X11)
+#if defined(Q_WS_X11) && ENABLE(NETSCAPE_PLUGIN_API)
         bool m_hasPendingGeometryChange;
         Pixmap m_drawable;
         Visual* m_visual;
@@ -389,6 +403,9 @@ private:
 
         bool m_isJavaScriptPaused;
 
+        bool m_isHalted;
+        bool m_hasBeenHalted;
+
         static PluginView* s_currentPluginView;
     };
 
diff --git a/WebCore/plugins/PluginViewNone.cpp b/WebCore/plugins/PluginViewNone.cpp
index d4601d4..725af82 100644
--- a/WebCore/plugins/PluginViewNone.cpp
+++ b/WebCore/plugins/PluginViewNone.cpp
@@ -26,114 +26,90 @@
 #include "config.h"
 #include "PluginView.h"
 
-#include "NotImplemented.h"
-#include "PluginPackage.h"
-
 using namespace WTF;
 
 namespace WebCore {
 
 void PluginView::setFocus()
 {
-    notImplemented();
 }
 
 void PluginView::show()
 {
-    notImplemented();
 }
 
 void PluginView::hide()
 {
-    notImplemented();
 }
 
 void PluginView::paint(GraphicsContext*, const IntRect&)
 {
-    notImplemented();
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent*)
 {
-    notImplemented();
 }
 
 void PluginView::handleMouseEvent(MouseEvent*)
 {
-    notImplemented();
 }
 
 void PluginView::setParent(ScrollView*)
 {
-    notImplemented();
 }
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    notImplemented();
 }
 
 NPError PluginView::handlePostReadFile(Vector<char>&, uint32, const char*)
 {
-    notImplemented();
-
     return 0;
 }
 
 NPError PluginView::getValue(NPNVariable, void*)
 {
-    notImplemented();
     return 0;
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 NPError PluginView::getValueStatic(NPNVariable variable, void* value)
 {
-    notImplemented();
     return 0;
 }
 #endif
 
 void PluginView::invalidateRect(NPRect*)
 {
-    notImplemented();
 }
 
 void PluginView::invalidateRect(const IntRect&)
 {
-    notImplemented();
 }
 
 void PluginView::invalidateRegion(NPRegion)
 {
-    notImplemented();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
 }
 
 bool PluginView::platformStart()
 {
-    notImplemented();
-
     return true;
 }
 
 void PluginView::platformDestroy()
 {
-    notImplemented();
 }
 
 void PluginView::setParentVisible(bool)
 {
-    notImplemented();
 }
 
 void PluginView::updatePluginWidget()
 {
-    notImplemented();
 }
 
 void PluginView::halt()
diff --git a/WebCore/plugins/mac/PluginPackageMac.cpp b/WebCore/plugins/mac/PluginPackageMac.cpp
index d242fb8..325bc4d 100644
--- a/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -159,7 +159,8 @@ bool PluginPackage::fetchInfo()
             plist = readPListFile(path.get(), /*createFile*/ true, m_module);
         }
 
-        mimeDict = (CFDictionaryRef)CFDictionaryGetValue(plist.get(), CFSTR("WebPluginMIMETypes"));
+        if (plist)
+            mimeDict = (CFDictionaryRef)CFDictionaryGetValue(plist.get(), CFSTR("WebPluginMIMETypes"));
     }
 
     if (!mimeDict)
diff --git a/WebCore/plugins/mac/PluginViewMac.cpp b/WebCore/plugins/mac/PluginViewMac.cpp
index 0ab91d1..6521c84 100644
--- a/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/WebCore/plugins/mac/PluginViewMac.cpp
@@ -174,8 +174,8 @@ bool PluginView::platformStart()
 
 #if PLATFORM(QT)
     if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
-        if (QWidget* window = QWidget::find(client->winId())) {
-            setPlatformPluginWidget(window);
+        if (QWidget* widget = client->ownerWidget()) {
+            setPlatformPluginWidget(widget);
         }
     }
 #endif
diff --git a/WebCore/plugins/qt/PluginContainerQt.cpp b/WebCore/plugins/qt/PluginContainerQt.cpp
index 59ab5bc..cb894a7 100644
--- a/WebCore/plugins/qt/PluginContainerQt.cpp
+++ b/WebCore/plugins/qt/PluginContainerQt.cpp
@@ -73,6 +73,7 @@ PluginContainerQt::PluginContainerQt(PluginView* view, QWidget* parent)
 PluginContainerQt::~PluginContainerQt()
 {
     delete m_clientWrapper;
+    m_pluginView->setPlatformPluginWidget(0);
 }
 
 void PluginContainerQt::on_clientClosed()
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index 27639e1..e61736b 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -107,10 +107,10 @@ void PluginView::updatePluginWidget()
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
         return;
 
-    if (m_drawable)
-        XFreePixmap(QX11Info::display(), m_drawable);
+    if (!m_isWindowed && m_windowRect.size() != oldWindowRect.size()) {
+        if (m_drawable)
+            XFreePixmap(QX11Info::display(), m_drawable);
 
-    if (!m_isWindowed) {
         m_drawable = XCreatePixmap(QX11Info::display(), QX11Info::appRootWindow(), m_windowRect.width(), m_windowRect.height(), 
                                    ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
         QApplication::syncX(); // make sure that the server knows about the Drawable
@@ -178,11 +178,20 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     const bool syncX = m_pluginDisplay && m_pluginDisplay != QX11Info::display();
 
     QPainter* painter = context->platformContext();
+    IntRect exposedRect(rect);
+    exposedRect.intersect(frameRect());
+    exposedRect.move(-frameRect().x(), -frameRect().y());
 
     QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
     const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
     ASSERT(drawableDepth == qtDrawable.depth());
 
+    // When printing, Qt uses a QPicture to capture the output in preview mode. The
+    // QPicture holds a reference to the X Pixmap. As a result, the print preview would
+    // update itself when the X Pixmap changes. To prevent this, we create a copy.
+    if (m_element->document()->printing())
+        qtDrawable = qtDrawable.copy();
+
     if (m_isTransparent && drawableDepth != 32) {
         // Attempt content propagation for drawable with no alpha by copying over from the backing store
         QPoint offset;
@@ -196,17 +205,17 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
         // (because backing store contents are already transformed). What we really mean to do 
         // here is to check if we are painting on QWebView, but let's be a little permissive :)
         QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-        const bool backingStoreHasUntransformedContents = qobject_cast<QWidget*>(client->pluginParent());
+        const bool backingStoreHasUntransformedContents = client && qobject_cast<QWidget*>(client->pluginParent());
 
         if (hasValidBackingStore && backingStorePixmap->depth() == drawableDepth 
             && backingStoreHasUntransformedContents) {
             GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
             XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
-                offset.x() + m_windowRect.x() + m_clipRect.x(), offset.y() + m_windowRect.y() + m_clipRect.y(),
-                m_clipRect.width(), m_clipRect.height(), m_clipRect.x(), m_clipRect.y());
+                offset.x() + m_windowRect.x() + exposedRect.x(), offset.y() + m_windowRect.y() + exposedRect.y(),
+                exposedRect.width(), exposedRect.height(), exposedRect.x(), exposedRect.y());
         } else { // no backing store, clean the pixmap because the plugin thinks its transparent
             QPainter painter(&qtDrawable);
-            painter.fillRect(m_clipRect, Qt::white);
+            painter.fillRect(exposedRect, Qt::white);
         }
 
         if (syncX)
@@ -218,19 +227,19 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
     exposeEvent.type = GraphicsExpose;
     exposeEvent.display = QX11Info::display();
-    exposeEvent.drawable = m_drawable;
-    exposeEvent.x = m_clipRect.x();
-    exposeEvent.y = m_clipRect.y();
-    exposeEvent.width = m_clipRect.x() + m_clipRect.width(); // flash bug? it thinks width is the right
-    exposeEvent.height = m_clipRect.y() + m_clipRect.height(); // flash bug? it thinks height is the bottom
+    exposeEvent.drawable = qtDrawable.handle();
+    exposeEvent.x = exposedRect.x();
+    exposeEvent.y = exposedRect.y();
+    exposeEvent.width = exposedRect.x() + exposedRect.width(); // flash bug? it thinks width is the right in transparent mode
+    exposeEvent.height = exposedRect.y() + exposedRect.height(); // flash bug? it thinks height is the bottom in transparent mode
 
     dispatchNPEvent(xevent);
 
     if (syncX)
         XSync(m_pluginDisplay, False); // sync changes by plugin
 
-    painter->drawPixmap(frameRect().x() + m_clipRect.x(), frameRect().y() + m_clipRect.y(), qtDrawable,
-        m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height());
+    painter->drawPixmap(QPoint(frameRect().x() + exposedRect.x(), frameRect().y() + exposedRect.y()), qtDrawable,
+                        exposedRect);
 }
 
 // TODO: Unify across ports.
@@ -240,24 +249,24 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
         return false;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(false);
-
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
     bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
     setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
 
     return accepted;
 }
 
-void setSharedXEventFields(XEvent* xEvent, QWidget* hostWindow)
+void setSharedXEventFields(XEvent* xEvent, QWidget* ownerWidget)
 {
     xEvent->xany.serial = 0; // we are unaware of the last request processed by X Server
     xEvent->xany.send_event = false;
-    xEvent->xany.display = hostWindow->x11Info().display();
+    xEvent->xany.display = QX11Info::display();
     // NOTE: event->xany.window doesn't always respond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
-    xEvent->xany.window = hostWindow->window()->handle();
+    xEvent->xany.window = ownerWidget ? ownerWidget->window()->handle() : 0;
 }
 
 void PluginView::initXEvent(XEvent* xEvent)
@@ -265,8 +274,8 @@ void PluginView::initXEvent(XEvent* xEvent)
     memset(xEvent, 0, sizeof(XEvent));
 
     QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-    QWidget* window = QWidget::find(client->winId());
-    setSharedXEventFields(xEvent, window);
+    QWidget* ownerWidget = client ? client->ownerWidget() : 0;
+    setSharedXEventFields(xEvent, ownerWidget);
 }
 
 void setXKeyEventSpecificFields(XEvent* xEvent, KeyboardEvent* event)
@@ -458,16 +467,23 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
         return;
 
+    // If the plugin didn't load sucessfully, no point in calling setwindow
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return;
+
     // On Unix, only call plugin if it's full-page or windowed
     if (m_mode != NP_FULL && m_mode != NP_EMBED)
         return;
 
+    // Check if the platformPluginWidget still exists
+    if (m_isWindowed && !platformPluginWidget())
+        return;
+
     if (!m_hasPendingGeometryChange)
         return;
     m_hasPendingGeometryChange = false;
 
     if (m_isWindowed) {
-        ASSERT(platformPluginWidget());
         platformPluginWidget()->setGeometry(m_windowRect);
         // if setMask is set with an empty QRegion, no clipping will
         // be performed, so in that case we hide the plugin view
@@ -577,13 +593,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVxDisplay:
-        if (platformPluginWidget())
-            *(void **)value = platformPluginWidget()->x11Info().display();
-        else {
-            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-            QWidget* window = QWidget::find(client->winId());
-            *(void **)value = window->x11Info().display();
-        }
+        *(void **)value = QX11Info::display();
         return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
@@ -628,7 +638,8 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
-        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformPageClient()->winId();
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        *((XID *)w) = client ? client->ownerWidget()->window()->winId() : 0;
         return NPERR_NO_ERROR;
     }
 
@@ -659,7 +670,7 @@ void PluginView::invalidateRect(NPRect* rect)
         invalidate();
         return;
     }
-    IntRect r(rect->left, rect->top, rect->right + rect->left, rect->bottom + rect->top);
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
     invalidateWindowlessPluginRect(r);
 }
 
@@ -754,9 +765,9 @@ bool PluginView::platformStart()
     }
 
     if (m_isWindowed) {
-        if (m_needsXEmbed) {
-            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
-            setPlatformWidget(new PluginContainerQt(this, QWidget::find(client->winId())));
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        if (m_needsXEmbed && client) {
+            setPlatformWidget(new PluginContainerQt(this, client->ownerWidget()));
             // sync our XEmbed container window creation before sending the xid to plugins.
             QApplication::syncX();
         } else {
diff --git a/WebCore/plugins/symbian/PluginContainerSymbian.cpp b/WebCore/plugins/symbian/PluginContainerSymbian.cpp
new file mode 100644
index 0000000..aece0e4
--- /dev/null
+++ b/WebCore/plugins/symbian/PluginContainerSymbian.cpp
@@ -0,0 +1,77 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "PluginContainerSymbian.h"
+
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PluginView.h"
+
+#include <QApplication>
+#include <QWidget>
+
+using namespace WebCore;
+
+PluginContainerSymbian::PluginContainerSymbian(PluginView* view, QWidget* parent)
+    : m_parent(parent)
+    , m_pluginView(view)
+    , m_hasPendingGeometryChange(false)
+{
+    setParent(m_parent);
+}
+
+PluginContainerSymbian::~PluginContainerSymbian()
+{
+}
+
+void PluginContainerSymbian::requestGeometry(const QRect& rect, const QRegion& clip)
+{
+    if (m_windowRect != rect || m_clipRegion != clip) {
+        m_windowRect = rect;
+        m_clipRegion = clip;
+        m_hasPendingGeometryChange = true;
+    }
+}
+
+void PluginContainerSymbian::adjustGeometry()
+{
+    if (m_hasPendingGeometryChange) {
+        setGeometry(m_windowRect);
+        setMask(m_clipRegion);
+        m_hasPendingGeometryChange = false;
+    }
+}
+
+void PluginContainerSymbian::focusInEvent(QFocusEvent* event)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(true);
+
+    m_pluginView->focusPluginElement();
+}
+
+void PluginContainerSymbian::focusOutEvent(QFocusEvent*)
+{
+    if (Page* page = m_pluginView->parentFrame()->page())
+        page->focusController()->setActive(false);
+}
diff --git a/WebCore/plugins/symbian/PluginContainerSymbian.h b/WebCore/plugins/symbian/PluginContainerSymbian.h
new file mode 100644
index 0000000..fce4a71
--- /dev/null
+++ b/WebCore/plugins/symbian/PluginContainerSymbian.h
@@ -0,0 +1,50 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef PluginContainerSymbian_h
+#define PluginContainerSymbian_h
+
+#include <QWidget>
+
+namespace WebCore {
+
+    class PluginView;
+
+    class PluginContainerSymbian : public QWidget {
+        Q_OBJECT
+    public:
+        PluginContainerSymbian(PluginView*, QWidget* parent);
+        ~PluginContainerSymbian();
+
+        void requestGeometry(const QRect&, const QRegion& clip = QRegion());
+        void adjustGeometry();
+
+    protected:
+        virtual void focusInEvent(QFocusEvent*);
+        virtual void focusOutEvent(QFocusEvent*);
+    private:
+        PluginView* m_pluginView;
+        QWidget* m_parent;
+        QRect m_windowRect;
+        QRegion m_clipRegion;
+        bool m_hasPendingGeometryChange;
+    };
+}
+
+#endif // PluginContainerSymbian_h
diff --git a/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp b/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp
new file mode 100644
index 0000000..2e09296
--- /dev/null
+++ b/WebCore/plugins/symbian/PluginDatabaseSymbian.cpp
@@ -0,0 +1,79 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginDatabase.h"
+
+#include <QFileInfo>
+#include <f32file.h>
+
+static const char QTPLUGIN_FILTER[] = "*.qtplugin";
+static const char QT_PLUGIN_FOLDER[] = ":\\resource\\qt\\plugins\\npqtplugins\\";
+
+namespace WebCore {
+
+Vector<String> PluginDatabase::defaultPluginDirectories()
+{
+    Vector<String> directories;
+    //find the installation drive
+    TDriveList drivelist;
+    TChar driveLetter;
+    RFs fsSession;
+    
+    if (fsSession.Connect() == KErrNone && fsSession.DriveList(drivelist) == KErrNone) {
+        for (TInt driveNumber = EDriveA; driveNumber <= EDriveZ; driveNumber++) {
+            if (drivelist[driveNumber] && fsSession.DriveToChar(driveNumber, driveLetter) == KErrNone) {
+                QString driveStringValue(QChar((uint)driveLetter.GetUpperCase()));
+                QString stubDirPath;
+                stubDirPath.append(driveStringValue);
+                stubDirPath.append(QT_PLUGIN_FOLDER);
+                if (QFileInfo(stubDirPath).exists())
+                    directories.append(stubDirPath);
+            }
+        }
+    }
+
+    fsSession.Close();
+    return directories;
+}
+
+bool PluginDatabase::isPreferredPluginDirectory(const String& path)
+{
+    return true;
+}
+
+void PluginDatabase::getPluginPathsInDirectories(HashSet<String>& paths) const
+{
+    // FIXME: This should be a case insensitive set.
+    HashSet<String> uniqueFilenames;
+
+    String fileNameFilter(QTPLUGIN_FILTER);
+
+    Vector<String>::const_iterator dirsEnd = m_pluginDirectories.end();
+    for (Vector<String>::const_iterator dIt = m_pluginDirectories.begin(); dIt != dirsEnd; ++dIt) {
+        Vector<String> pluginPaths = listDirectory(*dIt, fileNameFilter);
+        Vector<String>::const_iterator pluginsEnd = pluginPaths.end();
+        for (Vector<String>::const_iterator pIt = pluginPaths.begin(); pIt != pluginsEnd; ++pIt) {
+            if (!fileExists(*pIt))
+                continue;
+            paths.add(*pIt);
+        }
+    }
+}
+
+}
diff --git a/WebCore/plugins/symbian/PluginPackageSymbian.cpp b/WebCore/plugins/symbian/PluginPackageSymbian.cpp
new file mode 100644
index 0000000..d5c7533
--- /dev/null
+++ b/WebCore/plugins/symbian/PluginPackageSymbian.cpp
@@ -0,0 +1,177 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginPackage.h"
+
+#include "CString.h"
+#include "MIMETypeRegistry.h"
+#include "npinterface.h"
+#include "npruntime_impl.h"
+#include "PluginDatabase.h"
+#include "PluginDebug.h"
+#include <QPluginLoader>
+
+namespace WebCore {
+
+bool PluginPackage::fetchInfo()
+{
+    if (!load())
+        return false;
+
+    char* buf = 0;
+    NPError err = m_pluginFuncs.getvalue(0, NPPVpluginNameString, (void *)&buf);
+    m_name = buf;
+    err = m_pluginFuncs.getvalue(0, NPPVpluginDescriptionString, (void *)&buf);
+    m_description = buf;
+
+    determineModuleVersionFromDescription();
+
+    String s = m_npInterface->NP_GetMIMEDescription();
+    Vector<String> types;
+    s.split(UChar('|'), false, types);  // <MIME1>;<ext1,ext2,ext3,...>;<Description>|<MIME2>|<MIME3>|...
+
+    for (int i = 0; i < types.size(); ++i) {
+        Vector<String> mime;
+        types[i].split(UChar(';'), true, mime);  // <MIME1>;<ext1,ext2,ext3,...>;<Description>
+        if (mime.size() > 0) {
+            Vector<String> exts;
+            if (mime.size() > 1)
+                mime[1].split(UChar(','), false, exts); // <ext1,ext2,ext3,...>
+            
+            m_mimeToExtensions.add(mime[0], exts); // <MIME>,<ext1,ext2,ext3>
+            if (mime.size() > 2)
+                m_mimeToDescriptions.add(mime[0], mime[2]); // <MIME>,<Description>
+        }
+    }
+    unload();
+    return true;
+}
+
+bool PluginPackage::load()
+{
+    if (m_isLoaded) {
+        m_loadCount++;
+        return true;
+    }
+
+    m_pluginLoader = new QPluginLoader(m_path);
+    if (!m_pluginLoader->load()) {
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    QObject* plugin = m_pluginLoader->instance();
+    if (!plugin) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    // Plugin instance created
+    // Cast plugin to NPInterface,
+    m_npInterface = qobject_cast<NPInterface*>(plugin);
+    if (!m_npInterface) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    m_isLoaded = true;
+    
+    NPError npErr;
+    memset(&m_pluginFuncs, 0, sizeof(m_pluginFuncs));
+    m_pluginFuncs.size = sizeof(m_pluginFuncs);
+    m_browserFuncs.size = sizeof(m_browserFuncs);
+    m_browserFuncs.version = NP_VERSION_MINOR;
+    m_browserFuncs.geturl = NPN_GetURL;
+    m_browserFuncs.posturl = NPN_PostURL;
+    m_browserFuncs.requestread = NPN_RequestRead;
+    m_browserFuncs.newstream = NPN_NewStream;
+    m_browserFuncs.write = NPN_Write;
+    m_browserFuncs.destroystream = NPN_DestroyStream;
+    m_browserFuncs.status = NPN_Status;
+    m_browserFuncs.uagent = NPN_UserAgent;
+    m_browserFuncs.memalloc = NPN_MemAlloc;
+    m_browserFuncs.memfree = NPN_MemFree;
+    m_browserFuncs.memflush = NPN_MemFlush;
+    m_browserFuncs.reloadplugins = NPN_ReloadPlugins;
+    m_browserFuncs.geturlnotify = NPN_GetURLNotify;
+    m_browserFuncs.posturlnotify = NPN_PostURLNotify;
+    m_browserFuncs.getvalue = NPN_GetValue;
+    m_browserFuncs.setvalue = NPN_SetValue;
+    m_browserFuncs.invalidaterect = NPN_InvalidateRect;
+    m_browserFuncs.invalidateregion = NPN_InvalidateRegion;
+    m_browserFuncs.forceredraw = NPN_ForceRedraw;
+    m_browserFuncs.getJavaEnv = NPN_GetJavaEnv;
+    m_browserFuncs.getJavaPeer = NPN_GetJavaPeer;
+    m_browserFuncs.pushpopupsenabledstate = NPN_PushPopupsEnabledState;
+    m_browserFuncs.poppopupsenabledstate = NPN_PopPopupsEnabledState;
+    m_browserFuncs.releasevariantvalue = _NPN_ReleaseVariantValue;
+    m_browserFuncs.getstringidentifier = _NPN_GetStringIdentifier;
+    m_browserFuncs.getstringidentifiers = _NPN_GetStringIdentifiers;
+    m_browserFuncs.getintidentifier = _NPN_GetIntIdentifier;
+    m_browserFuncs.identifierisstring = _NPN_IdentifierIsString;
+    m_browserFuncs.utf8fromidentifier = _NPN_UTF8FromIdentifier;
+    m_browserFuncs.createobject = _NPN_CreateObject;
+    m_browserFuncs.retainobject = _NPN_RetainObject;
+    m_browserFuncs.releaseobject = _NPN_ReleaseObject;
+    m_browserFuncs.invoke = _NPN_Invoke;
+    m_browserFuncs.invokeDefault = _NPN_InvokeDefault;
+    m_browserFuncs.evaluate = _NPN_Evaluate;
+    m_browserFuncs.getproperty = _NPN_GetProperty;
+    m_browserFuncs.setproperty = _NPN_SetProperty;
+    m_browserFuncs.removeproperty = _NPN_RemoveProperty;
+    m_browserFuncs.hasproperty = _NPN_HasMethod;
+    m_browserFuncs.hasmethod = _NPN_HasProperty;
+    m_browserFuncs.setexception = _NPN_SetException;
+    m_browserFuncs.enumerate = _NPN_Enumerate;
+    m_browserFuncs.construct = _NPN_Construct;
+
+    npErr = m_npInterface->NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
+    if (npErr != NPERR_NO_ERROR) {
+        m_pluginLoader->unload();
+        delete m_pluginLoader;
+        m_pluginLoader = 0;
+        return false;
+    }
+
+    m_loadCount++;
+    return true;
+}
+
+void PluginPackage::unload()
+{
+    if (!m_isLoaded)
+        return;
+
+    if (--m_loadCount > 0)
+        return;
+        
+    m_isLoaded = false;
+    m_npInterface->NP_Shutdown();
+
+    m_pluginLoader->unload();
+    delete m_pluginLoader;
+    m_pluginLoader = 0;
+}
+}
+
diff --git a/WebCore/plugins/symbian/PluginViewSymbian.cpp b/WebCore/plugins/symbian/PluginViewSymbian.cpp
new file mode 100644
index 0000000..14e25b1
--- /dev/null
+++ b/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -0,0 +1,462 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "config.h"
+#include "PluginView.h"
+
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Element.h"
+#include "FocusController.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "Image.h"
+#include "JSDOMBinding.h"
+#include "KeyboardEvent.h"
+#include "MouseEvent.h"
+#include "NotImplemented.h"
+#include "npfunctions.h"
+#include "npinterface.h"
+#include "Page.h"
+#include "PlatformKeyboardEvent.h"
+#include "PlatformMouseEvent.h"
+#include "PluginContainerSymbian.h"
+#include "PluginDebug.h"
+#include "PluginMainThreadScheduler.h"
+#include "PluginPackage.h"
+#include "RenderLayer.h"
+#include "ScriptController.h"
+#include "Settings.h"
+#include "npruntime_impl.h"
+#include "runtime.h"
+#include "runtime_root.h"
+#include "QWebPageClient.h"
+#include <QKeyEvent>
+#include <QPixmap.h>
+#include <QRegion>
+#include <QVector>
+#include <QWidget>
+#include <runtime/JSLock.h>
+#include <runtime/JSValue.h>
+
+using JSC::ExecState;
+using JSC::Interpreter;
+using JSC::JSLock;
+using JSC::JSObject;
+using JSC::UString;
+
+using namespace std;
+
+using namespace WTF;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void PluginView::updatePluginWidget()
+{
+    if (!parent())
+        return;
+    ASSERT(parent()->isFrameView());
+    FrameView* frameView = static_cast<FrameView*>(parent());
+    IntRect oldWindowRect = m_windowRect;
+    IntRect oldClipRect = m_clipRect;
+    
+    m_windowRect = IntRect(frameView->contentsToWindow(frameRect().location()), frameRect().size());
+    m_clipRect = windowClipRect();
+    m_clipRect.move(-m_windowRect.x(), -m_windowRect.y());
+    if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
+        return;
+
+    // in order to move/resize the plugin window at the same time as the rest of frame
+    // during e.g. scrolling, we set the mask and geometry in the paint() function, but
+    // as paint() isn't called when the plugin window is outside the frame which can
+    // be caused by a scroll, we need to move/resize immediately.
+    if (!m_windowRect.intersects(frameView->frameRect()))
+        setNPWindowIfNeeded();
+}
+
+void PluginView::setFocus()
+{
+    if (platformPluginWidget())
+        platformPluginWidget()->setFocus(Qt::OtherFocusReason);
+    else
+        Widget::setFocus();
+}
+
+void PluginView::show()
+{
+    setSelfVisible(true);
+
+    if (isParentVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(true);
+}
+
+void PluginView::hide()
+{
+    setSelfVisible(false);
+
+    if (isParentVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(false);
+}
+
+void PluginView::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!m_isStarted) {
+        paintMissingPluginIcon(context, rect);
+        return;
+    }
+    
+    if (context->paintingDisabled())
+        return;
+    m_npWindow.ws_info = (void*)(context->platformContext());
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed && platformPluginWidget())
+        static_cast<PluginContainerSymbian*>(platformPluginWidget())->adjustGeometry();
+
+    if (m_isWindowed)
+        return;
+
+    context->save();
+    IntRect clipRect(rect);
+    clipRect.intersect(frameRect());
+    context->clip(clipRect);
+    context->translate(frameRect().location().x(), frameRect().location().y());
+
+    QPaintEvent ev(rect);
+    QEvent& npEvent = ev;
+    dispatchNPEvent(npEvent);
+
+    context->restore();
+}
+
+// TODO: Unify across ports.
+bool PluginView::dispatchNPEvent(NPEvent& event)
+{
+    if (!m_plugin->pluginFuncs()->event)
+        return false;
+
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+
+    setCallingPlugin(true);
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+
+    return accepted;
+}
+
+void PluginView::handleKeyboardEvent(KeyboardEvent* event)
+{
+    if (m_isWindowed)
+        return;
+
+    QEvent& npEvent = *(event->keyEvent()->qtEvent());
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleMouseEvent(MouseEvent* event)
+{
+    if (m_isWindowed)
+        return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    QEvent::Type type;
+    if (event->type() == eventNames().mousedownEvent)
+        type = QEvent::MouseButtonPress;
+    else if (event->type() == eventNames().mousemoveEvent)
+        type = QEvent::MouseMove;
+    else if (event->type() == eventNames().mouseupEvent)
+        type = QEvent::MouseButtonRelease;
+    else
+        return;
+
+    QPoint position(event->offsetX(), event->offsetY());
+    Qt::MouseButton button;
+    switch (event->which()) {
+    case 1:
+        button = Qt::LeftButton;
+        break;
+    case 2:
+        button = Qt::MidButton;
+        break;
+    case 3:
+        button = Qt::RightButton;
+        break;
+    default:
+        button = Qt::NoButton;
+    }
+    Qt::KeyboardModifiers modifiers = 0;
+    if (event->ctrlKey())
+        modifiers |= Qt::ControlModifier;
+    if (event->altKey())
+        modifiers |= Qt::AltModifier;
+    if (event->shiftKey())
+        modifiers |= Qt::ShiftModifier;
+    if (event->metaKey())
+        modifiers |= Qt::MetaModifier;
+    QMouseEvent mouseEvent(type, position, button, button, modifiers); 
+    QEvent& npEvent = mouseEvent;
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::setParent(ScrollView* parent)
+{
+    Widget::setParent(parent);
+
+    if (parent)
+        init();
+}
+
+void PluginView::setNPWindowRect(const IntRect&)
+{
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
+}
+
+void PluginView::setNPWindowIfNeeded()
+{
+    if (!m_isStarted || !parent() || !m_plugin->pluginFuncs()->setwindow)
+        return;
+    if (m_isWindowed) {
+        ASSERT(platformPluginWidget());
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    
+    } else {
+        // always call this method before painting.
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+    
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = m_windowRect.width();
+        m_npWindow.clipRect.bottom = m_windowRect.height();
+        m_npWindow.window = 0;
+    }
+
+    m_npWindow.width = m_windowRect.width();
+    m_npWindow.height = m_windowRect.height();
+    if (m_npWindow.x < 0 || m_npWindow.y < 0 || m_npWindow.width <= 0 || m_npWindow.height <= 0)
+        return;
+    
+    PluginView::setCurrentPluginView(this);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    setCallingPlugin(true);
+    m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
+    setCallingPlugin(false);
+    PluginView::setCurrentPluginView(0);
+}
+
+void PluginView::setParentVisible(bool visible)
+{
+    if (isParentVisible() == visible)
+        return;
+
+    Widget::setParentVisible(visible);
+
+    if (isSelfVisible() && platformPluginWidget())
+        platformPluginWidget()->setVisible(visible);
+}
+
+NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const char* buf)
+{
+    notImplemented();
+    return NPERR_NO_ERROR;
+}
+
+NPError PluginView::getValueStatic(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValueStatic(%s)", prettyNameForNPNVariable(variable).data());
+
+    switch (variable) {
+    case NPNVjavascriptEnabledBool:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
+    default:
+        return NPERR_GENERIC_ERROR;
+    }
+}
+
+NPError PluginView::getValue(NPNVariable variable, void* value)
+{
+    LOG(Plugins, "PluginView::getValue(%s)", prettyNameForNPNVariable(variable).data());
+
+    switch (variable) {
+    case NPNVWindowNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* windowScriptObject = m_parentFrame->script()->windowScriptNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (windowScriptObject)
+            _NPN_RetainObject(windowScriptObject);
+
+        void** v = (void**)value;
+        *v = windowScriptObject;
+            
+        return NPERR_NO_ERROR;
+    }
+
+    case NPNVPluginElementNPObject: {
+        if (m_isJavaScriptPaused)
+            return NPERR_GENERIC_ERROR;
+
+        NPObject* pluginScriptObject = 0;
+
+        if (m_element->hasTagName(appletTag) || m_element->hasTagName(embedTag) || m_element->hasTagName(objectTag))
+            pluginScriptObject = static_cast<HTMLPlugInElement*>(m_element)->getNPObject();
+
+        // Return value is expected to be retained, as described here: <http://www.mozilla.org/projects/plugin/npruntime.html>
+        if (pluginScriptObject)
+            _NPN_RetainObject(pluginScriptObject);
+
+        void** v = (void**)value;
+        *v = pluginScriptObject;
+
+        return NPERR_NO_ERROR;
+    }        
+    default:
+        return getValueStatic(variable, value);
+    }
+}
+
+void PluginView::invalidateRect(const IntRect& rect)
+{
+    if (m_isWindowed) {
+        platformWidget()->update(rect);
+        return;
+    }
+    
+    invalidateWindowlessPluginRect(rect);
+}
+    
+void PluginView::invalidateRect(NPRect* rect)
+{
+    if (m_isWindowed)
+        return;
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
+    m_invalidRects.append(r);
+    if (!m_invalidateTimer.isActive())
+        m_invalidateTimer.startOneShot(0.001);
+}
+
+void PluginView::invalidateRegion(NPRegion region)
+{
+    if (m_isWindowed)
+        return;
+    
+    if (!region) 
+        return;
+    
+    QVector<QRect> rects = region->rects();
+    for (int i = 0; i < rects.size(); ++i) {
+        const QRect& qRect = rects.at(i);
+        m_invalidRects.append(qRect);
+        if (!m_invalidateTimer.isActive())
+            m_invalidateTimer.startOneShot(0.001);
+    }
+}
+
+void PluginView::forceRedraw()
+{
+    if (m_isWindowed)
+        return;
+    invalidate();
+}
+
+bool PluginView::platformStart()
+{
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
+    
+    show();
+
+    if (m_isWindowed) {
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        // FIXME this will not work for QGraphicsView.
+        // But we cannot use winId because it will create a window and on S60,
+        // QWidgets should not create a window. 
+        Q_ASSERT(qobject_cast<QWidget*>(client->pluginParent()));
+        setPlatformWidget(new PluginContainerSymbian(this, 
+            qobject_cast<QWidget*>(client->pluginParent())));
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget();
+
+    } else {
+        setPlatformWidget(0);
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+    }    
+    setNPWindowIfNeeded();
+    
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    delete platformPluginWidget();
+}
+
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
+{
+}
+
+} // namespace WebCore
diff --git a/WebCore/plugins/symbian/npinterface.h b/WebCore/plugins/symbian/npinterface.h
new file mode 100644
index 0000000..0f0b6ca
--- /dev/null
+++ b/WebCore/plugins/symbian/npinterface.h
@@ -0,0 +1,37 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef npinterface_H
+#define npinterface_H
+
+#include "npfunctions.h"
+#include <QtPlugin>
+
+class NPInterface {
+public:
+    virtual NPError NP_Initialize(NPNetscapeFuncs* aNPNFuncs, NPPluginFuncs* aNPPFuncs) = 0;
+    virtual void NP_Shutdown() = 0;
+    virtual char* NP_GetMIMEDescription() = 0;
+};
+
+
+QT_BEGIN_NAMESPACE
+Q_DECLARE_INTERFACE(NPInterface, "com.nokia.qts60.webplugin/1.0");
+QT_END_NAMESPACE
+
+#endif // npinterface_H
diff --git a/WebCore/plugins/win/PluginPackageWin.cpp b/WebCore/plugins/win/PluginPackageWin.cpp
index e6fb9d5..dc9ec17 100644
--- a/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/WebCore/plugins/win/PluginPackageWin.cpp
@@ -56,17 +56,6 @@ static String getVersionInfo(const LPVOID versionInfoData, const String& info)
     return String(reinterpret_cast<UChar*>(buffer), bufferLength - 1);
 }
 
-int PluginPackage::compareFileVersion(const PlatformModuleVersion& compareVersion) const
-{
-    // return -1, 0, or 1 if plug-in version is less than, equal to, or greater than
-    // the passed version
-    if (m_moduleVersion.mostSig != compareVersion.mostSig)
-        return m_moduleVersion.mostSig > compareVersion.mostSig ? 1 : -1;
-    if (m_moduleVersion.leastSig != compareVersion.leastSig)
-        return m_moduleVersion.leastSig > compareVersion.leastSig ? 1 : -1;
-    return 0;
-}
-
 bool PluginPackage::isPluginBlacklisted()
 {
     if (name() == "Citrix ICA Client") {
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index ccbf6f8..5ccce0e 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -30,6 +30,7 @@
 #include "PluginView.h"
 
 #include "BitmapImage.h"
+#include "BitmapInfo.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -77,6 +78,7 @@
 
 #if PLATFORM(QT)
 #include "QWebPageClient.h"
+#include <QWidget>
 #endif
 
 static inline HWND windowHandleForPageClient(PlatformPageClient client)
@@ -84,7 +86,7 @@ static inline HWND windowHandleForPageClient(PlatformPageClient client)
 #if PLATFORM(QT)
     if (!client)
         return 0;
-    return client->winId();
+    return client->ownerWidget()->winId();
 #else
     return client;
 #endif
@@ -494,7 +496,54 @@ bool PluginView::dispatchNPEvent(NPEvent& npEvent)
     return result;
 }
 
-void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const IntRect& rect) const
+void PluginView::paintIntoTransformedContext(HDC hdc)
+{
+    if (m_isWindowed) {
+        SendMessage(platformPluginWidget(), WM_PRINTCLIENT, reinterpret_cast<WPARAM>(hdc), PRF_CLIENT | PRF_CHILDREN | PRF_OWNED);
+        return;
+    }
+
+    m_npWindow.type = NPWindowTypeDrawable;
+    m_npWindow.window = hdc;
+
+    WINDOWPOS windowpos = { 0 };
+
+#if PLATFORM(WINCE)
+    IntRect r = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
+
+    windowpos.x = r.x();
+    windowpos.y = r.y();
+    windowpos.cx = r.width();
+    windowpos.cy = r.height();
+#else
+    IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(frameRect().location());
+
+    windowpos.x = p.x();
+    windowpos.y = p.y();
+    windowpos.cx = frameRect().width();
+    windowpos.cy = frameRect().height();
+#endif
+
+    NPEvent npEvent;
+    npEvent.event = WM_WINDOWPOSCHANGED;
+    npEvent.lParam = reinterpret_cast<uint32>(&windowpos);
+    npEvent.wParam = 0;
+
+    dispatchNPEvent(npEvent);
+
+    setNPWindowRect(frameRect());
+
+    npEvent.event = WM_PAINT;
+    npEvent.wParam = reinterpret_cast<uint32>(hdc);
+
+    // This is supposed to be a pointer to the dirty rect, but it seems that the Flash plugin
+    // ignores it so we just pass null.
+    npEvent.lParam = 0;
+
+    dispatchNPEvent(npEvent);
+}
+
+void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const IntRect& rect)
 {
 #if !PLATFORM(WINCE)
     ASSERT(m_isWindowed);
@@ -516,7 +565,7 @@ void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const
 
     SetWorldTransform(hdc, &transform);
 
-    SendMessage(platformPluginWidget(), WM_PRINTCLIENT, reinterpret_cast<WPARAM>(hdc), PRF_CLIENT | PRF_CHILDREN | PRF_OWNED);
+    paintIntoTransformedContext(hdc);
 
     SetWorldTransform(hdc, &originalTransform);
 
@@ -546,7 +595,6 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     ASSERT(parent()->isFrameView());
     IntRect rectInWindow = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
     HDC hdc = context->getWindowsContext(rectInWindow, m_isTransparent);
-    NPEvent npEvent;
 
     // On Safari/Windows without transparency layers the GraphicsContext returns the HDC
     // of the window and the plugin expects that the passed in DC has window coordinates.
@@ -562,44 +610,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     }
 #endif
 
-    m_npWindow.type = NPWindowTypeDrawable;
-    m_npWindow.window = hdc;
-
-    WINDOWPOS windowpos;
-    memset(&windowpos, 0, sizeof(windowpos));
-
-#if PLATFORM(WINCE)
-    IntRect r = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
-
-    windowpos.x = r.x();
-    windowpos.y = r.y();
-    windowpos.cx = r.width();
-    windowpos.cy = r.height();
-#else
-    IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(frameRect().location());
-
-    windowpos.x = p.x();
-    windowpos.y = p.y();
-    windowpos.cx = frameRect().width();
-    windowpos.cy = frameRect().height();
-#endif
-
-    npEvent.event = WM_WINDOWPOSCHANGED;
-    npEvent.lParam = reinterpret_cast<uint32>(&windowpos);
-    npEvent.wParam = 0;
-
-    dispatchNPEvent(npEvent);
-
-    setNPWindowRect(frameRect());
-
-    npEvent.event = WM_PAINT;
-    npEvent.wParam = reinterpret_cast<uint32>(hdc);
-
-    // This is supposed to be a pointer to the dirty rect, but it seems that the Flash plugin
-    // ignores it so we just pass null.
-    npEvent.lParam = 0;
-
-    dispatchNPEvent(npEvent);
+    paintIntoTransformedContext(hdc);
 
     context->releaseWindowsContext(hdc, frameRect(), m_isTransparent);
 }
@@ -1017,14 +1028,52 @@ void PluginView::platformDestroy()
     setPlatformPluginWidget(0);
 }
 
+PassRefPtr<Image> PluginView::snapshot()
+{
+    OwnPtr<HDC> hdc(CreateCompatibleDC(0));
+
+    if (!m_isWindowed) {
+        // Enable world transforms.
+        SetGraphicsMode(hdc.get(), GM_ADVANCED);
+
+        XFORM transform;
+        GetWorldTransform(hdc.get(), &transform);
+
+        // Windowless plug-ins assume that they're drawing onto the view's DC.
+        // Translate the context so that the plug-in draws at (0, 0).
+        ASSERT(parent()->isFrameView());
+        IntPoint position = static_cast<FrameView*>(parent())->contentsToWindow(frameRect()).location();
+        transform.eDx = -position.x();
+        transform.eDy = -position.y();
+        SetWorldTransform(hdc.get(), &transform);
+    }
+
+    void* bits;
+    BitmapInfo bmp = BitmapInfo::createBottomUp(frameRect().size());
+    OwnPtr<HBITMAP> hbmp(CreateDIBSection(0, &bmp, DIB_RGB_COLORS, &bits, 0, 0));
+
+    HBITMAP hbmpOld = static_cast<HBITMAP>(SelectObject(hdc.get(), hbmp.get()));
+
+    paintIntoTransformedContext(hdc.get());
+
+    SelectObject(hdc.get(), hbmpOld);
+
+    return BitmapImage::create(hbmp.get());
+}
+
 void PluginView::halt()
 {
+    ASSERT(!m_isHalted);
+    ASSERT(m_isStarted);
+
 #if !PLATFORM(QT)
     // Show a screenshot of the plug-in.
-    OwnPtr<HBITMAP> nodeImage(m_parentFrame->nodeImage(m_element));
-    toRenderWidget(m_element->renderer())->showSubstituteImage(BitmapImage::create(nodeImage.get()));
+    toRenderWidget(m_element->renderer())->showSubstituteImage(snapshot());
 #endif
 
+    m_isHalted = true;
+    m_hasBeenHalted = true;
+
     stop();
     platformDestroy();
 }
@@ -1032,10 +1081,12 @@ void PluginView::halt()
 void PluginView::restart()
 {
     ASSERT(!m_isStarted);
+    ASSERT(m_isHalted);
 
     // Clear any substitute image.
     toRenderWidget(m_element->renderer())->showSubstituteImage(0);
 
+    m_isHalted = false;
     m_haveUpdatedPluginWidget = false;
     start();
 }
diff --git a/WebCore/rendering/HitTestResult.cpp b/WebCore/rendering/HitTestResult.cpp
index 0aaddc9..50933c6 100644
--- a/WebCore/rendering/HitTestResult.cpp
+++ b/WebCore/rendering/HitTestResult.cpp
@@ -123,17 +123,6 @@ Frame* HitTestResult::targetFrame() const
     return frame->tree()->find(m_innerURLElement->target());
 }
 
-IntRect HitTestResult::boundingBox() const
-{
-    if (m_innerNonSharedNode) {
-        RenderObject* renderer = m_innerNonSharedNode->renderer();
-        if (renderer)
-            return renderer->absoluteBoundingBoxRect();
-    }
-    
-    return IntRect();
-}
-
 bool HitTestResult::isSelected() const
 {
     if (!m_innerNonSharedNode)
@@ -246,7 +235,7 @@ IntRect HitTestResult::imageRect() const
 {
     if (!image())
         return IntRect();
-    return m_innerNonSharedNode->renderBox()->absoluteContentBox();
+    return m_innerNonSharedNode->renderBox()->absoluteContentQuad().enclosingBoundingBox();
 }
 
 KURL HitTestResult::absoluteImageURL() const
diff --git a/WebCore/rendering/HitTestResult.h b/WebCore/rendering/HitTestResult.h
index f29ca41..25e1058 100644
--- a/WebCore/rendering/HitTestResult.h
+++ b/WebCore/rendering/HitTestResult.h
@@ -63,7 +63,6 @@ public:
     void setIsOverWidget(bool b) { m_isOverWidget = b; }
 
     Frame* targetFrame() const;
-    IntRect boundingBox() const;
     bool isSelected() const;
     String spellingToolTip(TextDirection&) const;
     String replacedString() const;
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index 143d3d8..baea956 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -429,7 +429,7 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                 }
                 lineHeight = baseline + baselineToBottom;
             } else if (parentLineHeight.isPercent()) {
-                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize());
+                lineHeight = parentLineHeight.calcMinValue(curr->renderer()->style()->fontSize(), true);
                 baseline = 0;
                 for (size_t i = 0; i < usedFonts.size(); ++i) {
                     int halfLeading = (lineHeight - usedFonts[i]->ascent() - usedFonts[i]->descent()) / 2;
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 73b9a3a..9611660 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -646,6 +646,15 @@ void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
     }
 }
 
+void MediaControlVolumeSliderElement::update()
+{
+    float volume = m_mediaElement->volume();
+    if (value().toFloat() != volume) {
+        setValue(String::number(volume));
+        MediaControlInputElement::update();
+    }
+}
+
 // ----------------------------
 
 MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* document, HTMLMediaElement* element)
diff --git a/WebCore/rendering/MediaControlElements.h b/WebCore/rendering/MediaControlElements.h
index e562bb5..8b29773 100644
--- a/WebCore/rendering/MediaControlElements.h
+++ b/WebCore/rendering/MediaControlElements.h
@@ -234,6 +234,7 @@ class MediaControlVolumeSliderElement : public MediaControlInputElement {
 public:
     MediaControlVolumeSliderElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
+    virtual void update();
 };
 
 // ----------------------------
diff --git a/WebCore/rendering/RenderBR.cpp b/WebCore/rendering/RenderBR.cpp
index f407099..e05c8b4 100644
--- a/WebCore/rendering/RenderBR.cpp
+++ b/WebCore/rendering/RenderBR.cpp
@@ -64,7 +64,7 @@ int RenderBR::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
             return s->font().lineSpacing();
         }
         if (lh.isPercent())
-            return lh.calcMinValue(s->fontSize());
+            return lh.calcMinValue(s->fontSize(), true);
         return lh.value();
     }
 
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 83f9624..8e0f3b7 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -145,6 +145,8 @@ void RenderBox::styleWillChange(StyleDifference diff, const RenderStyle* newStyl
             markContainingBlocksForLayout();
             if (style()->position() == StaticPosition)
                 repaint();
+            else if (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition)
+                parent()->setChildNeedsLayout(true);
             if (isFloating() && !isPositioned() && (newStyle->position() == AbsolutePosition || newStyle->position() == FixedPosition))
                 removeFloatingOrPositionedChildFromBlockLists();
         }
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index 897d9b3..c579123 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -318,7 +318,7 @@ protected:
     
     virtual bool shouldCalculateSizeAsReplaced() const { return isReplaced() && !isInlineBlockOrInlineTable(); }
 
-    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&) const;
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
 private:
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index 1f79e50..ff7c9c9 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -231,7 +231,7 @@ bool RenderImage::setImageSizeForAltText(CachedImage* newImage /* = 0 */)
         imageHeight = paddingHeight;
     }
   
-    if (newImage) {
+    if (newImage && newImage->image()) {
         // imageSize() returns 0 for the error image.  We need the true size of the
         // error image, so we have to get it by grabbing image() directly.
         imageWidth += newImage->image()->width() * style()->effectiveZoom();
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 05d29d0..0302113 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -30,6 +30,7 @@
 #include "RenderArena.h"
 #include "RenderBlock.h"
 #include "RenderView.h"
+#include "TransformState.h"
 #include "VisiblePosition.h"
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -705,6 +706,92 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
 
+IntSize RenderInline::offsetFromContainer(RenderObject* container) const
+{
+    ASSERT(container == this->container());
+
+    IntSize offset;    
+    if (isRelPositioned())
+        offset += relativePositionOffset();
+
+    if (!isInline() || isReplaced()) {
+        RenderBlock* cb;
+        if (container->isBlockFlow() && (cb = toRenderBlock(container))->hasColumns()) {
+            IntRect rect(0, 0, 1, 1);
+            cb->adjustRectForColumns(rect);
+        }
+    }
+
+    if (container->hasOverflowClip())
+        offset -= toRenderBox(container)->layer()->scrolledContentOffset();
+
+    return offset;
+}
+
+void RenderInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
+{
+    if (repaintContainer == this)
+        return;
+
+    if (RenderView *v = view()) {
+        if (v->layoutStateEnabled() && !repaintContainer) {
+            LayoutState* layoutState = v->layoutState();
+            IntSize offset = layoutState->m_offset;
+            if (style()->position() == RelativePosition && layer())
+                offset += layer()->relativePositionOffset();
+            transformState.move(offset);
+            return;
+        }
+    }
+
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
+    if (!o)
+        return;
+
+    IntSize containerOffset = offsetFromContainer(o);
+
+    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+
+    if (containerSkipped) {
+        // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
+        // to just subtract the delta between the repaintContainer and o.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+        return;
+    }
+
+    o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
+}
+
+void RenderInline::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState& transformState) const
+{
+    // We don't expect this function to be called during layout.
+    ASSERT(!view() || !view()->layoutStateEnabled());
+
+    RenderObject* o = container();
+    if (!o)
+        return;
+
+    o->mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
+
+    IntSize containerOffset = offsetFromContainer(o);
+
+    bool preserve3D = useTransforms && (o->style()->preserves3D() || style()->preserves3D());
+    if (useTransforms && shouldUseTransformFromContainer(o)) {
+        TransformationMatrix t;
+        getTransformFromContainer(o, containerOffset, t);
+        transformState.applyTransform(t, preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+    } else
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+}
+
 void RenderInline::updateDragState(bool dragOn)
 {
     RenderBoxModelObject::updateDragState(dragOn);
diff --git a/WebCore/rendering/RenderInline.h b/WebCore/rendering/RenderInline.h
index 8e0064e..8e9715c 100644
--- a/WebCore/rendering/RenderInline.h
+++ b/WebCore/rendering/RenderInline.h
@@ -44,6 +44,8 @@ public:
     virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
+    virtual IntSize offsetFromContainer(RenderObject*) const;
+
     IntRect linesBoundingBox() const;
     IntRect linesVisibleOverflowBoundingBox() const;
 
@@ -107,6 +109,9 @@ private:
     virtual IntRect rectWithOutlineForRepaint(RenderBoxModelObject* repaintContainer, int outlineWidth);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& rect, bool fixed);
 
+    virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&) const;
+    virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
+
     virtual VisiblePosition positionForPoint(const IntPoint&);
 
     virtual IntRect borderBoundingBox() const
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index 7a8b428..8f2805a 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -311,12 +311,19 @@ void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags)
     if (m_reflection)
         m_reflection->layout();
 
+#if USE(ACCELERATED_COMPOSITING)
+    // Clear the IsCompositingUpdateRoot flag once we've found the first compositing layer in this update.
+    bool isUpdateRoot = (flags & IsCompositingUpdateRoot);
+    if (isComposited())
+        flags &= ~IsCompositingUpdateRoot;
+#endif
+
     for (RenderLayer* child = firstChild(); child; child = child->nextSibling())
         child->updateLayerPositions(flags);
 
 #if USE(ACCELERATED_COMPOSITING)
     if ((flags & UpdateCompositingLayers) && isComposited())
-        backing()->updateAfterLayout(RenderLayerBacking::CompositingChildren);
+        backing()->updateAfterLayout(RenderLayerBacking::CompositingChildren, isUpdateRoot);
 #endif
         
     // With all our children positioned, now update our marquee if we need to.
@@ -1139,8 +1146,10 @@ void RenderLayer::scrollToOffset(int x, int y, bool updateScrollbars, bool repai
 
 #if USE(ACCELERATED_COMPOSITING)
     if (compositor()->inCompositingMode()) {
-        if (RenderLayer* compositingAncestor = ancestorCompositingLayer())
-            compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants);
+        if (RenderLayer* compositingAncestor = ancestorCompositingLayer()) {
+            bool isUpdateRoot = true;
+            compositingAncestor->backing()->updateAfterLayout(RenderLayerBacking::AllDescendants, isUpdateRoot);
+        }
     }
 #endif
     
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index 9d2212b..a274638 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -298,10 +298,11 @@ public:
     enum UpdateLayerPositionsFlag {
         DoFullRepaint = 1,
         CheckForRepaint = 1 << 1,
-        UpdateCompositingLayers = 1 << 2,
+        IsCompositingUpdateRoot = 1 << 2,
+        UpdateCompositingLayers = 1 << 3,
     };
     typedef unsigned UpdateLayerPositionsFlags;
-    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | UpdateCompositingLayers);
+    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers);
 
     void updateTransform();
 
@@ -327,6 +328,7 @@ public:
     Vector<RenderLayer*>* normalFlowList() const { return m_normalFlowList; }
 
     bool hasVisibleContent() const { return m_hasVisibleContent; }
+    bool hasVisibleDescendant() const { return m_hasVisibleDescendant; }
     void setHasVisibleContent(bool);
     void dirtyVisibleContentStatus();
 
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index 941817c..d7248d4 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -89,8 +89,8 @@ void RenderLayerBacking::createGraphicsLayer()
         m_graphicsLayer->setName("Anonymous Node");
 #endif  // NDEBUG
 
-    updateLayerOpacity();
-    updateLayerTransform();
+    updateLayerOpacity(renderer()->style());
+    updateLayerTransform(renderer()->style());
 }
 
 void RenderLayerBacking::destroyGraphicsLayer()
@@ -104,15 +104,13 @@ void RenderLayerBacking::destroyGraphicsLayer()
     m_maskLayer = 0;
 }
 
-void RenderLayerBacking::updateLayerOpacity()
+void RenderLayerBacking::updateLayerOpacity(const RenderStyle* style)
 {
-    m_graphicsLayer->setOpacity(compositingOpacity(renderer()->opacity()));
+    m_graphicsLayer->setOpacity(compositingOpacity(style->opacity()));
 }
 
-void RenderLayerBacking::updateLayerTransform()
+void RenderLayerBacking::updateLayerTransform(const RenderStyle* style)
 {
-    RenderStyle* style = renderer()->style();
-
     // FIXME: This could use m_owningLayer->transform(), but that currently has transform-origin
     // baked into it, and we don't want that.
     TransformationMatrix t;
@@ -148,7 +146,7 @@ void RenderLayerBacking::updateCompositedBounds()
     setCompositedBounds(layerBounds);
 }
 
-void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
+void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth, bool isUpdateRoot)
 {
     RenderLayerCompositor* layerCompositor = compositor();
     if (!layerCompositor->compositingLayersNeedRebuild()) {
@@ -162,7 +160,7 @@ void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
         updateCompositedBounds();
         layerCompositor->updateCompositingDescendantGeometry(m_owningLayer, m_owningLayer, updateDepth);
         
-        if (!m_owningLayer->parent()) {
+        if (isUpdateRoot) {
             updateGraphicsLayerGeometry();
             layerCompositor->updateRootLayerPosition();
         }
@@ -219,11 +217,11 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     // Set transform property, if it is not animating. We have to do this here because the transform
     // is affected by the layer dimensions.
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyWebkitTransform))
-        updateLayerTransform();
+        updateLayerTransform(renderer()->style());
 
     // Set opacity, if it is not animating.
     if (!renderer()->animation()->isAnimatingPropertyOnRenderer(renderer(), CSSPropertyOpacity))
-        updateLayerOpacity();
+        updateLayerOpacity(renderer()->style());
     
     RenderStyle* style = renderer()->style();
     m_graphicsLayer->setPreserves3D(style->transformStyle3D() == TransformStyle3DPreserve3D);
@@ -886,7 +884,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     if (paintingRoot && !renderer()->isDescendantOf(paintingRoot))
         paintingRootForRenderer = paintingRoot;
 
-    bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
+    bool shouldPaint = (m_owningLayer->hasVisibleContent() || m_owningLayer->hasVisibleDescendant()) && m_owningLayer->isSelfPaintingLayer();
 
     if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
         // If this is the root then we need to send in a bigger bounding box
@@ -1082,8 +1080,11 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
             // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
-            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime))
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime)) {
+                // To ensure that the correct opacity is visible when the animation ends, also set the final opacity.
+                updateLayerOpacity(toStyle);
                 didAnimate = true;
+            }
         }
     }
 
@@ -1093,8 +1094,11 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             KeyframeValueList transformVector(AnimatedPropertyWebkitTransform);
             transformVector.insert(new TransformAnimationValue(0, &fromStyle->transform()));
             transformVector.insert(new TransformAnimationValue(1, &toStyle->transform()));
-            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime))
+            if (m_graphicsLayer->addAnimation(transformVector, toRenderBox(renderer())->borderBoxRect().size(), transformAnim, String(), beginTime)) {
+                // To ensure that the correct transform is visible when the animation ends, also set the final opacity.
+                updateLayerTransform(toStyle);
                 didAnimate = true;
+            }
         }
     }
 
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index e12aa58..17bcaf7 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -54,7 +54,7 @@ public:
     RenderLayer* owningLayer() const { return m_owningLayer; }
 
     enum UpdateDepth { CompositingChildren, AllDescendants };
-    void updateAfterLayout(UpdateDepth);
+    void updateAfterLayout(UpdateDepth, bool isUpdateRoot);
     
     // Returns true if layer configuration changed.
     bool updateGraphicsLayerConfiguration();
@@ -140,8 +140,8 @@ private:
     // Result is perspective origin in pixels.
     FloatPoint computePerspectiveOrigin(const IntRect& borderBox) const;
 
-    void updateLayerOpacity();
-    void updateLayerTransform();
+    void updateLayerOpacity(const RenderStyle*);
+    void updateLayerTransform(const RenderStyle*);
 
     // Return the opacity value that this layer should use for compositing.
     float compositingOpacity(float rendererOpacity) const;
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index 1da2628..1d4da23 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -258,6 +258,7 @@ void RenderMedia::createVolumeSlider()
     m_volumeSlider = new MediaControlVolumeSliderElement(document(), mediaElement());
     m_volumeSlider->setAttribute(precisionAttr, "float");
     m_volumeSlider->setAttribute(maxAttr, "1");
+    m_volumeSlider->setAttribute(valueAttr, String::number(mediaElement()->volume()));
     m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
 }
 
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
index 4303aaa..9cc1493 100644
--- a/WebCore/rendering/RenderMediaControls.cpp
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -37,7 +37,7 @@ using namespace std;
  
 namespace WebCore {
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
index bba2fa2..56fbec4 100644
--- a/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -54,14 +54,16 @@ static Image* platformResource(const char* name)
     return 0;
 }
 
+static bool hasSource(const HTMLMediaElement* mediaElement)
+{
+    return mediaElement->networkState() != HTMLMediaElement::NETWORK_EMPTY
+        && mediaElement->networkState() != HTMLMediaElement::NETWORK_NO_SOURCE;
+}
+
 static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
 {
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
     IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
+    context->drawImage(image, rect);
     return true;
 }
 
@@ -75,7 +77,7 @@ static bool paintMediaMuteButton(RenderObject* object, const RenderObject::Paint
     static Image* soundNone = platformResource("mediaSoundNone");
     static Image* soundDisabled = platformResource("mediaSoundDisabled");
 
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+    if (!hasSource(mediaElement) || !mediaElement->hasAudio())
         return paintMediaButton(paintInfo.context, rect, soundDisabled);
 
     return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
@@ -91,7 +93,7 @@ static bool paintMediaPlayButton(RenderObject* object, const RenderObject::Paint
     static Image* mediaPause = platformResource("mediaPause");
     static Image* mediaPlayDisabled = platformResource("mediaPlayDisabled");
 
-    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+    if (!hasSource(mediaElement))
         return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
 
     return paintMediaButton(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
@@ -110,6 +112,7 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
     // FIXME: this should be a rounded rect but need to fix GraphicsContextSkia first.
     // https://bugs.webkit.org/show_bug.cgi?id=30143
     context->save();
+    context->setShouldAntialias(true);
     context->setStrokeStyle(SolidStroke);
     context->setStrokeColor(style->borderLeftColor());
     context->setStrokeThickness(style->borderLeftWidth());
@@ -119,10 +122,9 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
 
     // Draw the buffered ranges.
     // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-    // FIXME: percentLoaded() doesn't always hit 1.0 so we're using round().
     IntRect bufferedRect = rect;
     bufferedRect.inflate(-style->borderLeftWidth());
-    bufferedRect.setWidth(round((bufferedRect.width() * mediaElement->percentLoaded())));
+    bufferedRect.setWidth((bufferedRect.width() * mediaElement->percentLoaded()));
 
     // Don't bother drawing an empty area.
     if (!bufferedRect.isEmpty()) {
@@ -138,7 +140,7 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
         context->save();
         context->setStrokeStyle(NoStroke);
         context->setFillGradient(gradient);
-        context->drawRect(bufferedRect);
+        context->fillRect(bufferedRect);
         context->restore();
     }
 
@@ -150,6 +152,13 @@ static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::Pain
     if (!object->parent()->isSlider())
         return false;
 
+    HTMLMediaElement* mediaElement = toParentMediaElement(object->parent());
+    if (!mediaElement)
+        return false;
+
+    if (!hasSource(mediaElement))
+        return true;
+
     static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
     return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
 }
@@ -231,6 +240,8 @@ bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part,
     case MediaCurrentTimePart:
     case MediaTimeRemainingPart:
         return true;
+    default:
+        ;
     }
     return false;
 }
@@ -261,6 +272,9 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaCurrentTimeDisplay:
     case MediaTimeRemainingDisplay:
     case MediaControlsPanel:
+    case MediaRewindButton:
+    case MediaReturnToRealtimeButton:
+    case MediaStatusDisplay:
         ASSERT_NOT_REACHED();
         break;
     }
@@ -278,9 +292,10 @@ void RenderMediaControlsChromium::adjustMediaSliderThumbSize(RenderObject* objec
     else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
         thumbImage = mediaVolumeSliderThumb;
 
+    float zoomLevel = object->style()->effectiveZoom();
     if (thumbImage) {
-        object->style()->setWidth(Length(thumbImage->width(), Fixed));
-        object->style()->setHeight(Length(thumbImage->height(), Fixed));
+        object->style()->setWidth(Length(static_cast<int>(thumbImage->width() * zoomLevel), Fixed));
+        object->style()->setHeight(Length(static_cast<int>(thumbImage->height() * zoomLevel), Fixed));
     }
 }
 
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index d83e4d0..21ced26 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -1571,7 +1571,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             // For changes in float styles, we need to conceivably remove ourselves
             // from the floating objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
-        else if (isPositioned() && (newStyle->position() != AbsolutePosition && newStyle->position() != FixedPosition))
+        else if (isPositioned() && (m_style->position() != newStyle->position()))
             // For changes in positioning styles, we need to conceivably remove ourselves
             // from the positioned objects list.
             toRenderBox(this)->removeFloatingOrPositionedChildFromBlockLists();
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 3a39423..fb42bb7 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -585,8 +585,9 @@ bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject:
     paint.setAntiAlias(true);
     paint.setStyle(SkPaint::kFill_Style);
 
+    int arrowXPosition = (o->style()->direction() == RTL) ? rect.x() + 7 : right - 13;
     SkPath path;
-    path.moveTo(right - 13, middle - 3);
+    path.moveTo(arrowXPosition, middle - 3);
     path.rLineTo(6, 0);
     path.rLineTo(-3, 6);
     path.close();
diff --git a/WebCore/rendering/RenderThemeChromiumWin.cpp b/WebCore/rendering/RenderThemeChromiumWin.cpp
index 20503f3..4b38d53 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -611,21 +611,11 @@ bool RenderThemeChromiumWin::paintTextFieldInternal(RenderObject* o,
                                                     const IntRect& r,
                                                     bool drawEdges)
 {
-    // Nasty hack to make us not paint the border on text fields with a
-    // border-radius. Webkit paints elements with border-radius for us.
-    // FIXME: Get rid of this if-check once we can properly clip rounded
-    // borders: http://b/1112604 and http://b/1108635
-    // FIXME: make sure we do the right thing if css background-clip is set.
-    if (o->style()->hasBorderRadius())
-        return false;
-
-    const ThemeData& themeData = getThemeData(o);
-
     // Fallback to white if the specified color object is invalid.
+    // (Note ChromiumBridge::paintTextField duplicates this check).
     Color backgroundColor(Color::white);
-    if (o->style()->backgroundColor().isValid()) {
+    if (o->style()->backgroundColor().isValid())
         backgroundColor = o->style()->backgroundColor();
-    }
 
     // If we have background-image, don't fill the content area to expose the
     // parent's background. Also, we shouldn't fill the content area if the
@@ -634,17 +624,32 @@ bool RenderThemeChromiumWin::paintTextFieldInternal(RenderObject* o,
     // Note that we should paint the content area white if we have neither the
     // background color nor background image explicitly specified to keep the
     // appearance of select element consistent with other browsers.
-    bool fillContentArea = !o->style()->hasBackgroundImage() && backgroundColor.alpha() != 0;
-
-    WebCore::ThemePainter painter(i.context, r);
-    ChromiumBridge::paintTextField(painter.context(),
-                                   themeData.m_part,
-                                   themeData.m_state,
-                                   themeData.m_classicState,
-                                   painter.drawRect(),
-                                   backgroundColor,
-                                   fillContentArea,
-                                   drawEdges);
+    bool fillContentArea = !o->style()->hasBackgroundImage() && backgroundColor.alpha();
+
+    if (o->style()->hasBorderRadius()) {
+        // If the style has rounded borders, setup the context to clip the
+        // background (themed or filled) appropriately.
+        // FIXME: make sure we do the right thing if css background-clip is set.
+        i.context->save();
+        IntSize topLeft, topRight, bottomLeft, bottomRight;
+        o->style()->getBorderRadiiForRect(r, topLeft, topRight, bottomLeft, bottomRight);
+        i.context->addRoundedRectClip(r, topLeft, topRight, bottomLeft, bottomRight);
+    }
+    {
+        const ThemeData& themeData = getThemeData(o);
+        WebCore::ThemePainter painter(i.context, r);
+        ChromiumBridge::paintTextField(painter.context(),
+                                       themeData.m_part,
+                                       themeData.m_state,
+                                       themeData.m_classicState,
+                                       painter.drawRect(),
+                                       backgroundColor,
+                                       fillContentArea,
+                                       drawEdges);
+        // End of block commits the painter before restoring context.
+    }
+    if (o->style()->hasBorderRadius())
+        i.context->restore();
     return false;
 }
 
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 8e53088..2ea3b8b 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -86,7 +86,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
     return safariTheme; // keep the reference of one.
 }
 
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
diff --git a/WebCore/rendering/RenderTreeAsText.cpp b/WebCore/rendering/RenderTreeAsText.cpp
index 5c6e738..b7ab191 100644
--- a/WebCore/rendering/RenderTreeAsText.cpp
+++ b/WebCore/rendering/RenderTreeAsText.cpp
@@ -28,6 +28,7 @@
 
 #include "CSSMutableStyleDeclaration.h"
 #include "CharacterNames.h"
+#include "CString.h"
 #include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -553,4 +554,31 @@ String externalRepresentation(RenderObject* o)
     return ts.release();
 }
 
+static void writeCounterValuesFromChildren(TextStream& stream, RenderObject* parent)
+{
+    for (RenderObject* child = parent->firstChild(); child; child = child->nextSibling()) {
+        if (child->isCounter()) {
+            String str(toRenderText(child)->text());
+            stream << str;
+        }
+    }
+}
+
+String counterValueForElement(Element* element)
+{
+    // Make sure the element is not freed during the layout.
+    RefPtr<Element> elementRef(element);
+    element->document()->updateLayout();
+    TextStream stream;
+    // The counter renderers should be children of anonymous children
+    // (i.e., :before or :after pseudo-elements).
+    if (RenderObject* renderer = element->renderer()) {
+        for (RenderObject* child = renderer->firstChild(); child; child = child->nextSibling()) {
+            if (child->isAnonymous())
+                writeCounterValuesFromChildren(stream, child);
+        }
+    }
+    return stream.release();
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderTreeAsText.h b/WebCore/rendering/RenderTreeAsText.h
index daca253..325f109 100644
--- a/WebCore/rendering/RenderTreeAsText.h
+++ b/WebCore/rendering/RenderTreeAsText.h
@@ -28,15 +28,18 @@
 
 namespace WebCore {
 
-    class RenderObject;
-    class String;
-    class TextStream;
+class Element;
+class RenderObject;
+class String;
+class TextStream;
 
-    String externalRepresentation(RenderObject*);
-    void write(TextStream&, const RenderObject&, int indent = 0);
+String externalRepresentation(RenderObject*);
+void write(TextStream&, const RenderObject&, int indent = 0);
 
-    // Helper function shared with SVGRenderTreeAsText
-    String quoteAndEscapeNonPrintables(const String&);
+// Helper function shared with SVGRenderTreeAsText
+String quoteAndEscapeNonPrintables(const String&);
+
+String counterValueForElement(Element*);
 
 } // namespace WebCore
 
diff --git a/WebCore/rendering/SVGRenderSupport.cpp b/WebCore/rendering/SVGRenderSupport.cpp
index fb6866f..ea087f9 100644
--- a/WebCore/rendering/SVGRenderSupport.cpp
+++ b/WebCore/rendering/SVGRenderSupport.cpp
@@ -94,6 +94,9 @@ void SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
+    if (ShadowData* shadow = svgStyle->shadow())
+        paintInfo.context->setShadow(IntSize(shadow->x, shadow->y), shadow->blur, shadow->color); 
+
 #if ENABLE(FILTERS)
     AtomicString filterId(svgStyle->filter());
 #endif
@@ -220,7 +223,7 @@ FloatRect SVGRenderBase::filterBoundingBoxForRenderer(const RenderObject* object
 #if ENABLE(FILTERS)
     SVGResourceFilter* filter = getFilterById(object->document(), object->style()->svgStyle()->filter());
     if (filter)
-        return filter->filterBBoxForItemBBox(object->objectBoundingBox());
+        return filter->filterBoundingBox();
 #else
     UNUSED_PARAM(object);
 #endif
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index f1591de..2ea2304 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -458,7 +458,7 @@ public:
             return font().lineSpacing();
 
         if (lh.isPercent())
-            return lh.calcMinValue(fontSize());
+            return lh.calcMinValue(fontSize(), true);
 
         return lh.value();
     }
@@ -1196,11 +1196,14 @@ public:
     static const Vector<StyleDashboardRegion>& noneDashboardRegions();
 #endif
 
+<<<<<<< HEAD:WebCore/rendering/style/RenderStyle.h
 #ifdef ANDROID_CSS_TAP_HIGHLIGHT_COLOR
     static Color initialTapHighlightColor() { return Color::tap; }
 #endif
 };
 
+=======
+>>>>>>> webkit.org at r50258.:WebCore/rendering/style/RenderStyle.h
 } // namespace WebCore
 
 #endif // RenderStyle_h
diff --git a/WebCore/rendering/style/SVGRenderStyle.cpp b/WebCore/rendering/style/SVGRenderStyle.cpp
index 1289b06..e8827c4 100644
--- a/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -51,6 +51,7 @@ SVGRenderStyle::SVGRenderStyle()
     mask = defaultStyle->mask;
     misc = defaultStyle->misc;
     markers = defaultStyle->markers;
+    shadowSVG = defaultStyle->shadowSVG;
 
     setBitDefaults();
 }
@@ -67,6 +68,7 @@ SVGRenderStyle::SVGRenderStyle(CreateDefaultType)
     mask.init();
     misc.init();
     markers.init();
+    shadowSVG.init();
 }
 
 SVGRenderStyle::SVGRenderStyle(const SVGRenderStyle& other)
@@ -80,6 +82,7 @@ SVGRenderStyle::SVGRenderStyle(const SVGRenderStyle& other)
     mask = other.mask;
     misc = other.misc;
     markers = other.markers;
+    shadowSVG = other.shadowSVG;
 
     svg_inherited_flags = other.svg_inherited_flags;
     svg_noninherited_flags = other.svg_noninherited_flags;
@@ -93,7 +96,7 @@ bool SVGRenderStyle::operator==(const SVGRenderStyle& o) const
 {
     return (fill == o.fill && stroke == o.stroke && text == o.text &&
         stops == o.stops && clip == o.clip && mask == o.mask &&
-        misc == o.misc && markers == o.markers &&
+        misc == o.misc && markers == o.markers && shadowSVG == o.shadowSVG &&
         svg_inherited_flags == o.svg_inherited_flags &&
         svg_noninherited_flags == o.svg_noninherited_flags);
 }
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index e50d349..12477d7 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -30,6 +30,7 @@
 #include "GraphicsTypes.h"
 #include "SVGPaint.h"
 #include "SVGRenderStyleDefs.h"
+#include "ShadowData.h"
 
 #include <wtf/Platform.h>
 
@@ -98,6 +99,8 @@ namespace WebCore {
         SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL(Color, misc, lightingColor, LightingColor, lightingColor, Color(255, 255, 255))
         SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_REFCOUNTED(CSSValue, misc, baselineShiftValue, BaselineShiftValue, baselineShiftValue, 0)
 
+        SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_OWNPTR(ShadowData, shadowSVG, shadow, Shadow, shadow, 0)
+
         // convenience
         bool hasStroke() const { return (strokePaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
         bool hasFill() const { return (fillPaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE); }
@@ -172,6 +175,7 @@ namespace WebCore {
         DataRef<StyleClipData> clip;
         DataRef<StyleMaskData> mask;
         DataRef<StyleMiscData> misc;
+        DataRef<StyleShadowSVGData> shadowSVG;
 
     private:
         enum CreateDefaultType { CreateDefault };
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.cpp b/WebCore/rendering/style/SVGRenderStyleDefs.cpp
index f5faad3..2ed1d8f 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.cpp
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.cpp
@@ -213,6 +213,25 @@ bool StyleMiscData::operator==(const StyleMiscData &other) const
            && baselineShiftValue == other.baselineShiftValue;
 }
 
+StyleShadowSVGData::StyleShadowSVGData()
+{
+}
+
+StyleShadowSVGData::StyleShadowSVGData(const StyleShadowSVGData& other)
+    : RefCounted<StyleShadowSVGData>()
+    , shadow(other.shadow ? new ShadowData(*other.shadow) : 0)
+{
+}
+
+bool StyleShadowSVGData::operator==(const StyleShadowSVGData& other) const
+{
+    if ((!shadow && other.shadow) || (shadow && !other.shadow))
+        return false;
+    if (shadow && other.shadow && (*shadow != *other.shadow))
+        return false;
+    return true;
+}
+
 #endif // ENABLE(SVG)
 
 // vim:ts=4:noet
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.h b/WebCore/rendering/style/SVGRenderStyleDefs.h
index c0f5d4e..f4cf932 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -33,6 +33,9 @@
 #include "Color.h"
 #include "Path.h"
 #include "PlatformString.h"
+#include "ShadowData.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
@@ -65,6 +68,13 @@
     } \
     static Data* initial##Type() { return Initial; }
 
+#define SVG_RS_DEFINE_ATTRIBUTE_DATAREF_WITH_INITIAL_OWNPTR(Data, Group, Variable, Type, Name, Initial) \
+    Data* Name() const { return Group->Variable.get(); } \
+    void set##Type(Data* obj) { \
+        Group.access()->Variable.set(obj); \
+    } \
+    static Data* initial##Type() { return Initial; }
+
 #define SVG_RS_SET_VARIABLE(Group, Variable, Value) \
     if (!(Group->Variable == Value)) \
         Group.access()->Variable = Value;
@@ -279,6 +289,24 @@ namespace WebCore {
         StyleMiscData();
         StyleMiscData(const StyleMiscData&);
     };
+    
+    class StyleShadowSVGData : public RefCounted<StyleShadowSVGData> {
+    public:
+        static PassRefPtr<StyleShadowSVGData> create() { return adoptRef(new StyleShadowSVGData); }
+        PassRefPtr<StyleShadowSVGData> copy() const { return adoptRef(new StyleShadowSVGData(*this)); }
+        
+        bool operator==(const StyleShadowSVGData& other) const;
+        bool operator!=(const StyleShadowSVGData& other) const
+        {
+            return !(*this == other);
+        }
+
+        OwnPtr<ShadowData> shadow;
+
+    private:
+        StyleShadowSVGData();
+        StyleShadowSVGData(const StyleShadowSVGData& other);
+    };
 
 } // namespace WebCore
 
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index 403e132..5aaa26f 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -128,7 +128,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
         return 0;
     }
 
-    RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion));
+    RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion, displayName, estimatedSize));
 
     if (!database->openAndVerifyVersion(e)) {
        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
@@ -147,25 +147,28 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
     return database;
 }
 
-Database::Database(Document* document, const String& name, const String& expectedVersion)
+Database::Database(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize)
     : m_transactionInProgress(false)
     , m_document(document)
     , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion)
+    , m_displayName(displayName)
+    , m_estimatedSize(estimatedSize)
     , m_deleted(false)
     , m_stopped(false)
     , m_opened(false)
 {
     ASSERT(document);
-    m_securityOrigin = document->securityOrigin();
+    m_mainThreadSecurityOrigin = document->securityOrigin();
+    m_databaseThreadSecurityOrigin = m_mainThreadSecurityOrigin->threadsafeCopy();
 
     if (m_name.isNull())
         m_name = "";
 
     ScriptController::initializeThreading();
 
-    m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
+    m_guid = guidForOriginAndName(m_mainThreadSecurityOrigin->toString(), name);
 
     {
         MutexLocker locker(guidMutex());
@@ -181,7 +184,7 @@ Database::Database(Document* document, const String& name, const String& expecte
 
     ASSERT(m_document->databaseThread());
 
-    m_filename = DatabaseTracker::tracker().fullPathForDatabase(m_securityOrigin.get(), m_name);
+    m_filename = DatabaseTracker::tracker().fullPathForDatabase(m_mainThreadSecurityOrigin.get(), m_name);
 
     DatabaseTracker::tracker().addOpenDatabase(this);
     m_document->addOpenDatabase(this);
@@ -364,20 +367,9 @@ void Database::stop()
     }
 }
 
-unsigned long long Database::databaseSize() const
-{
-    return SQLiteFileSystem::getDatabaseFileSize(m_filename);
-}
-
 unsigned long long Database::maximumSize() const
 {
-    // The maximum size for this database is the full quota for this origin, minus the current usage within this origin,
-    // except for the current usage of this database
-
-    OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
-    Locker<OriginQuotaManager> locker(manager);
-
-    return DatabaseTracker::tracker().quotaForOrigin(m_securityOrigin.get()) - manager.diskUsage(m_securityOrigin.get()) + databaseSize();
+    return DatabaseTracker::tracker().getMaxSizeForDatabase(this);
 }
 
 void Database::disableAuthorizer()
@@ -645,9 +637,13 @@ void Database::setExpectedVersion(const String& version)
     updateGuidVersionMap(m_guid, version);
 }
 
-PassRefPtr<SecurityOrigin> Database::securityOriginCopy() const
+SecurityOrigin* Database::securityOrigin() const
 {
-    return m_securityOrigin->threadsafeCopy();
+    if (isMainThread())
+        return m_mainThreadSecurityOrigin.get();
+    if (currentThread() == document()->databaseThread()->getThreadID())
+        return m_databaseThreadSecurityOrigin.get();
+    return 0;
 }
 
 String Database::stringIdentifier() const
@@ -656,6 +652,23 @@ String Database::stringIdentifier() const
     return m_name.threadsafeCopy();
 }
 
+String Database::displayName() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_displayName.threadsafeCopy();
+}
+
+unsigned long Database::estimatedSize() const
+{
+    return m_estimatedSize;
+}
+
+String Database::fileName() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_filename.threadsafeCopy();
+}
+
 #endif
 
 }
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index b850686..f275027 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -89,8 +89,11 @@ public:
     Vector<String> tableNames();
 
     Document* document() const { return m_document.get(); }
-    PassRefPtr<SecurityOrigin> securityOriginCopy() const;
+    SecurityOrigin* securityOrigin() const;
     String stringIdentifier() const;
+    String displayName() const;
+    unsigned long estimatedSize() const;
+    String fileName() const;
 
     bool getVersionFromDatabase(String&);
     bool setVersionInDatabase(const String&);
@@ -121,7 +124,8 @@ public:
     SQLTransactionCoordinator* transactionCoordinator() const;
 
 private:
-    Database(Document* document, const String& name, const String& expectedVersion);
+    Database(Document* document, const String& name, const String& expectedVersion,
+             const String& displayName, unsigned long estimatedSize);
 
     bool openAndVerifyVersion(ExceptionCode&);
 
@@ -136,10 +140,13 @@ private:
     static void deliverPendingCallback(void*);
 
     RefPtr<Document> m_document;
-    RefPtr<SecurityOrigin> m_securityOrigin;
+    RefPtr<SecurityOrigin> m_mainThreadSecurityOrigin;
+    RefPtr<SecurityOrigin> m_databaseThreadSecurityOrigin;
     String m_name;
     int m_guid;
     String m_expectedVersion;
+    String m_displayName;
+    unsigned long m_estimatedSize;
     String m_filename;
 
     bool m_deleted;
@@ -152,7 +159,7 @@ private:
     RefPtr<DatabaseAuthorizer> m_databaseAuthorizer;
 
 #ifndef NDEBUG
-    String databaseDebugName() const { return m_securityOrigin->toString() + "::" + m_name; }
+    String databaseDebugName() const { return m_mainThreadSecurityOrigin->toString() + "::" + m_name; }
 #endif
 };
 
diff --git a/WebCore/storage/DatabaseThread.cpp b/WebCore/storage/DatabaseThread.cpp
index 9e3afdd..40c83ee 100644
--- a/WebCore/storage/DatabaseThread.cpp
+++ b/WebCore/storage/DatabaseThread.cpp
@@ -152,22 +152,20 @@ void DatabaseThread::scheduleImmediateTask(PassRefPtr<DatabaseTask> task)
     m_queue.prepend(task);
 }
 
+class SameDatabasePredicate {
+public:
+    SameDatabasePredicate(const Database* database) : m_database(database) { }
+    bool operator()(RefPtr<DatabaseTask>& task) const { return task->database() == m_database; }
+private:
+    const Database* m_database;
+};
+
 void DatabaseThread::unscheduleDatabaseTasks(Database* database)
 {
     // Note that the thread loop is running, so some tasks for the database
     // may still be executed. This is unavoidable.
-
-    Deque<RefPtr<DatabaseTask> > filteredReverseQueue;
-    RefPtr<DatabaseTask> task;
-    while (m_queue.tryGetMessage(task)) {
-        if (task->database() != database)
-            filteredReverseQueue.append(task);
-    }
-
-    while (!filteredReverseQueue.isEmpty()) {
-        m_queue.append(filteredReverseQueue.first());
-        filteredReverseQueue.removeFirst();
-    }
+    SameDatabasePredicate predicate(database);
+    m_queue.removeIf(predicate);
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseTracker.cpp b/WebCore/storage/DatabaseTracker.cpp
index 265cd0d..c0c4242 100644
--- a/WebCore/storage/DatabaseTracker.cpp
+++ b/WebCore/storage/DatabaseTracker.cpp
@@ -33,6 +33,7 @@
 
 #include "ChromeClient.h"
 #include "Database.h"
+#include "DatabaseThread.h"
 #include "DatabaseTrackerClient.h"
 #include "Document.h"
 #include "Logging.h"
@@ -182,6 +183,16 @@ bool DatabaseTracker::hasEntryForDatabase(SecurityOrigin* origin, const String&
     return statement.step() == SQLResultRow;
 }
 
+unsigned long long DatabaseTracker::getMaxSizeForDatabase(const Database* database)
+{
+    ASSERT(currentThread() == database->document()->databaseThread()->getThreadID());
+    // The maximum size for a database is the full quota for its origin, minus the current usage within the origin,
+    // plus the current usage of the given database
+    Locker<OriginQuotaManager> locker(originQuotaManager());
+    SecurityOrigin* origin = database->securityOrigin();
+    return quotaForOrigin(origin) - originQuotaManager().diskUsage(origin) + SQLiteFileSystem::getDatabaseFileSize(database->fileName());
+}
+
 String DatabaseTracker::originPath(SecurityOrigin* origin) const
 {
     ASSERT(currentThread() == m_thread);
@@ -409,13 +420,11 @@ void DatabaseTracker::addOpenDatabase(Database* database)
     if (!m_openDatabaseMap)
         m_openDatabaseMap.set(new DatabaseOriginMap);
 
-    RefPtr<SecurityOrigin> origin(database->securityOriginCopy());
     String name(database->stringIdentifier());
-
-    DatabaseNameMap* nameMap = m_openDatabaseMap->get(origin);
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(database->securityOrigin());
     if (!nameMap) {
         nameMap = new DatabaseNameMap;
-        m_openDatabaseMap->set(origin, nameMap);
+        m_openDatabaseMap->set(database->securityOrigin(), nameMap);
     }
 
     DatabaseSet* databaseSet = nameMap->get(name);
@@ -441,10 +450,8 @@ void DatabaseTracker::removeOpenDatabase(Database* database)
         return;
     }
 
-    RefPtr<SecurityOrigin> origin(database->securityOriginCopy());
     String name(database->stringIdentifier());
-
-    DatabaseNameMap* nameMap = m_openDatabaseMap->get(origin);
+    DatabaseNameMap* nameMap = m_openDatabaseMap->get(database->securityOrigin());
     if (!nameMap) {
         ASSERT_NOT_REACHED();
         return;
@@ -469,7 +476,7 @@ void DatabaseTracker::removeOpenDatabase(Database* database)
     if (!nameMap->isEmpty())
         return;
 
-    m_openDatabaseMap->remove(origin);
+    m_openDatabaseMap->remove(database->securityOrigin());
     delete nameMap;
 }
 
diff --git a/WebCore/storage/DatabaseTracker.h b/WebCore/storage/DatabaseTracker.h
index 2f6e06d..85e4858 100644
--- a/WebCore/storage/DatabaseTracker.h
+++ b/WebCore/storage/DatabaseTracker.h
@@ -86,6 +86,8 @@ public:
 
     bool hasEntryForOrigin(SecurityOrigin*);
 
+    unsigned long long getMaxSizeForDatabase(const Database*);
+
 private:
     DatabaseTracker();
 
diff --git a/WebCore/storage/OriginQuotaManager.cpp b/WebCore/storage/OriginQuotaManager.cpp
index 20bb34d..30b3271 100644
--- a/WebCore/storage/OriginQuotaManager.cpp
+++ b/WebCore/storage/OriginQuotaManager.cpp
@@ -104,8 +104,7 @@ void OriginQuotaManager::markDatabase(Database* database)
 {
     ASSERT(database);
     ASSERT(m_usageRecordGuardLocked);
-    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
-    OriginUsageRecord* usageRecord = m_usageMap.get(origin);
+    OriginUsageRecord* usageRecord = m_usageMap.get(database->securityOrigin());
     ASSERT(usageRecord);
 
     usageRecord->markDatabase(database->stringIdentifier());
diff --git a/WebCore/storage/SQLTransaction.cpp b/WebCore/storage/SQLTransaction.cpp
index 149b384..165685b 100644
--- a/WebCore/storage/SQLTransaction.cpp
+++ b/WebCore/storage/SQLTransaction.cpp
@@ -40,7 +40,6 @@
 #include "Logging.h"
 #include "Page.h"
 #include "PlatformString.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
 #include "SQLError.h"
 #include "SQLiteTransaction.h"
diff --git a/WebCore/storage/SQLTransactionClient.cpp b/WebCore/storage/SQLTransactionClient.cpp
index e72f5ed..5918bd8 100644
--- a/WebCore/storage/SQLTransactionClient.cpp
+++ b/WebCore/storage/SQLTransactionClient.cpp
@@ -47,7 +47,7 @@ void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
     ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
     Database* database = transaction->database();
     DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(
-        database->document()->securityOrigin(), database->stringIdentifier());
+        database->securityOrigin(), database->stringIdentifier());
 }
 
 void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
@@ -65,11 +65,9 @@ bool SQLTransactionClient::didExceedQuota(SQLTransaction* transaction)
     Page* page = database->document()->page();
     ASSERT(page);
 
-    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
-
-    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     page->chrome()->client()->exceededDatabaseQuota(database->document()->frame(), database->stringIdentifier());
-    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     return (newQuota > currentQuota);
 }
 
diff --git a/WebCore/storage/StorageEvent.cpp b/WebCore/storage/StorageEvent.cpp
index f3b3b70..13ccfe9 100644
--- a/WebCore/storage/StorageEvent.cpp
+++ b/WebCore/storage/StorageEvent.cpp
@@ -28,7 +28,6 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
 #include "Storage.h"
 
 namespace WebCore {
@@ -42,23 +41,22 @@ StorageEvent::StorageEvent()
 {
 }
 
-PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+PassRefPtr<StorageEvent> StorageEvent::create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
 {
-    return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source, storageArea));
+    return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, storageArea));
 }
 
-StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
     : Event(type, false, true)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
     , m_uri(uri)
-    , m_source(source)
     , m_storageArea(storageArea)
 {
 }
 
-void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
+void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea)
 {
     if (dispatched())
         return;
@@ -69,7 +67,6 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
     m_oldValue = oldValue;
     m_newValue = newValue;
     m_uri = uri;
-    m_source = source;
     m_storageArea = storageArea;
 }
 
diff --git a/WebCore/storage/StorageEvent.h b/WebCore/storage/StorageEvent.h
index 7e2bcff..fa7535b 100644
--- a/WebCore/storage/StorageEvent.h
+++ b/WebCore/storage/StorageEvent.h
@@ -33,37 +33,34 @@
 
 namespace WebCore {
 
-    class DOMWindow;
     class Storage;
 
     class StorageEvent : public Event {
     public:
         static PassRefPtr<StorageEvent> create();
-        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         const String& key() const { return m_key; }
         const String& oldValue() const { return m_oldValue; }
         const String& newValue() const { return m_newValue; }
         const String& uri() const { return m_uri; }
-        DOMWindow* source() const { return m_source.get(); }
         Storage* storageArea() const { return m_storageArea.get(); }
 
-        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg,  Storage storageAreaArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, Storage storageAreaArg);
 
         virtual bool isStorageEvent() const { return true; }
 
     private:
         StorageEvent();
-        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, Storage* storageArea);
 
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
-        RefPtr<DOMWindow> m_source;
         RefPtr<Storage> m_storageArea;
     };
 
diff --git a/WebCore/storage/StorageEvent.idl b/WebCore/storage/StorageEvent.idl
index 5a3f993..7c87561 100644
--- a/WebCore/storage/StorageEvent.idl
+++ b/WebCore/storage/StorageEvent.idl
@@ -33,12 +33,11 @@ module storage {
         readonly attribute [ConvertNullStringTo=Null] DOMString oldValue;
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
-        readonly attribute DOMWindow source;
         readonly attribute Storage storageArea;
-        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
+        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Storage storageAreaArg);
     };
 
 }
diff --git a/WebCore/storage/StorageEventDispatcher.cpp b/WebCore/storage/StorageEventDispatcher.cpp
index 496ff6d..9763e07 100644
--- a/WebCore/storage/StorageEventDispatcher.cpp
+++ b/WebCore/storage/StorageEventDispatcher.cpp
@@ -55,7 +55,7 @@ void StorageEventDispatcher::dispatch(const String& key, const String& oldValue,
         }
 
         for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->sessionStorage()));
     } else {
         // Send events to every page.
         const HashSet<Page*>& pages = page->group().pages();
@@ -68,7 +68,7 @@ void StorageEventDispatcher::dispatch(const String& key, const String& oldValue,
         }
 
         for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->localStorage()));
     }
 }
 
diff --git a/WebCore/svg/LinearGradientAttributes.h b/WebCore/svg/LinearGradientAttributes.h
index fc59465..0aefbac 100644
--- a/WebCore/svg/LinearGradientAttributes.h
+++ b/WebCore/svg/LinearGradientAttributes.h
@@ -29,10 +29,10 @@
 namespace WebCore {
     struct LinearGradientAttributes : GradientAttributes {
         LinearGradientAttributes()
-            : m_x1(0.0)
-            , m_y1(0.0)
-            , m_x2(1.0)
-            , m_y2(0.0)
+            : m_x1()
+            , m_y1()
+            , m_x2(LengthModeWidth, "100%")
+            , m_y2()
             , m_x1Set(false)
             , m_y1Set(false)
             , m_x2Set(false)
@@ -40,15 +40,15 @@ namespace WebCore {
         {
         }
 
-        double x1() const { return m_x1; }
-        double y1() const { return m_y1; }
-        double x2() const { return m_x2; }
-        double y2() const { return m_y2; }
+        SVGLength x1() const { return m_x1; }
+        SVGLength y1() const { return m_y1; }
+        SVGLength x2() const { return m_x2; }
+        SVGLength y2() const { return m_y2; }
 
-        void setX1(double value) { m_x1 = value; m_x1Set = true; }
-        void setY1(double value) { m_y1 = value; m_y1Set = true; }
-        void setX2(double value) { m_x2 = value; m_x2Set = true; }
-        void setY2(double value) { m_y2 = value; m_y2Set = true; }
+        void setX1(const SVGLength& value) { m_x1 = value; m_x1Set = true; }
+        void setY1(const SVGLength& value) { m_y1 = value; m_y1Set = true; }
+        void setX2(const SVGLength& value) { m_x2 = value; m_x2Set = true; }
+        void setY2(const SVGLength& value) { m_y2 = value; m_y2Set = true; }
 
         bool hasX1() const { return m_x1Set; }
         bool hasY1() const { return m_y1Set; }
@@ -57,10 +57,10 @@ namespace WebCore {
 
     private:
         // Properties
-        double m_x1;
-        double m_y1;
-        double m_x2;
-        double m_y2;
+        SVGLength m_x1;
+        SVGLength m_y1;
+        SVGLength m_x2;
+        SVGLength m_y2;
 
         // Property states
         bool m_x1Set : 1;
diff --git a/WebCore/svg/RadialGradientAttributes.h b/WebCore/svg/RadialGradientAttributes.h
index 273cd29..7645721 100644
--- a/WebCore/svg/RadialGradientAttributes.h
+++ b/WebCore/svg/RadialGradientAttributes.h
@@ -29,11 +29,11 @@
 namespace WebCore {
     struct RadialGradientAttributes : GradientAttributes {
         RadialGradientAttributes()
-            : m_cx(0.5)
-            , m_cy(0.5)
-            , m_r(0.5)
-            , m_fx(0.0)
-            , m_fy(0.0)
+            : m_cx(LengthModeWidth, "50%")
+            , m_cy(LengthModeWidth, "50%")
+            , m_r(LengthModeWidth, "50%")
+            , m_fx()
+            , m_fy()
             , m_cxSet(false)
             , m_cySet(false)
             , m_rSet(false)
@@ -42,17 +42,17 @@ namespace WebCore {
         {
         }
 
-        double cx() const { return m_cx; }
-        double cy() const { return m_cy; }
-        double r() const { return m_r; }
-        double fx() const { return m_fx; }
-        double fy() const { return m_fy; }
+        SVGLength cx() const { return m_cx; }
+        SVGLength cy() const { return m_cy; }
+        SVGLength r() const { return m_r; }
+        SVGLength fx() const { return m_fx; }
+        SVGLength fy() const { return m_fy; }
 
-        void setCx(double value) { m_cx = value; m_cxSet = true; }
-        void setCy(double value) { m_cy = value; m_cySet = true; }
-        void setR(double value) { m_r = value; m_rSet = true; }
-        void setFx(double value) { m_fx = value; m_fxSet = true; }
-        void setFy(double value) { m_fy = value; m_fySet = true; }
+        void setCx(const SVGLength& value) { m_cx = value; m_cxSet = true; }
+        void setCy(const SVGLength& value) { m_cy = value; m_cySet = true; }
+        void setR(const SVGLength& value) { m_r = value; m_rSet = true; }
+        void setFx(const SVGLength& value) { m_fx = value; m_fxSet = true; }
+        void setFy(const SVGLength& value) { m_fy = value; m_fySet = true; }
 
         bool hasCx() const { return m_cxSet; }
         bool hasCy() const { return m_cySet; }
@@ -62,11 +62,11 @@ namespace WebCore {
 
     private:
         // Properties
-        double m_cx;
-        double m_cy;
-        double m_r;
-        double m_fx;
-        double m_fy;
+        SVGLength m_cx;
+        SVGLength m_cy;
+        SVGLength m_r;
+        SVGLength m_fx;
+        SVGLength m_fy;
 
         // Property states
         bool m_cxSet : 1;
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index 639e3e0..7cb7b3e 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderTypes.h"
 #include "KeyboardEvent.h"
 #include "MappedAttribute.h"
 #include "MouseEvent.h"
@@ -54,6 +55,7 @@ SVGAElement::SVGAElement(const QualifiedName& tagName, Document *doc)
     , SVGExternalResourcesRequired()
     , m_target(this, SVGNames::targetAttr)
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -153,7 +155,7 @@ void SVGAElement::defaultEventHandler(Event* evt)
             }
 #endif
             if (document()->frame())
-                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true);
+                document()->frame()->loader()->urlSelected(document()->completeURL(url), target, evt, false, false, true, SendReferrer);
         }
 
         evt->setDefaultHandled();
diff --git a/WebCore/svg/SVGAElement.h b/WebCore/svg/SVGAElement.h
index 77cec67..a3e59c5 100644
--- a/WebCore/svg/SVGAElement.h
+++ b/WebCore/svg/SVGAElement.h
@@ -3,8 +3,6 @@
                   2004, 2005 Rob Buis <buis@kde.org>
                   2007 Eric Seidel <eric@webkit.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,14 +58,16 @@ namespace WebCore {
 
         virtual bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGNames::aTagString, SVGNames::targetAttrString, String, Target, target)
 
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGAllInOne.cpp b/WebCore/svg/SVGAllInOne.cpp
index 6ca4539..6606243 100644
--- a/WebCore/svg/SVGAllInOne.cpp
+++ b/WebCore/svg/SVGAllInOne.cpp
@@ -67,6 +67,7 @@
 #include "SVGFELightElement.cpp"
 #include "SVGFEMergeElement.cpp"
 #include "SVGFEMergeNodeElement.cpp"
+#include "SVGFEMorphologyElement.cpp"
 #include "SVGFEOffsetElement.cpp"
 #include "SVGFEPointLightElement.cpp"
 #include "SVGFESpecularLightingElement.cpp"
@@ -149,3 +150,4 @@
 #include "SVGViewSpec.cpp"
 #include "SVGZoomAndPan.cpp"
 #include "SVGZoomEvent.cpp"
+#include "SynchronizablePropertyController.cpp"
diff --git a/WebCore/svg/SVGAltGlyphElement.h b/WebCore/svg/SVGAltGlyphElement.h
index 7c67a71..b571880 100644
--- a/WebCore/svg/SVGAltGlyphElement.h
+++ b/WebCore/svg/SVGAltGlyphElement.h
@@ -47,9 +47,6 @@ namespace WebCore {
     
         SVGGlyphElement* glyphElement() const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:    
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGAltGlyphElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
diff --git a/WebCore/svg/SVGAnimatedProperty.h b/WebCore/svg/SVGAnimatedProperty.h
index 6803055..984046f 100644
--- a/WebCore/svg/SVGAnimatedProperty.h
+++ b/WebCore/svg/SVGAnimatedProperty.h
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -62,14 +63,16 @@ namespace WebCore {
     struct IsDerivedFromSVGElement;
 
     // Helper template used for synchronizing SVG <-> XML properties
-    template<typename OwnerElement, typename DecoratedType>
-    void synchronizeProperty(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue);
+    template<typename OwnerType, typename DecoratedType, bool isDerivedFromSVGElement>
+    struct PropertySynchronizer;
 
     // Abstract base class
     class SVGAnimatedPropertyBase : public Noncopyable {
     public:
         virtual ~SVGAnimatedPropertyBase() { }
         virtual void synchronize() const = 0;
+        virtual void startAnimation() const = 0;
+        virtual void stopAnimation() = 0;
     };
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -124,6 +127,7 @@ namespace WebCore {
         // Tear offs only used by bindings, never in internal code
         PassRefPtr<TearOff> animatedTearOff() const;
 
+        void registerProperty();
         virtual void synchronize() const;
 
         void startAnimation() const;
@@ -140,6 +144,10 @@ namespace WebCore {
         const AtomicString& m_attributeIdentifier;
 
         mutable SynchronizableTypeWrapper<StorableType> m_value;
+
+#ifndef NDEBUG
+        bool m_registered;
+#endif
     };
 
     // SVGAnimatedPropertyTearOff implementation
@@ -186,8 +194,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value()
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -198,8 +210,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value()
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -211,8 +227,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -225,8 +245,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -239,8 +263,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1, arg2)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -254,8 +282,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1, arg2)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -269,8 +301,12 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeName.localName())
         , m_value(arg1, arg2, arg3)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
@@ -285,20 +321,26 @@ namespace WebCore {
         , m_attributeName(attributeName)
         , m_attributeIdentifier(attributeIdentifier)
         , m_value(arg1, arg2, arg3)
+#ifndef NDEBUG
+        , m_registered(false)
+#endif
     {
         ASSERT(m_ownerType);
+        registerProperty();
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::value() const
     {
+        ASSERT(m_registered);
         return m_value;
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setValue(typename SVGAnimatedProperty::DecoratedType newValue)
     {
+        ASSERT(m_registered);
         m_value = newValue;
         ownerElement()->setSynchronizedSVGAttributes(false);
     }
@@ -307,6 +349,7 @@ namespace WebCore {
     typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::DecoratedType
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::baseValue() const
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
         SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
         if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier))
@@ -318,6 +361,7 @@ namespace WebCore {
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::setBaseValue(typename SVGAnimatedProperty::DecoratedType newValue)
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
         SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
         if (extensions && extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier)) {
@@ -334,25 +378,38 @@ namespace WebCore {
     PassRefPtr<typename SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::TearOff>
     SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::animatedTearOff() const
     {
+        ASSERT(m_registered);
         return lookupOrCreateWrapper<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName, TearOff, OwnerElement>(*this, ownerElement(), m_attributeName, m_attributeIdentifier);
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
+    void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::registerProperty()
+    {
+        ASSERT(!m_registered);
+        ownerElement()->propertyController().registerProperty(m_attributeName, this);
+
+#ifndef NDEBUG
+        m_registered = true;
+#endif
+    }
+
+    template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::synchronize() const
     {
+        ASSERT(m_registered);
         if (!m_value.needsSynchronization()) 
             return; 
 
-        synchronizeProperty<OwnerElement, DecoratedType>(ownerElement(), m_attributeName, baseValue());
+        PropertySynchronizer<OwnerElement, DecoratedType, IsDerivedFromSVGElement<OwnerType>::value>::synchronize(ownerElement(), m_attributeName, baseValue());
         m_value.setSynchronized(); 
     }
 
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::startAnimation() const
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions) {
+        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
             ASSERT(!extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
             extensions->setBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier, m_value);
         }
@@ -361,12 +418,12 @@ namespace WebCore {
     template<typename OwnerTypeArg, typename AnimatedTypeArg, const char* TagName, const char* PropertyName>
     void SVGAnimatedProperty<OwnerTypeArg, AnimatedTypeArg, TagName, PropertyName>::stopAnimation()
     {
+        ASSERT(m_registered);
         const OwnerElement* ownerElement = this->ownerElement();
-        SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions();
-        if (extensions) {
+        if (SVGDocumentExtensions* extensions = ownerElement->accessDocumentSVGExtensions()) {
             ASSERT(extensions->hasBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
             setValue(extensions->baseValue<DecoratedType>(ownerElement, m_attributeIdentifier));
-            extensions->removeBaseValue<AnimatedType>(ownerElement, m_attributeIdentifier);
+            extensions->removeBaseValue<DecoratedType>(ownerElement, m_attributeIdentifier);
         }
     }
 
@@ -406,39 +463,37 @@ namespace WebCore {
         static const bool value = true;
     };
 
-    class SVGExternalResourcesRequired;
-    template<>
-    struct IsDerivedFromSVGElement<SVGExternalResourcesRequired> : Noncopyable {
-        static const bool value = false;
-    };
-
-    class SVGFitToViewBox;
+    class SVGViewSpec;
     template<>
-    struct IsDerivedFromSVGElement<SVGFitToViewBox> : Noncopyable {
+    struct IsDerivedFromSVGElement<SVGViewSpec> : Noncopyable {
         static const bool value = false;
     };
 
-    class SVGURIReference;
-    template<>
-    struct IsDerivedFromSVGElement<SVGURIReference> : Noncopyable {
-        static const bool value = false;
+    // PropertySynchronizer implementation
+    template<typename OwnerElement, typename DecoratedType>
+    struct PropertySynchronizer<OwnerElement, DecoratedType, true> : Noncopyable {
+        static void synchronize(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
+        {
+            AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
+
+            NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
+            Attribute* old = namedAttrMap->getAttributeItem(attributeName);
+            if (old && value.isNull()) 
+                namedAttrMap->removeAttribute(old->name()); 
+            else if (!old && !value.isNull()) 
+                namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
+            else if (old && !value.isNull()) 
+                old->setValue(value); 
+        }
     };
 
-    // Central function handling the main SVG<->XML synchronization part.
     template<typename OwnerElement, typename DecoratedType>
-    void synchronizeProperty(const OwnerElement* ownerElement, const QualifiedName& attributeName, DecoratedType baseValue)
-    {
-        AtomicString value(SVGAnimatedTypeValue<DecoratedType>::toString(baseValue));
-
-        NamedNodeMap* namedAttrMap = ownerElement->attributes(false); 
-        Attribute* old = namedAttrMap->getAttributeItem(attributeName);
-        if (old && value.isNull()) 
-            namedAttrMap->removeAttribute(old->name()); 
-        else if (!old && !value.isNull()) 
-            namedAttrMap->addAttribute(const_cast<OwnerElement*>(ownerElement)->createAttribute(attributeName, value));
-        else if (old && !value.isNull()) 
-            old->setValue(value); 
-    }
+    struct PropertySynchronizer<OwnerElement, DecoratedType, false> : Noncopyable {
+        static void synchronize(const OwnerElement*, const QualifiedName&, DecoratedType)
+        {
+            // no-op, for types not inheriting from Element, thus nothing to synchronize
+        }
+    };
 
     // Helper macro used to register animated properties within SVG* classes
     #define ANIMATED_PROPERTY_DECLARATIONS(OwnerType, ElementTag, AttributeTag, AnimatedType, UpperProperty, LowerProperty) \
@@ -451,8 +506,7 @@ namespace WebCore {
         void set##UpperProperty(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setValue(type); } \
         DecoratedTypeFor##UpperProperty LowerProperty##BaseValue() const { return m_##LowerProperty.baseValue(); } \
         void set##UpperProperty##BaseValue(DecoratedTypeFor##UpperProperty type) { m_##LowerProperty.setBaseValue(type); } \
-        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); } \
-        void synchronize##UpperProperty() const { m_##LowerProperty.synchronize(); }
+        PassRefPtr<SVGAnimatedProperty##UpperProperty::TearOff> LowerProperty##Animated() const { return m_##LowerProperty.animatedTearOff(); }
 
 };
 
diff --git a/WebCore/svg/SVGAnimatedTemplate.h b/WebCore/svg/SVGAnimatedTemplate.h
index 3f04c5b..e7c49c1 100644
--- a/WebCore/svg/SVGAnimatedTemplate.h
+++ b/WebCore/svg/SVGAnimatedTemplate.h
@@ -158,7 +158,7 @@ namespace WebCore {
 
         if (!wrapper) {
             wrapper = Type::create(creator, element, attrName);
-            element->addSVGPropertySynchronizer(attrName, creator);
+            element->propertyController().setPropertyNeedsSynchronization(attrName);
             Type::wrapperCache()->set(key, wrapper.get());
         }
 
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index cf945f8..67e32e0 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -52,7 +52,8 @@ namespace WebCore {
 SVGAnimationElement::SVGAnimationElement(const QualifiedName& tagName, Document* doc)
     : SVGSMILElement(tagName, doc)
     , SVGTests()
-    , SVGExternalResourcesRequired()
+    , SVGExternalResourcesRequired() 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_animationValid(false)
 {
 }
diff --git a/WebCore/svg/SVGAnimationElement.h b/WebCore/svg/SVGAnimationElement.h
index 1835a8d..b0b091b 100644
--- a/WebCore/svg/SVGAnimationElement.h
+++ b/WebCore/svg/SVGAnimationElement.h
@@ -1,12 +1,10 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -66,8 +64,6 @@ namespace WebCore {
         static bool attributeIsCSS(const String& attributeName);
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
- 
         enum CalcMode { CalcModeDiscrete, CalcModeLinear, CalcModePaced, CalcModeSpline };
         CalcMode calcMode() const;
         
@@ -109,6 +105,11 @@ namespace WebCore {
         float calculatePercentForSpline(float percent, unsigned splineIndex) const;
         
     protected:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAnimationElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         bool m_animationValid;
 
         Vector<String> m_values;
diff --git a/WebCore/svg/SVGCircleElement.cpp b/WebCore/svg/SVGCircleElement.cpp
index 0c48f51..2329299 100644
--- a/WebCore/svg/SVGCircleElement.cpp
+++ b/WebCore/svg/SVGCircleElement.cpp
@@ -41,6 +41,7 @@ SVGCircleElement::SVGCircleElement(const QualifiedName& tagName, Document* doc)
     , m_cx(this, SVGNames::cxAttr, LengthModeWidth)
     , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
     , m_r(this, SVGNames::rAttr, LengthModeOther)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGCircleElement.h b/WebCore/svg/SVGCircleElement.h
index 598e51f..69b015d 100644
--- a/WebCore/svg/SVGCircleElement.h
+++ b/WebCore/svg/SVGCircleElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,13 +45,17 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cxAttrString, SVGLength, Cx, cx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGNames::circleTagString, SVGNames::rAttrString, SVGLength, R, r)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCircleElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGClipPathElement.cpp b/WebCore/svg/SVGClipPathElement.cpp
index 691e4d5..bbeac91 100644
--- a/WebCore/svg/SVGClipPathElement.cpp
+++ b/WebCore/svg/SVGClipPathElement.cpp
@@ -40,6 +40,7 @@ SVGClipPathElement::SVGClipPathElement(const QualifiedName& tagName, Document* d
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_clipPathUnits(this, SVGNames::clipPathUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGClipPathElement.h b/WebCore/svg/SVGClipPathElement.h
index 4043554..6079159 100644
--- a/WebCore/svg/SVGClipPathElement.h
+++ b/WebCore/svg/SVGClipPathElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,12 +47,14 @@ namespace WebCore {
 
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGNames::clipPathTagString, SVGNames::clipPathUnitsAttrString, int, ClipPathUnits, clipPathUnits)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGClipPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         RefPtr<SVGResourceClipper> m_clipper;
     };
 
diff --git a/WebCore/svg/SVGCursorElement.cpp b/WebCore/svg/SVGCursorElement.cpp
index 5b408f8..b282aa3 100644
--- a/WebCore/svg/SVGCursorElement.cpp
+++ b/WebCore/svg/SVGCursorElement.cpp
@@ -41,6 +41,7 @@ SVGCursorElement::SVGCursorElement(const QualifiedName& tagName, Document* doc)
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGCursorElement.h b/WebCore/svg/SVGCursorElement.h
index 71963b6..ee919a4 100644
--- a/WebCore/svg/SVGCursorElement.h
+++ b/WebCore/svg/SVGCursorElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -50,9 +48,6 @@ namespace WebCore {
 
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::yAttrString, SVGLength, Y, y)
@@ -60,6 +55,11 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         HashSet<SVGElement*> m_clients;
     };
 
diff --git a/WebCore/svg/SVGDefsElement.cpp b/WebCore/svg/SVGDefsElement.cpp
index b084bb2..c03c09b 100644
--- a/WebCore/svg/SVGDefsElement.cpp
+++ b/WebCore/svg/SVGDefsElement.cpp
@@ -34,6 +34,7 @@ SVGDefsElement::SVGDefsElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGDefsElement.h b/WebCore/svg/SVGDefsElement.h
index c4cac62..4bb206e 100644
--- a/WebCore/svg/SVGDefsElement.h
+++ b/WebCore/svg/SVGDefsElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -43,8 +41,11 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGDefsElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGElement.cpp b/WebCore/svg/SVGElement.cpp
index d455717..27e8c04 100644
--- a/WebCore/svg/SVGElement.cpp
+++ b/WebCore/svg/SVGElement.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
     Copyright (C) 2008 Alp Toker <alp@atoker.com>
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -77,16 +78,6 @@ bool SVGElement::isSupported(StringImpl* feature, StringImpl* version) const
     return DOMImplementation::hasFeature(feature, version);
 }
 
-String SVGElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void SVGElement::setId(const String& value, ExceptionCode&)
-{
-    setAttribute(idAttr, value);
-}
-
 String SVGElement::xmlbase() const
 {
     return getAttribute(XMLNames::baseAttr);
@@ -243,7 +234,7 @@ void SVGElement::insertedIntoDocument()
     StyledElement::insertedIntoDocument();
     SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
 
-    String resourceId = SVGURIReference::getTarget(id());
+    String resourceId = SVGURIReference::getTarget(getAttribute(idAttr));
     if (extensions->isPendingResource(resourceId)) {
         std::auto_ptr<HashSet<SVGStyledElement*> > clients(extensions->removePendingResource(resourceId));
         if (clients->isEmpty())
@@ -279,10 +270,10 @@ void SVGElement::updateAnimatedSVGAttribute(const String& name) const
     m_synchronizingSVGAttributes = true;
 
     if (name.isEmpty()) {
-        invokeAllSVGPropertySynchronizers();
+        m_propertyController.synchronizeAllProperties();
         setSynchronizedSVGAttributes(true);
     } else
-        invokeSVGPropertySynchronizer(name);
+        m_propertyController.synchronizeProperty(name);
 
     m_synchronizingSVGAttributes = false;
 }
diff --git a/WebCore/svg/SVGElement.h b/WebCore/svg/SVGElement.h
index 3a17567..b247a74 100644
--- a/WebCore/svg/SVGElement.h
+++ b/WebCore/svg/SVGElement.h
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "StyledElement.h"
 #include "SVGAnimatedProperty.h"
+#include "SynchronizablePropertyController.h"
 
 namespace WebCore {
 
@@ -41,8 +42,6 @@ namespace WebCore {
         static PassRefPtr<SVGElement> create(const QualifiedName&, Document*);
         virtual ~SVGElement();
 
-        String id() const;
-        void setId(const String&, ExceptionCode&);
         String xmlbase() const;
         void setXmlbase(const String&, ExceptionCode&);
 
@@ -79,14 +78,11 @@ namespace WebCore {
 
         HashSet<SVGElementInstance*> instancesForElement() const;
 
-        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
-        {
-            m_svgPropertyMap.set(attrName.localName(), &base);
-        }
-
         void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
         void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
 
+        SynchronizablePropertyController& propertyController() const { return m_propertyController; }
+
     protected:
         SVGElement(const QualifiedName&, Document*);
 
@@ -108,36 +104,13 @@ namespace WebCore {
 
         virtual void buildPendingResource() { }
 
-        // Inlined methods handling SVG property synchronization
-        void invokeSVGPropertySynchronizer(const String& name) const
-        {
-            if (m_svgPropertyMap.contains(name)) {
-                const SVGAnimatedPropertyBase* property = m_svgPropertyMap.get(name);
-                ASSERT(property);
-
-                property->synchronize();
-            }
-        }
-
-        void invokeAllSVGPropertySynchronizers() const
-        {
-            HashMap<String, const SVGAnimatedPropertyBase*>::const_iterator it = m_svgPropertyMap.begin();
-            const HashMap<String, const SVGAnimatedPropertyBase*>::const_iterator end = m_svgPropertyMap.end();
-            for (; it != end; ++it) {
-                const SVGAnimatedPropertyBase* property = it->second;
-                ASSERT(property);
-
-                property->synchronize();
-            }
-        }
-
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
         virtual bool haveLoadedRequiredResources();
 
         ContainerNode* m_shadowParent;
-        mutable HashMap<String, const SVGAnimatedPropertyBase*> m_svgPropertyMap;
+        mutable SynchronizablePropertyController m_propertyController;
 
         SVGCursorElement* m_cursorElement;
         CSSCursorImageValue* m_cursorImageValue;
diff --git a/WebCore/svg/SVGElement.idl b/WebCore/svg/SVGElement.idl
index a1f331f..e4112c1 100644
--- a/WebCore/svg/SVGElement.idl
+++ b/WebCore/svg/SVGElement.idl
@@ -25,7 +25,7 @@
 module svg {
 
     interface [GenerateNativeConverter, Conditional=SVG] SVGElement : Element {
-                 attribute [ConvertNullToNullString] DOMString id
+                 attribute [ConvertNullToNullString, Reflect] DOMString id
                      setter raises(DOMException);
                  attribute [ConvertNullToNullString] DOMString xmlbase
                      setter raises(DOMException);
diff --git a/WebCore/svg/SVGEllipseElement.cpp b/WebCore/svg/SVGEllipseElement.cpp
index 6d56ff8..4c67ff3 100644
--- a/WebCore/svg/SVGEllipseElement.cpp
+++ b/WebCore/svg/SVGEllipseElement.cpp
@@ -42,6 +42,7 @@ SVGEllipseElement::SVGEllipseElement(const QualifiedName& tagName, Document* doc
     , m_cy(this, SVGNames::cyAttr, LengthModeHeight)
     , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
     , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }    
 
diff --git a/WebCore/svg/SVGEllipseElement.h b/WebCore/svg/SVGEllipseElement.h
index 8c7d3a1..5b54fd5 100644
--- a/WebCore/svg/SVGEllipseElement.h
+++ b/WebCore/svg/SVGEllipseElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,7 +45,6 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -55,6 +52,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::cyAttrString, SVGLength, Cy, cy)
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGNames::ellipseTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGEllipseElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGExternalResourcesRequired.cpp b/WebCore/svg/SVGExternalResourcesRequired.cpp
index 640f92e..201ecbf 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.cpp
+++ b/WebCore/svg/SVGExternalResourcesRequired.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 char SVGExternalResourcesRequiredIdentifier[] = "SVGExternalResourcesRequired";
 
 SVGExternalResourcesRequired::SVGExternalResourcesRequired()
-    : m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGExternalResourcesRequired.h b/WebCore/svg/SVGExternalResourcesRequired.h
index e491e4b..f088c82 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/WebCore/svg/SVGExternalResourcesRequired.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -32,16 +30,11 @@ namespace WebCore {
     extern char SVGExternalResourcesRequiredIdentifier[];
     class MappedAttribute;
 
-    // FIXME: This is wrong for several reasons:
-    // 1. externalResourcesRequired is not animateable according to SVG 1.1 section 5.9
-    // 2. externalResourcesRequired should just be part of SVGElement, and default to "false" for all elements
-    /*
-     SPEC: Note that the SVG DOM 
-     defines the attribute externalResourcesRequired as being of type SVGAnimatedBoolean, whereas the 
-     SVG language definition says that externalResourcesRequired is not animated. Because the SVG 
-     language definition states that externalResourcesRequired cannot be animated, the animVal will 
-     always be the same as the baseVal.
-     */
+    // Notes on a SVG 1.1 spec discrepancy:
+    // The SVG DOM defines the attribute externalResourcesRequired as being of type SVGAnimatedBoolean, whereas the 
+    // SVG language definition says that externalResourcesRequired is not animated. Because the SVG language definition
+    // states that externalResourcesRequired cannot be animated, the animVal will always be the same as the baseVal.
+    // FIXME: When implementing animVal support, make sure that animVal==baseVal for externalResourcesRequired
     class SVGExternalResourcesRequired {
     public:
         SVGExternalResourcesRequired();
@@ -50,12 +43,8 @@ namespace WebCore {
         bool parseMappedAttribute(MappedAttribute*);
         bool isKnownAttribute(const QualifiedName&);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGExternalResourcesRequired, SVGExternalResourcesRequiredIdentifier,
-                                       SVGNames::externalResourcesRequiredAttrString, bool,
-                                       ExternalResourcesRequired, externalResourcesRequired)
+    protected:
+        virtual void setExternalResourcesRequiredBaseValue(SVGAnimatedTypeValue<bool>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFECompositeElement.idl b/WebCore/svg/SVGFECompositeElement.idl
index 97a13fc..d317997 100644
--- a/WebCore/svg/SVGFECompositeElement.idl
+++ b/WebCore/svg/SVGFECompositeElement.idl
@@ -38,7 +38,7 @@ module svg {
 
         readonly attribute SVGAnimatedString      in1;
         readonly attribute SVGAnimatedString      in2;
-        readonly attribute SVGAnimatedEnumeration _operator;
+        readonly attribute SVGAnimatedEnumeration operator;
         readonly attribute SVGAnimatedNumber      k1;
         readonly attribute SVGAnimatedNumber      k2;
         readonly attribute SVGAnimatedNumber      k3;
diff --git a/WebCore/svg/SVGFEFloodElement.cpp b/WebCore/svg/SVGFEFloodElement.cpp
index ae5ce94..3d80799 100644
--- a/WebCore/svg/SVGFEFloodElement.cpp
+++ b/WebCore/svg/SVGFEFloodElement.cpp
@@ -34,7 +34,6 @@ namespace WebCore {
 
 SVGFEFloodElement::SVGFEFloodElement(const QualifiedName& tagName, Document* doc)
     : SVGFilterPrimitiveStandardAttributes(tagName, doc)
-    , m_in1(this, SVGNames::inAttr)
 {
 }
 
@@ -42,28 +41,14 @@ SVGFEFloodElement::~SVGFEFloodElement()
 {
 }
 
-void SVGFEFloodElement::parseMappedAttribute(MappedAttribute* attr)
-{
-    const String& value = attr->value();
-    if (attr->name() == SVGNames::inAttr)
-        setIn1BaseValue(value);
-    else
-        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
-}
-
 bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 {
-    FilterEffect* input = filterResource->builder()->getEffectById(in1());
-
-    if (!input)
-        return false;
-
     RefPtr<RenderStyle> filterStyle = styleForRenderer();
 
     Color color = filterStyle->svgStyle()->floodColor();
     float opacity = filterStyle->svgStyle()->floodOpacity();
 
-    RefPtr<FilterEffect> effect = FEFlood::create(input, color, opacity);
+    RefPtr<FilterEffect> effect = FEFlood::create(color, opacity);
     filterResource->addFilterEffect(this, effect.release());
     
     return true;
@@ -71,6 +56,6 @@ bool SVGFEFloodElement::build(SVGResourceFilter* filterResource)
 
 }
 
-#endif // ENABLE(SVG)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 // vim:ts=4:noet
diff --git a/WebCore/svg/SVGFEFloodElement.h b/WebCore/svg/SVGFEFloodElement.h
index ca4e18b..e83fc94 100644
--- a/WebCore/svg/SVGFEFloodElement.h
+++ b/WebCore/svg/SVGFEFloodElement.h
@@ -33,14 +33,10 @@ namespace WebCore {
         SVGFEFloodElement(const QualifiedName&, Document*);
         virtual ~SVGFEFloodElement();
 
-        virtual void parseMappedAttribute(MappedAttribute*);
         virtual bool build(SVGResourceFilter*);
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFEFloodElement, SVGNames::feFloodTagString, SVGNames::inAttrString, String, In1, in1)
     };
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 #endif
diff --git a/WebCore/svg/SVGFEFloodElement.idl b/WebCore/svg/SVGFEFloodElement.idl
index 814bbdf..b3c3180 100644
--- a/WebCore/svg/SVGFEFloodElement.idl
+++ b/WebCore/svg/SVGFEFloodElement.idl
@@ -27,8 +27,5 @@ module svg {
 
     interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEFloodElement : SVGElement,
                                                     SVGFilterPrimitiveStandardAttributes {
-
-        readonly attribute SVGAnimatedString      in1;
-
     };
 }
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.h b/WebCore/svg/SVGFEGaussianBlurElement.h
index 187c212..c9bb613 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -24,7 +24,7 @@
 #define SVGFEGaussianBlurElement_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
-#include "SVGFEGaussianBlur.h"
+#include "FEGaussianBlur.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index fade0f7..269d6b2 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -44,6 +44,7 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGFEImageElement.h b/WebCore/svg/SVGFEImageElement.h
index 0393c66..7c6d89b 100644
--- a/WebCore/svg/SVGFEImageElement.h
+++ b/WebCore/svg/SVGFEImageElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -49,15 +47,17 @@ namespace WebCore {
         virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
         virtual bool build(SVGResourceFilter*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         CachedResourceHandle<CachedImage> m_cachedImage;
     };
 
diff --git a/WebCore/svg/SVGFELightElement.h b/WebCore/svg/SVGFELightElement.h
index f6e79fb..92947a1 100644
--- a/WebCore/svg/SVGFELightElement.h
+++ b/WebCore/svg/SVGFELightElement.h
@@ -39,9 +39,6 @@ namespace WebCore {
         virtual LightSource* lightSource() const = 0;
         virtual void parseMappedAttribute(MappedAttribute*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::azimuthAttrString, float, Azimuth, azimuth)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFELightElement, SVGFELightElementIdentifier, SVGNames::elevationAttrString, float, Elevation, elevation)
diff --git a/WebCore/svg/SVGFEMergeElement.cpp b/WebCore/svg/SVGFEMergeElement.cpp
index cb3a781..8f4eed9 100644
--- a/WebCore/svg/SVGFEMergeElement.cpp
+++ b/WebCore/svg/SVGFEMergeElement.cpp
@@ -45,6 +45,8 @@ bool SVGFEMergeElement::build(SVGResourceFilter* filterResource)
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         if (n->hasTagName(SVGNames::feMergeNodeTag)) {
             FilterEffect* mergeEffect = filterResource->builder()->getEffectById(static_cast<SVGFEMergeNodeElement*>(n)->in1());
+            if (!mergeEffect)
+                return false;
             mergeInputs.append(mergeEffect);
         }
     }
diff --git a/WebCore/svg/SVGFEMergeNodeElement.h b/WebCore/svg/SVGFEMergeNodeElement.h
index 4633f98..cdec8d2 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/WebCore/svg/SVGFEMergeNodeElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,9 +34,6 @@ namespace WebCore {
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEMergeNodeElement, SVGNames::feMergeNodeTagString, SVGNames::inAttrString, String, In1, in1)
     };
diff --git a/WebCore/svg/SVGFEMorphologyElement.cpp b/WebCore/svg/SVGFEMorphologyElement.cpp
new file mode 100644
index 0000000..4a06188
--- /dev/null
+++ b/WebCore/svg/SVGFEMorphologyElement.cpp
@@ -0,0 +1,88 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEMorphologyElement.h"
+
+#include "MappedAttribute.h"
+#include "SVGNames.h"
+#include "SVGParserUtilities.h"
+#include "SVGResourceFilter.h"
+
+namespace WebCore {
+
+char SVGRadiusXAttrIdentifier[] = "SVGRadiusXAttr";
+char SVGRadiusYAttrIdentifier[] = "SVGRadiusYAttr";
+
+SVGFEMorphologyElement::SVGFEMorphologyElement(const QualifiedName& tagName, Document* document)
+    : SVGFilterPrimitiveStandardAttributes(tagName, document)
+    , m_in1(this, SVGNames::inAttr)
+    , m__operator(this, SVGNames::operatorAttr, FEMORPHOLOGY_OPERATOR_ERODE)
+    , m_radiusX(this, SVGNames::radiusAttr)
+    , m_radiusY(this, SVGNames::radiusAttr)
+{
+}
+
+SVGFEMorphologyElement::~SVGFEMorphologyElement()
+{
+}
+
+void SVGFEMorphologyElement::setRadius(float, float)
+{
+    // FIXME: Needs an implementation.
+}
+
+void SVGFEMorphologyElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    const String& value = attr->value();
+    if (attr->name() == SVGNames::operatorAttr) {
+        if (value == "erode")
+            set_operatorBaseValue(FEMORPHOLOGY_OPERATOR_ERODE);
+        else if (value == "dilate")
+            set_operatorBaseValue(FEMORPHOLOGY_OPERATOR_DILATE);
+    } else if (attr->name() == SVGNames::inAttr)
+        setIn1BaseValue(value);
+    else if (attr->name() == SVGNames::radiusAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setRadiusXBaseValue(x);
+            setRadiusYBaseValue(y);
+        }
+    } else
+        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
+}
+
+bool SVGFEMorphologyElement::build(SVGResourceFilter* filterResource)
+{
+    FilterEffect* input1 = filterResource->builder()->getEffectById(in1());
+
+    if (!input1)
+        return false;
+
+    RefPtr<FilterEffect> effect = FEMorphology::create(input1, static_cast<MorphologyOperatorType>(_operator()), radiusX(), radiusY());
+    filterResource->addFilterEffect(this, effect.release());
+    
+    return true;
+}
+
+} //namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGFEMorphologyElement.h b/WebCore/svg/SVGFEMorphologyElement.h
new file mode 100644
index 0000000..6c1aec1
--- /dev/null
+++ b/WebCore/svg/SVGFEMorphologyElement.h
@@ -0,0 +1,52 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGFEMorphologyElement_h
+#define SVGFEMorphologyElement_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEMorphology.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+
+namespace WebCore {
+
+    extern char SVGRadiusXAttrIdentifier[];
+    extern char SVGRadiusYAttrIdentifier[];
+
+    class SVGFEMorphologyElement : public SVGFilterPrimitiveStandardAttributes {
+    public:
+        SVGFEMorphologyElement(const QualifiedName&, Document*);
+        virtual ~SVGFEMorphologyElement();
+
+        void setRadius(float radiusX, float radiusY);
+
+        virtual void parseMappedAttribute(MappedAttribute*);
+        virtual bool build(SVGResourceFilter*);
+
+    private:
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::inAttrString, String, In1, in1)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGNames::operatorAttrString, int, _operator, _operator)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusXAttrIdentifier, float, RadiusX, radiusX)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEMorphologyElement, SVGNames::feMorphologyTagString, SVGRadiusYAttrIdentifier, float, RadiusY, radiusY)
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.h b/WebCore/svg/SVGFEMorphologyElement.idl
index e6fe7f5..cce0e36 100644
--- a/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/WebCore/svg/SVGFEMorphologyElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,37 +20,24 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSHTMLAllCollection_h
-#define JSHTMLAllCollection_h
+module svg {
 
-#include "HTMLCollection.h"
-#include "JSHTMLCollection.h"
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEMorphologyElement : SVGElement,
+                                                             SVGFilterPrimitiveStandardAttributes {
+        // Morphology Operators
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_UNKNOWN  = 0;
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_ERODE    = 1;
+        const unsigned short SVG_MORPHOLOGY_OPERATOR_DILATE   = 2;
 
-namespace WebCore {
+        readonly attribute SVGAnimatedString      in1;
+        readonly attribute SVGAnimatedEnumeration operator;
+        readonly attribute SVGAnimatedNumber      radiusX;
+        readonly attribute SVGAnimatedNumber      radiusY;
 
-    class HTMLCollection;
-
-    class JSHTMLAllCollection : public JSHTMLCollection {
-    public:
-        JSHTMLAllCollection(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
-            : JSHTMLCollection(structure, globalObject, collection)
-        {
-        }
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
-        { 
-            return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
-        }
-
-        static const JSC::ClassInfo s_info;
-
-    private:
-        virtual bool toBoolean(JSC::ExecState*) const { return false; }
+        void setRadius(in float radiusX, in float radiusY);
     };
 
-} // namespace WebCore
-
-#endif // JSHTMLAllCollection_h
+}
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index bc39475..db46179 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
     Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
 
     This file is part of the KDE project
 
@@ -55,6 +56,7 @@ SVGFilterElement::SVGFilterElement(const QualifiedName& tagName, Document* doc)
     , m_filterResX(this, SVGNames::filterResAttr)
     , m_filterResY(this, SVGNames::filterResAttr)
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -101,39 +103,36 @@ void SVGFilterElement::parseMappedAttribute(MappedAttribute* attr)
     }
 }
 
-SVGResource* SVGFilterElement::canvasResource()
+void SVGFilterElement::buildFilter(const FloatRect& targetRect) const
 {
-    if (!attached())
-        return 0;
-
-    if (!m_filter)
-        m_filter = new SVGResourceFilter();
-
     bool filterBBoxMode = filterUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
-    m_filter->setFilterBoundingBoxMode(filterBBoxMode);
-
-    float _x, _y, _width, _height;
-
-    if (filterBBoxMode) {
-        _x = x().valueAsPercentage();
-        _y = y().valueAsPercentage();
-        _width = width().valueAsPercentage();
-        _height = height().valueAsPercentage();
-    } else {
-        m_filter->setXBoundingBoxMode(x().unitType() == LengthTypePercentage);
-        m_filter->setYBoundingBoxMode(y().unitType() == LengthTypePercentage);
-
-        _x = x().value(this);
-        _y = y().value(this);
-        _width = width().value(this);
-        _height = height().value(this);
-    } 
-
-    m_filter->setFilterRect(FloatRect(_x, _y, _width, _height));
-
     bool primitiveBBoxMode = primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
+
+    FloatRect filterBBox;
+    if (filterBBoxMode)
+        filterBBox = FloatRect(x().valueAsPercentage(),
+                               y().valueAsPercentage(),
+                               width().valueAsPercentage(),
+                               height().valueAsPercentage());
+    else
+        filterBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    FloatRect filterRect = filterBBox;
+    if (filterBBoxMode)
+        filterRect = FloatRect(targetRect.x() + filterRect.x() * targetRect.width(),
+                               targetRect.y() + filterRect.y() * targetRect.height(),
+                               filterRect.width() * targetRect.width(),
+                               filterRect.height() * targetRect.height());
+
+    m_filter->setFilterBoundingBox(filterRect);
+    m_filter->setFilterRect(filterBBox);
     m_filter->setEffectBoundingBoxMode(primitiveBBoxMode);
+    m_filter->setFilterBoundingBoxMode(filterBBoxMode);
 
+    // Add effects to the filter
     m_filter->builder()->clearEffects();
     for (Node* n = firstChild(); n != 0; n = n->nextSibling()) {
         SVGElement* element = 0;
@@ -148,12 +147,18 @@ SVGResource* SVGFilterElement::canvasResource()
             }
         }
     }
+}
 
+SVGResource* SVGFilterElement::canvasResource()
+{
+    if (!attached())
+        return 0;
+
+    if (!m_filter)
+        m_filter = SVGResourceFilter::create(this);
     return m_filter.get();
 }
 
 }
 
-#endif // ENABLE(SVG)
-
-// vim:ts=4:noet
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/SVGFilterElement.h b/WebCore/svg/SVGFilterElement.h
index 64b21f6..836c689 100644
--- a/WebCore/svg/SVGFilterElement.h
+++ b/WebCore/svg/SVGFilterElement.h
@@ -3,8 +3,6 @@
     Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,9 +49,6 @@ namespace WebCore {
         virtual void parseMappedAttribute(MappedAttribute*);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::filterUnitsAttrString, int, FilterUnits, filterUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGNames::primitiveUnitsAttrString, int, PrimitiveUnits, primitiveUnits)
@@ -67,7 +62,16 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
-        RefPtr<SVGResourceFilter> m_filter;
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        mutable RefPtr<SVGResourceFilter> m_filter;
+
+    private:
+        friend class SVGResourceFilter;
+        void buildFilter(const FloatRect& targetRect) const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
index 3eeb625..67c8bff 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.cpp
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -77,8 +76,6 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
 
     ASSERT(resourceFilter);
 
-    float _x, _y, _width, _height;
-
     if (this->hasAttribute(SVGNames::xAttr))
         filterEffect->setHasX(true);
     if (this->hasAttribute(SVGNames::yAttr))
@@ -88,47 +85,19 @@ void SVGFilterPrimitiveStandardAttributes::setStandardAttributes(SVGResourceFilt
     if (this->hasAttribute(SVGNames::heightAttr))
         filterEffect->setHasHeight(true);
 
-    if (resourceFilter->effectBoundingBoxMode()) {
-        _x = x().valueAsPercentage();
-        _y = y().valueAsPercentage();
-        _width = width().valueAsPercentage();
-        _height = height().valueAsPercentage();
-    } else {
-        // We need to resolve any percentages in filter rect space.
-        if (x().unitType() == LengthTypePercentage) {
-            filterEffect->setXBoundingBoxMode(true);
-            _x = x().valueAsPercentage();
-        } else {
-            filterEffect->setXBoundingBoxMode(false);
-            _x = x().value(this);
-        }
-
-        if (y().unitType() == LengthTypePercentage) {
-            filterEffect->setYBoundingBoxMode(true);
-            _y = y().valueAsPercentage();
-        } else {
-            filterEffect->setYBoundingBoxMode(false);
-            _y = y().value(this);
-        }
-
-        if (width().unitType() == LengthTypePercentage) {
-            filterEffect->setWidthBoundingBoxMode(true);
-            _width = width().valueAsPercentage();
-        } else {
-            filterEffect->setWidthBoundingBoxMode(false);
-            _width = width().value(this);
-        }
-
-        if (height().unitType() == LengthTypePercentage) {
-            filterEffect->setHeightBoundingBoxMode(true);
-            _height = height().valueAsPercentage();
-        } else {
-            filterEffect->setHeightBoundingBoxMode(false);
-            _height = height().value(this);
-        }
-    }
-
-    filterEffect->setSubRegion(FloatRect(_x, _y, _width, _height));
+    FloatRect effectBBox;
+    if (resourceFilter->effectBoundingBoxMode())
+        effectBBox = FloatRect(x().valueAsPercentage(),
+                               y().valueAsPercentage(),
+                               width().valueAsPercentage(),
+                               height().valueAsPercentage());
+    else
+        effectBBox = FloatRect(x().value(this),
+                               y().value(this),
+                               width().value(this),
+                               height().value(this));
+
+    filterEffect->setSubRegion(effectBBox);
 }
 
 }
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index 3cdbb37..cb8ec1c 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -50,7 +48,6 @@ namespace WebCore {
     protected:
         friend class SVGResourceFilter;
         void setStandardAttributes(SVGResourceFilter*, FilterEffect*) const;
-        virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterPrimitiveStandardAttributes, SVGFilterPrimitiveStandardAttributesIdentifier, SVGNames::xAttrString, SVGLength, X, x)
diff --git a/WebCore/svg/SVGFitToViewBox.cpp b/WebCore/svg/SVGFitToViewBox.cpp
index 847038c..c566a8f 100644
--- a/WebCore/svg/SVGFitToViewBox.cpp
+++ b/WebCore/svg/SVGFitToViewBox.cpp
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,6 +23,7 @@
 #if ENABLE(SVG)
 #include "SVGFitToViewBox.h"
 
+#include "Attr.h"
 #include "Document.h"
 #include "FloatRect.h"
 #include "MappedAttribute.h"
@@ -39,8 +38,6 @@ namespace WebCore {
 char SVGFitToViewBoxIdentifier[] = "SVGFitToViewBox";
 
 SVGFitToViewBox::SVGFitToViewBox()
-    : m_viewBox(this, SVGNames::viewBoxAttr)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -48,9 +45,8 @@ SVGFitToViewBox::~SVGFitToViewBox()
 {
 }
 
-bool SVGFitToViewBox::parseViewBox(const UChar*& c, const UChar* end, float& x, float& y, float& w, float& h, bool validate)
+bool SVGFitToViewBox::parseViewBox(Document* doc, const UChar*& c, const UChar* end, float& x, float& y, float& w, float& h, bool validate)
 {
-    Document* doc = contextElement()->document();
     String str(c, end - c);
 
     skipOptionalSpaces(c, end);
@@ -81,24 +77,22 @@ bool SVGFitToViewBox::parseViewBox(const UChar*& c, const UChar* end, float& x,
     return true;
 }
 
-TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+TransformationMatrix SVGFitToViewBox::viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio* preserveAspectRatio, float viewWidth, float viewHeight)
 {
-    FloatRect viewBoxRect = viewBox();
+    ASSERT(preserveAspectRatio);
     if (!viewBoxRect.width() || !viewBoxRect.height())
         return TransformationMatrix();
 
-    return preserveAspectRatio()->getCTM(viewBoxRect.x(),
-            viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(),
-            0, 0, viewWidth, viewHeight);
+    return preserveAspectRatio->getCTM(viewBoxRect.x(), viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(), 0, 0, viewWidth, viewHeight);
 }
 
-bool SVGFitToViewBox::parseMappedAttribute(MappedAttribute* attr)
+bool SVGFitToViewBox::parseMappedAttribute(Document* document, MappedAttribute* attr)
 {
     if (attr->name() == SVGNames::viewBoxAttr) {
         float x = 0.0f, y = 0.0f, w = 0.0f, h = 0.0f;
         const UChar* c = attr->value().characters();
         const UChar* end = c + attr->value().length();
-        if (parseViewBox(c, end, x, y, w, h))
+        if (parseViewBox(document, c, end, x, y, w, h))
             setViewBoxBaseValue(FloatRect(x, y, w, h));
         return true;
     } else if (attr->name() == SVGNames::preserveAspectRatioAttr) {
diff --git a/WebCore/svg/SVGFitToViewBox.h b/WebCore/svg/SVGFitToViewBox.h
index ac03df4..503a0ef 100644
--- a/WebCore/svg/SVGFitToViewBox.h
+++ b/WebCore/svg/SVGFitToViewBox.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -38,17 +36,17 @@ namespace WebCore {
         SVGFitToViewBox();
         virtual ~SVGFitToViewBox();
 
-        bool parseViewBox(const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
-        virtual TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        bool parseViewBox(Document*, const UChar*& start, const UChar* end, float& x, float& y, float& w, float& h, bool validate = true);
+        static TransformationMatrix viewBoxToViewTransform(const FloatRect& viewBoxRect, SVGPreserveAspectRatio*, float viewWidth, float viewHeight);
 
-        bool parseMappedAttribute(MappedAttribute*);
+        bool parseMappedAttribute(Document*, MappedAttribute*);
         bool isKnownAttribute(const QualifiedName&);
 
-        virtual const SVGElement* contextElement() const = 0;
+    protected:
+        virtual SVGAnimatedTypeValue<FloatRect>::DecoratedType viewBoxBaseValue() const = 0;
+        virtual void setViewBoxBaseValue(SVGAnimatedTypeValue<FloatRect>::DecoratedType type) = 0;
 
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFitToViewBox, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
-        ANIMATED_PROPERTY_DECLARATIONS(SVGFitToViewBox, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+        virtual SVGAnimatedTypeValue<SVGPreserveAspectRatio>::DecoratedType preserveAspectRatioBaseValue() const = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFontElement.cpp b/WebCore/svg/SVGFontElement.cpp
index 98321f4..7d62b8c 100644
--- a/WebCore/svg/SVGFontElement.cpp
+++ b/WebCore/svg/SVGFontElement.cpp
@@ -39,7 +39,8 @@ namespace WebCore {
 using namespace SVGNames;
 
 SVGFontElement::SVGFontElement(const QualifiedName& tagName, Document* doc)
-    : SVGStyledElement(tagName, doc)
+    : SVGStyledElement(tagName, doc) 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_isGlyphCacheValid(false)
 {
 }
diff --git a/WebCore/svg/SVGFontElement.h b/WebCore/svg/SVGFontElement.h
index 42468da..1fc5136 100644
--- a/WebCore/svg/SVGFontElement.h
+++ b/WebCore/svg/SVGFontElement.h
@@ -47,10 +47,12 @@ namespace WebCore {
 
         SVGMissingGlyphElement* firstMissingGlyphElement() const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFontElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         void ensureGlyphCache() const;
 
         typedef Vector<SVGHorizontalKerningPair> KerningPairVector;
diff --git a/WebCore/svg/SVGForeignObjectElement.cpp b/WebCore/svg/SVGForeignObjectElement.cpp
index b93ddeb..1e75741 100644
--- a/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/WebCore/svg/SVGForeignObjectElement.cpp
@@ -44,6 +44,7 @@ SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, D
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGForeignObjectElement.h b/WebCore/svg/SVGForeignObjectElement.h
index 7b93bb6..1848e2b 100644
--- a/WebCore/svg/SVGForeignObjectElement.h
+++ b/WebCore/svg/SVGForeignObjectElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2006 Apple Computer, Inc.
 
-    This file is part of the WebKit project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -48,9 +46,6 @@ namespace WebCore {
         bool childShouldCreateRenderer(Node*) const;
         virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::yAttrString, SVGLength, Y, y)
@@ -59,6 +54,11 @@ namespace WebCore {
 
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGGElement.cpp b/WebCore/svg/SVGGElement.cpp
index 2b50d74..241f264 100644
--- a/WebCore/svg/SVGGElement.cpp
+++ b/WebCore/svg/SVGGElement.cpp
@@ -34,6 +34,7 @@ SVGGElement::SVGGElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGGElement.h b/WebCore/svg/SVGGElement.h
index 8e3b368..9cfb5a3 100644
--- a/WebCore/svg/SVGGElement.h
+++ b/WebCore/svg/SVGGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,10 +45,12 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         friend class SVGUseElement;
         TransformationMatrix localMatrix() const;
     };
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index 29bbcac..93e2cb4 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -49,6 +49,7 @@ SVGGradientElement::SVGGradientElement(const QualifiedName& tagName, Document* d
     , m_gradientUnits(this, SVGNames::gradientUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_gradientTransform(this, SVGNames::gradientTransformAttr, SVGTransformList::create(SVGNames::gradientTransformAttr))
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGGradientElement.h b/WebCore/svg/SVGGradientElement.h
index 3c8a760..8413597 100644
--- a/WebCore/svg/SVGGradientElement.h
+++ b/WebCore/svg/SVGGradientElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,8 +58,6 @@ namespace WebCore {
         Vector<SVGGradientStop> buildStops() const;
         mutable RefPtr<SVGPaintServerGradient> m_resource;
  
-        virtual const SVGElement* contextElement() const { return this; }
-
     protected:
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::spreadMethodAttrString, int, SpreadMethod, spreadMethod)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientUnitsAttrString, int, GradientUnits, gradientUnits)
@@ -69,6 +65,11 @@ namespace WebCore {
 
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGImageElement.cpp b/WebCore/svg/SVGImageElement.cpp
index 5b7dee2..e29846c 100644
--- a/WebCore/svg/SVGImageElement.cpp
+++ b/WebCore/svg/SVGImageElement.cpp
@@ -47,6 +47,7 @@ SVGImageElement::SVGImageElement(const QualifiedName& tagName, Document* doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create()) 
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_imageLoader(this)
 {
 }
diff --git a/WebCore/svg/SVGImageElement.h b/WebCore/svg/SVGImageElement.h
index 7840fc5..1bdcdba 100644
--- a/WebCore/svg/SVGImageElement.h
+++ b/WebCore/svg/SVGImageElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -61,7 +59,6 @@ namespace WebCore {
     protected:
         virtual bool haveLoadedRequiredResources();
         virtual bool hasRelativeValues() const;
-        virtual const SVGElement* contextElement() const { return this; }
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::xAttrString, SVGLength, X, x)
@@ -73,6 +70,11 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         SVGImageLoader m_imageLoader;
     };
 
diff --git a/WebCore/svg/SVGLineElement.cpp b/WebCore/svg/SVGLineElement.cpp
index cb31178..4f7b7e5 100644
--- a/WebCore/svg/SVGLineElement.cpp
+++ b/WebCore/svg/SVGLineElement.cpp
@@ -42,6 +42,7 @@ SVGLineElement::SVGLineElement(const QualifiedName& tagName, Document* doc)
     , m_y1(this, SVGNames::y1Attr, LengthModeHeight)
     , m_x2(this, SVGNames::x2Attr, LengthModeWidth)
     , m_y2(this, SVGNames::y2Attr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGLineElement.h b/WebCore/svg/SVGLineElement.h
index 2d89f5c..a24e009 100644
--- a/WebCore/svg/SVGLineElement.h
+++ b/WebCore/svg/SVGLineElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -51,7 +49,6 @@ namespace WebCore {
         virtual bool supportsMarkers() const { return true; }
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -59,6 +56,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y1AttrString, SVGLength, Y1, y1)
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::x2AttrString, SVGLength, X2, x2)
         ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGNames::lineTagString, SVGNames::y2AttrString, SVGLength, Y2, y2)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGLineElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGLinearGradientElement.cpp b/WebCore/svg/SVGLinearGradientElement.cpp
index 9927a50..f5c8cee 100644
--- a/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/WebCore/svg/SVGLinearGradientElement.cpp
@@ -84,8 +84,15 @@ void SVGLinearGradientElement::buildGradient() const
 
     RefPtr<SVGPaintServerLinearGradient> linearGradient = WTF::static_pointer_cast<SVGPaintServerLinearGradient>(m_resource);
 
-    FloatPoint startPoint = FloatPoint::narrowPrecision(attributes.x1(), attributes.y1());
-    FloatPoint endPoint = FloatPoint::narrowPrecision(attributes.x2(), attributes.y2());
+    FloatPoint startPoint;
+    FloatPoint endPoint;
+    if (attributes.boundingBoxMode()) {
+        startPoint = FloatPoint(attributes.x1().valueAsPercentage(), attributes.y1().valueAsPercentage());
+        endPoint = FloatPoint(attributes.x2().valueAsPercentage(), attributes.y2().valueAsPercentage());
+    } else {
+        startPoint = FloatPoint(attributes.x1().value(this), attributes.y1().value(this));
+        endPoint = FloatPoint(attributes.x2().value(this), attributes.y2().value(this));
+    }
 
     RefPtr<Gradient> gradient = Gradient::create(startPoint, endPoint);
     gradient->setSpreadMethod(attributes.spreadMethod());
@@ -142,16 +149,16 @@ LinearGradientAttributes SVGLinearGradientElement::collectGradientProperties() c
             const SVGLinearGradientElement* linear = static_cast<const SVGLinearGradientElement*>(current);
 
             if (!attributes.hasX1() && current->hasAttribute(SVGNames::x1Attr))
-                attributes.setX1(linear->x1().valueAsPercentage());
+                attributes.setX1(linear->x1());
 
             if (!attributes.hasY1() && current->hasAttribute(SVGNames::y1Attr))
-                attributes.setY1(linear->y1().valueAsPercentage());
+                attributes.setY1(linear->y1());
 
             if (!attributes.hasX2() && current->hasAttribute(SVGNames::x2Attr))
-                attributes.setX2(linear->x2().valueAsPercentage());
+                attributes.setX2(linear->x2());
 
             if (!attributes.hasY2() && current->hasAttribute(SVGNames::y2Attr))
-                attributes.setY2(linear->y2().valueAsPercentage());
+                attributes.setY2(linear->y2());
         }
 
         processedGradients.add(current);
diff --git a/WebCore/svg/SVGMPathElement.cpp b/WebCore/svg/SVGMPathElement.cpp
index f19580c..b8c862a 100644
--- a/WebCore/svg/SVGMPathElement.cpp
+++ b/WebCore/svg/SVGMPathElement.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 SVGMPathElement::SVGMPathElement(const QualifiedName& qname, Document* doc)
     : SVGElement(qname, doc)
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGMPathElement.h b/WebCore/svg/SVGMPathElement.h
index 463542f..ded6cdf 100644
--- a/WebCore/svg/SVGMPathElement.h
+++ b/WebCore/svg/SVGMPathElement.h
@@ -1,28 +1,26 @@
 /*
- Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- 
- This file is part of the WebKit project
- 
- This library is free software; you can redistribute it and/or
- modify it under the terms of the GNU Library General Public
- License as published by the Free Software Foundation; either
- version 2 of the License, or (at your option) any later version.
- 
- This library is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- Library General Public License for more details.
- 
- You should have received a copy of the GNU Library General Public License
- along with this library; see the file COPYING.LIB.  If not, write to
- the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- Boston, MA 02110-1301, USA.
- */
+    Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
 
 #ifndef SVGMPathElement_h
 #define SVGMPathElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGURIReference.h"
 #include "SVGExternalResourcesRequired.h"
 
@@ -41,16 +39,17 @@ namespace WebCore {
         
         SVGPathElement* pathElement();
         
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
+    private:
         // SVGURIReference
-        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href) 
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif // SVGMPathElement_h
-
-// vim:ts=4:noet
diff --git a/WebCore/svg/SVGMarkerElement.cpp b/WebCore/svg/SVGMarkerElement.cpp
index b09e718..2e96926 100644
--- a/WebCore/svg/SVGMarkerElement.cpp
+++ b/WebCore/svg/SVGMarkerElement.cpp
@@ -50,6 +50,9 @@ SVGMarkerElement::SVGMarkerElement(const QualifiedName& tagName, Document* doc)
     , m_markerUnits(this, SVGNames::markerUnitsAttr, SVG_MARKERUNITS_STROKEWIDTH)
     , m_orientType(this, SVGNames::orientAttr, SVG_MARKER_ORIENT_ANGLE)
     , m_orientAngle(this, SVGNames::orientAttr, SVGAngle::create())
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
     // Spec: If the markerWidth/markerHeight attribute is not specified, the effect is as if a value of "3" were specified.
 }
@@ -63,6 +66,11 @@ SVGMarkerElement::~SVGMarkerElement()
         detach();
 }
 
+TransformationMatrix SVGMarkerElement::viewBoxToViewTransform(float viewWidth, float viewHeight) const
+{
+    return SVGFitToViewBox::viewBoxToViewTransform(viewBox(), preserveAspectRatio(), viewWidth, viewHeight);
+}
+
 void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == SVGNames::markerUnitsAttr) {
@@ -94,7 +102,7 @@ void SVGMarkerElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
 
         SVGStyledElement::parseMappedAttribute(attr);
diff --git a/WebCore/svg/SVGMarkerElement.h b/WebCore/svg/SVGMarkerElement.h
index e2e3493..7e08a96 100644
--- a/WebCore/svg/SVGMarkerElement.h
+++ b/WebCore/svg/SVGMarkerElement.h
@@ -58,6 +58,8 @@ namespace WebCore {
         SVGMarkerElement(const QualifiedName&, Document*);
         virtual ~SVGMarkerElement();
 
+        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+
         void setOrientToAuto();
         void setOrientToAngle(PassRefPtr<SVGAngle>);
 
@@ -68,9 +70,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refXAttrString, SVGLength, RefX, refX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGNames::refYAttrString, SVGLength, RefY, refY)
@@ -80,6 +79,15 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientTypeAttrIdentifier, int, OrientType, orientType)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGNames::markerTagString, SVGOrientAngleAttrIdentifier, SVGAngle, OrientAngle, orientAngle)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMarkerElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         RefPtr<SVGResourceMarker> m_marker;
     };
 
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index ea11b4a..127f6f4 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -56,6 +56,7 @@ SVGMaskElement::SVGMaskElement(const QualifiedName& tagName, Document* doc)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
@@ -129,45 +130,45 @@ void SVGMaskElement::childrenChanged(bool changedByParser, Node* beforeChange, N
 PassOwnPtr<ImageBuffer> SVGMaskElement::drawMaskerContent(const FloatRect& targetRect, FloatRect& maskDestRect) const
 {    
     // Determine specified mask size
-    float xValue;
-    float yValue;
-    float widthValue;
-    float heightValue;
-
-    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
-        xValue = x().valueAsPercentage() * targetRect.width();
-        yValue = y().valueAsPercentage() * targetRect.height();
-        widthValue = width().valueAsPercentage() * targetRect.width();
-        heightValue = height().valueAsPercentage() * targetRect.height();
-    } else {
-        xValue = x().value(this);
-        yValue = y().value(this);
-        widthValue = width().value(this);
-        heightValue = height().value(this);
-    } 
-
-    IntSize imageSize(lroundf(widthValue), lroundf(heightValue));
+    if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        maskDestRect = FloatRect(x().valueAsPercentage() * targetRect.width(),
+                                 y().valueAsPercentage() * targetRect.height(),
+                                 width().valueAsPercentage() * targetRect.width(),
+                                 height().valueAsPercentage() * targetRect.height());
+    else
+        maskDestRect = FloatRect(x().value(this),
+                                 y().value(this),
+                                 width().value(this),
+                                 height().value(this));
+
+    IntSize imageSize(lroundf(maskDestRect.width()), lroundf(maskDestRect.height()));
     clampImageBufferSizeToViewport(document()->view(), imageSize);
 
-    if (imageSize.width() < static_cast<int>(widthValue))
-        widthValue = imageSize.width();
+    if (imageSize.width() < static_cast<int>(maskDestRect.width()))
+        maskDestRect.setWidth(imageSize.width());
 
-    if (imageSize.height() < static_cast<int>(heightValue))
-        heightValue = imageSize.height();
+    if (imageSize.height() < static_cast<int>(maskDestRect.height()))
+        maskDestRect.setHeight(imageSize.height());
 
-    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize);
+    // FIXME: This changes color space to linearRGB, the default color space
+    // for masking operations in SVG. We need a switch for the other color-space
+    // attribute values sRGB, inherit and auto.
+    OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(imageSize, LinearRGB);
     if (!maskImage)
         return 0;
 
-    maskDestRect = FloatRect(xValue, yValue, widthValue, heightValue);
+    FloatPoint maskContextLocation = maskDestRect.location();
     if (maskUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
         maskDestRect.move(targetRect.x(), targetRect.y());
 
+    if (maskContentUnits() != SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
+        maskContextLocation.move(targetRect.x(), targetRect.y());
+
     GraphicsContext* maskImageContext = maskImage->context();
     ASSERT(maskImageContext);
 
     maskImageContext->save();
-    maskImageContext->translate(-xValue, -yValue);
+    maskImageContext->translate(-maskContextLocation.x(), -maskContextLocation.y());
 
     if (maskContentUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
         maskImageContext->save();
diff --git a/WebCore/svg/SVGMaskElement.h b/WebCore/svg/SVGMaskElement.h
index a152093..362c730 100644
--- a/WebCore/svg/SVGMaskElement.h
+++ b/WebCore/svg/SVGMaskElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2005 Alexander Kellett <lypanov@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -54,9 +52,6 @@ namespace WebCore {
 
         PassOwnPtr<ImageBuffer> drawMaskerContent(const FloatRect& targetRect, FloatRect& maskRect) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskUnitsAttrString, int, MaskUnits, maskUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::maskContentUnitsAttrString, int, MaskContentUnits, maskContentUnits)
@@ -68,6 +63,11 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         RefPtr<SVGResourceMasker> m_masker;
     };
 
diff --git a/WebCore/svg/SVGPathElement.cpp b/WebCore/svg/SVGPathElement.cpp
index 172cac1..7079929 100644
--- a/WebCore/svg/SVGPathElement.cpp
+++ b/WebCore/svg/SVGPathElement.cpp
@@ -50,6 +50,7 @@ SVGPathElement::SVGPathElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_pathLength(this, SVGNames::pathLengthAttr, 0.0f)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGPathElement.h b/WebCore/svg/SVGPathElement.h
index 362a85b..7ea010b 100644
--- a/WebCore/svg/SVGPathElement.h
+++ b/WebCore/svg/SVGPathElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -99,13 +97,15 @@ namespace WebCore {
 
         virtual bool supportsMarkers() const { return true; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         mutable RefPtr<SVGPathSegList> m_pathSegList;
 
         ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGNames::pathTagString, SVGNames::pathLengthAttrString, float, PathLength, pathLength)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPathElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index ef2b29e..34b7db4 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -65,6 +65,9 @@ SVGPatternElement::SVGPatternElement(const QualifiedName& tagName, Document* doc
     , m_patternContentUnits(this, SVGNames::patternContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
     , m_patternTransform(this, SVGNames::patternTransformAttr, SVGTransformList::create(SVGNames::patternTransformAttr))
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -111,7 +114,7 @@ void SVGPatternElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
 
         SVGStyledElement::parseMappedAttribute(attr);
@@ -196,7 +199,7 @@ void SVGPatternElement::buildPattern(const FloatRect& targetRect) const
         }
     }
 
-    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(patternBoundaries.width(), patternBoundaries.height()); 
+    TransformationMatrix viewBoxCTM = viewBoxToViewTransform(viewBox(), preserveAspectRatio(), patternBoundaries.width(), patternBoundaries.height()); 
     FloatRect patternBoundariesIncludingOverflow = patternBoundaries;
 
     // Apply objectBoundingBoxMode fixup for patternContentUnits, if viewBox is not set.
diff --git a/WebCore/svg/SVGPatternElement.h b/WebCore/svg/SVGPatternElement.h
index 46b031e..6a679af 100644
--- a/WebCore/svg/SVGPatternElement.h
+++ b/WebCore/svg/SVGPatternElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -58,9 +56,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         virtual SVGResource* canvasResource();
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::yAttrString, SVGLength, Y, y)
@@ -73,6 +68,15 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGPatternElement
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         mutable RefPtr<SVGPaintServerPattern> m_resource;
 
     private:
diff --git a/WebCore/svg/SVGPolyElement.cpp b/WebCore/svg/SVGPolyElement.cpp
index db39c52..62e53a3 100644
--- a/WebCore/svg/SVGPolyElement.cpp
+++ b/WebCore/svg/SVGPolyElement.cpp
@@ -42,6 +42,7 @@ SVGPolyElement::SVGPolyElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGAnimatedPoints()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -117,7 +118,7 @@ void SVGPolyElement::updateAnimatedSVGAttribute(const String& name) const
     if (name == SVGNames::pointsAttr.localName()) {
         m_synchronizingSVGAttributes = true;
 
-        synchronizeProperty<SVGPolyElement, SVGPointList*>(this, SVGNames::pointsAttr, m_points.get());
+        PropertySynchronizer<SVGPolyElement, SVGPointList*, true>::synchronize(this, SVGNames::pointsAttr, m_points.get());
         setSynchronizedSVGAttributes(true);
         m_synchronizingSVGAttributes = false;
         return;
diff --git a/WebCore/svg/SVGPolyElement.h b/WebCore/svg/SVGPolyElement.h
index 8dd16cd..2ffd150 100644
--- a/WebCore/svg/SVGPolyElement.h
+++ b/WebCore/svg/SVGPolyElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -54,10 +52,12 @@ namespace WebCore {
 
         virtual void updateAnimatedSVGAttribute(const String&) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPolyElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
         mutable RefPtr<SVGPointList> m_points;
     };
 
diff --git a/WebCore/svg/SVGRadialGradientElement.cpp b/WebCore/svg/SVGRadialGradientElement.cpp
index 23a8579..a9b5cff 100644
--- a/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/WebCore/svg/SVGRadialGradientElement.cpp
@@ -92,29 +92,39 @@ void SVGRadialGradientElement::buildGradient() const
 
     RefPtr<SVGPaintServerRadialGradient> radialGradient = WTF::static_pointer_cast<SVGPaintServerRadialGradient>(m_resource);
 
-    double adjustedFocusX = attributes.fx();
-    double adjustedFocusY = attributes.fy();
+    FloatPoint focalPoint;
+    FloatPoint centerPoint;
+    float radius;
+    if (attributes.boundingBoxMode()) {
+        focalPoint = FloatPoint(attributes.fx().valueAsPercentage(), attributes.fy().valueAsPercentage());
+        centerPoint = FloatPoint(attributes.cx().valueAsPercentage(), attributes.cy().valueAsPercentage());
+        radius = attributes.r().valueAsPercentage();
+    } else {
+        focalPoint = FloatPoint(attributes.fx().value(this), attributes.fy().value(this));
+        centerPoint = FloatPoint(attributes.cx().value(this), attributes.cy().value(this));
+        radius = attributes.r().value(this);
+    }
+
+    float adjustedFocusX = focalPoint.x();
+    float adjustedFocusY = focalPoint.y();
 
-    double fdx = attributes.fx() - attributes.cx();
-    double fdy = attributes.fy() - attributes.cy();
+    float fdx = focalPoint.x() - centerPoint.x();
+    float fdy = focalPoint.y() - centerPoint.y();
 
     // Spec: If (fx, fy) lies outside the circle defined by (cx, cy) and
     // r, set (fx, fy) to the point of intersection of the line through
     // (fx, fy) and the circle.
-    if (sqrt(fdx * fdx + fdy * fdy) > attributes.r()) {
-        double angle = atan2(attributes.fy() * 100.0, attributes.fx() * 100.0);
-        adjustedFocusX = cos(angle) * attributes.r();
-        adjustedFocusY = sin(angle) * attributes.r();
+    if (sqrt(fdx * fdx + fdy * fdy) > radius) {
+        float angle = atan2f(focalPoint.y() * 100.0f, focalPoint.x() * 100.0f);
+        adjustedFocusX = cosf(angle) * radius;
+        adjustedFocusY = sinf(angle) * radius;
     }
 
-    FloatPoint focalPoint = FloatPoint::narrowPrecision(attributes.fx(), attributes.fy());
-    FloatPoint centerPoint = FloatPoint::narrowPrecision(attributes.cx(), attributes.cy());
-
     RefPtr<Gradient> gradient = Gradient::create(
-        FloatPoint::narrowPrecision(adjustedFocusX, adjustedFocusY),
+        FloatPoint(adjustedFocusX, adjustedFocusY),
         0.f, // SVG does not support a "focus radius"
         centerPoint,
-        narrowPrecisionToFloat(attributes.r()));
+        radius);
     gradient->setSpreadMethod(attributes.spreadMethod());
 
     Vector<SVGGradientStop> stops = attributes.stops();
@@ -134,7 +144,7 @@ void SVGRadialGradientElement::buildGradient() const
     radialGradient->setGradientTransform(attributes.gradientTransform());
     radialGradient->setGradientCenter(centerPoint);
     radialGradient->setGradientFocal(focalPoint);
-    radialGradient->setGradientRadius(narrowPrecisionToFloat(attributes.r()));
+    radialGradient->setGradientRadius(radius);
     radialGradient->setGradientStops(attributes.stops());
 }
 
@@ -166,19 +176,19 @@ RadialGradientAttributes SVGRadialGradientElement::collectGradientProperties() c
             const SVGRadialGradientElement* radial = static_cast<const SVGRadialGradientElement*>(current);
 
             if (!attributes.hasCx() && current->hasAttribute(SVGNames::cxAttr))
-                attributes.setCx(radial->cx().valueAsPercentage());
+                attributes.setCx(radial->cx());
 
             if (!attributes.hasCy() && current->hasAttribute(SVGNames::cyAttr))
-                attributes.setCy(radial->cy().valueAsPercentage());
+                attributes.setCy(radial->cy());
 
             if (!attributes.hasR() && current->hasAttribute(SVGNames::rAttr))
-                attributes.setR(radial->r().valueAsPercentage());
+                attributes.setR(radial->r());
 
             if (!attributes.hasFx() && current->hasAttribute(SVGNames::fxAttr))
-                attributes.setFx(radial->fx().valueAsPercentage());
+                attributes.setFx(radial->fx());
 
             if (!attributes.hasFy() && current->hasAttribute(SVGNames::fyAttr))
-                attributes.setFy(radial->fy().valueAsPercentage());
+                attributes.setFy(radial->fy());
         }
 
         processedGradients.add(current);
diff --git a/WebCore/svg/SVGRectElement.cpp b/WebCore/svg/SVGRectElement.cpp
index bfb6205..966976a 100644
--- a/WebCore/svg/SVGRectElement.cpp
+++ b/WebCore/svg/SVGRectElement.cpp
@@ -43,6 +43,7 @@ SVGRectElement::SVGRectElement(const QualifiedName& tagName, Document *doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
     , m_rx(this, SVGNames::rxAttr, LengthModeWidth)
     , m_ry(this, SVGNames::ryAttr, LengthModeHeight)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGRectElement.h b/WebCore/svg/SVGRectElement.h
index 2937c23..a4d859e 100644
--- a/WebCore/svg/SVGRectElement.h
+++ b/WebCore/svg/SVGRectElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -47,7 +45,6 @@ namespace WebCore {
         virtual Path toPathData() const;
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool hasRelativeValues() const;
 
     private:
@@ -57,6 +54,11 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::rxAttrString, SVGLength, Rx, rx)
         ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGNames::rectTagString, SVGNames::ryAttrString, SVGLength, Ry, ry)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGRectElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp
index 29e72b8..2d5008b 100644
--- a/WebCore/svg/SVGSVGElement.cpp
+++ b/WebCore/svg/SVGSVGElement.cpp
@@ -66,7 +66,10 @@ SVGSVGElement::SVGSVGElement(const QualifiedName& tagName, Document* doc)
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "100%")
-    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%")
+    , m_height(this, SVGNames::heightAttr, LengthModeHeight, "100%") 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
     , m_useCurrentView(false)
     , m_timeContainer(SMILTimeContainer::create(this))
     , m_viewSpec(0)
@@ -261,7 +264,7 @@ void SVGSVGElement::parseMappedAttribute(MappedAttribute* attr)
             return;
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
             return;
-        if (SVGFitToViewBox::parseMappedAttribute(attr))
+        if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
             return;
         if (SVGZoomAndPan::parseMappedAttribute(attr))
             return;
@@ -513,13 +516,8 @@ TransformationMatrix SVGSVGElement::viewBoxToViewTransform(float viewWidth, floa
             viewBoxRect = currentView()->viewBox();
     } else
         viewBoxRect = viewBox();
-    if (!viewBoxRect.width() || !viewBoxRect.height())
-        return TransformationMatrix();
-
-    TransformationMatrix ctm = preserveAspectRatio()->getCTM(viewBoxRect.x(),
-            viewBoxRect.y(), viewBoxRect.width(), viewBoxRect.height(),
-            0, 0, viewWidth, viewHeight);
 
+    TransformationMatrix ctm = SVGFitToViewBox::viewBoxToViewTransform(viewBoxRect, preserveAspectRatio(), viewWidth, viewHeight);
     if (useCurrentView() && currentView())
         return currentView()->transform()->concatenate().matrix() * ctm;
 
diff --git a/WebCore/svg/SVGSVGElement.h b/WebCore/svg/SVGSVGElement.h
index 223ebf6..f30e8f6 100644
--- a/WebCore/svg/SVGSVGElement.h
+++ b/WebCore/svg/SVGSVGElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -128,13 +126,11 @@ namespace WebCore {
 
         virtual void svgAttributeChanged(const QualifiedName&);
 
-        virtual TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
+        TransformationMatrix viewBoxToViewTransform(float viewWidth, float viewHeight) const;
 
         void inheritViewAttributes(SVGViewElement*);
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
         friend class RenderSVGRoot;
         friend class RenderSVGViewportContainer;
 
@@ -148,6 +144,15 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGNames::svgTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSVGElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         virtual void documentWillBecomeInactive();
         virtual void documentDidBecomeActive();
 
diff --git a/WebCore/svg/SVGScriptElement.cpp b/WebCore/svg/SVGScriptElement.cpp
index 5e946ce..c2f4a6e 100644
--- a/WebCore/svg/SVGScriptElement.cpp
+++ b/WebCore/svg/SVGScriptElement.cpp
@@ -37,7 +37,8 @@ SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* doc,
     : SVGElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
-    , m_href(this, XLinkNames::hrefAttr)
+    , m_href(this, XLinkNames::hrefAttr) 
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
     , m_data(this, this)
 {
     m_data.setCreatedByParser(createdByParser);
diff --git a/WebCore/svg/SVGScriptElement.h b/WebCore/svg/SVGScriptElement.h
index 0fd85ff..699c535 100644
--- a/WebCore/svg/SVGScriptElement.h
+++ b/WebCore/svg/SVGScriptElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -60,7 +58,6 @@ namespace WebCore {
         virtual bool shouldExecuteAsJavaScript() const { return false; }
 
     protected:
-        virtual const SVGElement* contextElement() const { return this; }
         virtual bool haveLoadedRequiredResources();
 
         virtual String sourceAttributeValue() const;
@@ -76,6 +73,11 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
     private:
         ScriptElementData m_data;
         String m_type;
diff --git a/WebCore/svg/SVGStyledElement.cpp b/WebCore/svg/SVGStyledElement.cpp
index 98b6459..6960519 100644
--- a/WebCore/svg/SVGStyledElement.cpp
+++ b/WebCore/svg/SVGStyledElement.cpp
@@ -245,20 +245,23 @@ PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& na
     if (!mappedAttributes())
         return 0;
 
-    Attribute* attr = mappedAttributes()->getAttributeItem(QualifiedName(nullAtom, name, nullAtom));
+    QualifiedName attributeName(nullAtom, name, nullAtom);
+    Attribute* attr = mappedAttributes()->getAttributeItem(attributeName);
     if (!attr || !attr->isMappedAttribute() || !attr->style())
         return 0;
 
     MappedAttribute* cssSVGAttr = static_cast<MappedAttribute*>(attr);
-
-    // FIXME: Is it possible that the style will not be shared at the time this
-    // is called, but a later addition to the DOM will make it shared?
-    if (!cssSVGAttr->style()->hasOneRef()) {
+    // This function returns a pointer to a CSSValue which can be mutated from JavaScript.
+    // If the associated MappedAttribute uses the same CSSMappedAttributeDeclaration
+    // as StyledElement's mappedAttributeDecls cache, create a new CSSMappedAttributeDeclaration
+    // before returning so that any modifications to the CSSValue will not affect other attributes.
+    MappedAttributeEntry entry;
+    mapToEntry(attributeName, entry);
+    if (getMappedAttributeDecl(entry, cssSVGAttr) == cssSVGAttr->decl()) {
         cssSVGAttr->setDecl(0);
         int propId = SVGStyledElement::cssPropertyIdForSVGAttributeName(cssSVGAttr->name());
         addCSSProperty(cssSVGAttr, propId, cssSVGAttr->value());
     }
-
     return cssSVGAttr->style()->getPropertyCSSValue(name);
 }
 
diff --git a/WebCore/svg/SVGSwitchElement.cpp b/WebCore/svg/SVGSwitchElement.cpp
index 2867d00..a07b2a7 100644
--- a/WebCore/svg/SVGSwitchElement.cpp
+++ b/WebCore/svg/SVGSwitchElement.cpp
@@ -34,6 +34,7 @@ SVGSwitchElement::SVGSwitchElement(const QualifiedName& tagName, Document* doc)
     , SVGTests()
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGSwitchElement.h b/WebCore/svg/SVGSwitchElement.h
index a2be835..f5e9a0d 100644
--- a/WebCore/svg/SVGSwitchElement.h
+++ b/WebCore/svg/SVGSwitchElement.h
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -22,8 +20,8 @@
 
 #ifndef SVGSwitchElement_h
 #define SVGSwitchElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGExternalResourcesRequired.h"
 #include "SVGLangSpace.h"
 #include "SVGStyledTransformableElement.h"
@@ -44,16 +42,14 @@ namespace WebCore {
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
-        mutable bool m_insideRenderSection;
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSwitchElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
     };
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
 #endif
-
-// vim:ts=4:noet
diff --git a/WebCore/svg/SVGSymbolElement.cpp b/WebCore/svg/SVGSymbolElement.cpp
index 073a13d..4155b0c 100644
--- a/WebCore/svg/SVGSymbolElement.cpp
+++ b/WebCore/svg/SVGSymbolElement.cpp
@@ -34,6 +34,9 @@ SVGSymbolElement::SVGSymbolElement(const QualifiedName& tagName, Document* doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -47,7 +50,7 @@ void SVGSymbolElement::parseMappedAttribute(MappedAttribute* attr)
         return;
     if (SVGExternalResourcesRequired::parseMappedAttribute(attr))
         return;
-    if (SVGFitToViewBox::parseMappedAttribute(attr))
+    if (SVGFitToViewBox::parseMappedAttribute(document(), attr))
         return;
 
     SVGStyledElement::parseMappedAttribute(attr);
diff --git a/WebCore/svg/SVGSymbolElement.h b/WebCore/svg/SVGSymbolElement.h
index a6ccbce..5c68202 100644
--- a/WebCore/svg/SVGSymbolElement.h
+++ b/WebCore/svg/SVGSymbolElement.h
@@ -1,9 +1,7 @@
 /*
-    Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
+    Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -22,8 +20,8 @@
 
 #ifndef SVGSymbolElement_h
 #define SVGSymbolElement_h
-#if ENABLE(SVG)
 
+#if ENABLE(SVG)
 #include "SVGExternalResourcesRequired.h"
 #include "SVGFitToViewBox.h"
 #include "SVGLangSpace.h"
@@ -44,8 +42,15 @@ namespace WebCore {
     
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
+    private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+ 
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGSymbolElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio) 
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGTRefElement.h b/WebCore/svg/SVGTRefElement.h
index 63f5fac..71d40a0 100644
--- a/WebCore/svg/SVGTRefElement.h
+++ b/WebCore/svg/SVGTRefElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -40,9 +38,6 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
         bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         void updateReferencedText();
 
diff --git a/WebCore/svg/SVGTextContentElement.cpp b/WebCore/svg/SVGTextContentElement.cpp
index 86009c1..9334304 100644
--- a/WebCore/svg/SVGTextContentElement.cpp
+++ b/WebCore/svg/SVGTextContentElement.cpp
@@ -52,6 +52,7 @@ SVGTextContentElement::SVGTextContentElement(const QualifiedName& tagName, Docum
     , SVGExternalResourcesRequired()
     , m_textLength(this, SVGNames::textLengthAttr, LengthModeOther)
     , m_lengthAdjust(this, SVGNames::lengthAdjustAttr, LENGTHADJUST_SPACING)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
diff --git a/WebCore/svg/SVGTextContentElement.h b/WebCore/svg/SVGTextContentElement.h
index 9933b2c..9b2c938 100644
--- a/WebCore/svg/SVGTextContentElement.h
+++ b/WebCore/svg/SVGTextContentElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2008 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -66,12 +64,14 @@ namespace WebCore {
 
         bool isKnownAttribute(const QualifiedName&);
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::textLengthAttrString, SVGLength, TextLength, textLength)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGTextContentElementIdentifier, SVGNames::lengthAdjustAttrString, int, LengthAdjust, lengthAdjust)
+
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextContentElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired) 
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGTextPathElement.h b/WebCore/svg/SVGTextPathElement.h
index 3266814..1bfcc8b 100644
--- a/WebCore/svg/SVGTextPathElement.h
+++ b/WebCore/svg/SVGTextPathElement.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -64,9 +62,6 @@ namespace WebCore {
 
         bool childShouldCreateRenderer(Node*) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::startOffsetAttrString, SVGLength, StartOffset, startOffset)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::methodAttrString, int, Method, method)
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 8a2d65f..42517bd 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -66,6 +66,7 @@ SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
     , m_href(this, XLinkNames::hrefAttr)
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
 {
 }
 
@@ -483,13 +484,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
         targetInstance->appendChild(instancePtr.get());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
-        if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr.get(), foundProblem);
-
-        // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
-        // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
-        if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr.get(), foundProblem);
+        buildInstanceTree(element, instancePtr.get(), foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
diff --git a/WebCore/svg/SVGUseElement.h b/WebCore/svg/SVGUseElement.h
index 3eedf21..45ca783 100644
--- a/WebCore/svg/SVGUseElement.h
+++ b/WebCore/svg/SVGUseElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -68,9 +66,6 @@ namespace WebCore {
         static void removeDisallowedElementsFromSubtree(Node* element);
         SVGElementInstance* instanceForShadowTreeElement(Node* element) const;
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::yAttrString, SVGLength, Y, y)
@@ -80,6 +75,11 @@ namespace WebCore {
         // SVGURIReference
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
 
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+
     private:
         // Instance tree handling
         void buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundCycle);
diff --git a/WebCore/svg/SVGViewElement.cpp b/WebCore/svg/SVGViewElement.cpp
index 61cb397..af1d1fe 100644
--- a/WebCore/svg/SVGViewElement.cpp
+++ b/WebCore/svg/SVGViewElement.cpp
@@ -40,6 +40,9 @@ SVGViewElement::SVGViewElement(const QualifiedName& tagName, Document* doc)
     , SVGExternalResourcesRequired()
     , SVGFitToViewBox()
     , SVGZoomAndPan()
+    , m_externalResourcesRequired(this, SVGNames::externalResourcesRequiredAttr, false)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
 {
 }
 
@@ -61,7 +64,7 @@ void SVGViewElement::parseMappedAttribute(MappedAttribute* attr)
         viewTarget()->reset(attr->value());
     else {
         if (SVGExternalResourcesRequired::parseMappedAttribute(attr)
-           || SVGFitToViewBox::parseMappedAttribute(attr)
+           || SVGFitToViewBox::parseMappedAttribute(document(), attr)
            || SVGZoomAndPan::parseMappedAttribute(attr))
             return;
 
diff --git a/WebCore/svg/SVGViewElement.h b/WebCore/svg/SVGViewElement.h
index 840dea9..33d0ae3 100644
--- a/WebCore/svg/SVGViewElement.h
+++ b/WebCore/svg/SVGViewElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -46,10 +44,16 @@ namespace WebCore {
 
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    protected:
-        virtual const SVGElement* contextElement() const { return this; }
-
     private:
+        // SVGExternalResourcesRequired
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGExternalResourcesRequiredIdentifier,
+                                       SVGNames::externalResourcesRequiredAttrString, bool,
+                                       ExternalResourcesRequired, externalResourcesRequired)
+ 
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewElement, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+ 
         mutable RefPtr<SVGStringList> m_viewTarget;
     };
 
diff --git a/WebCore/svg/SVGViewSpec.cpp b/WebCore/svg/SVGViewSpec.cpp
index b12b1c2..e6ded33 100644
--- a/WebCore/svg/SVGViewSpec.cpp
+++ b/WebCore/svg/SVGViewSpec.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -36,8 +34,10 @@ namespace WebCore {
 SVGViewSpec::SVGViewSpec(const SVGSVGElement* contextElement)
     : SVGFitToViewBox()
     , SVGZoomAndPan()
-    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
     , m_contextElement(contextElement)
+    , m_viewBox(this, SVGNames::viewBoxAttr)
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_transform(SVGTransformList::create(SVGNames::transformAttr))
 {
 }
 
@@ -55,7 +55,7 @@ void SVGViewSpec::setViewBoxString(const String& viewBox)
     float x, y, w, h;
     const UChar* c = viewBox.characters();
     const UChar* end = c + viewBox.length();
-    if (!parseViewBox(c, end, x, y, w, h, false))
+    if (!parseViewBox(m_contextElement->document(), c, end, x, y, w, h, false))
         return;
     setViewBoxBaseValue(FloatRect(x, y, w, h));
 }
@@ -74,12 +74,7 @@ void SVGViewSpec::setViewTargetString(const String& viewTargetString)
 
 SVGElement* SVGViewSpec::viewTarget() const
 {
-    return static_cast<SVGElement*>(m_contextElement->ownerDocument()->getElementById(m_viewTargetString));
-}
-
-const SVGElement* SVGViewSpec::contextElement() const
-{
-    return m_contextElement;
+    return static_cast<SVGElement*>(m_contextElement->document()->getElementById(m_viewTargetString));
 }
 
 static const UChar svgViewSpec[] = {'s', 'v', 'g', 'V', 'i', 'e', 'w'};
@@ -111,7 +106,7 @@ bool SVGViewSpec::parseViewSpec(const String& viewSpec)
                     return false;
                 currViewSpec++;
                 float x, y, w, h;
-                if (!parseViewBox(currViewSpec, end, x, y, w, h, false))
+                if (!parseViewBox(m_contextElement->document(), currViewSpec, end, x, y, w, h, false))
                     return false;
                 setViewBoxBaseValue(FloatRect(x, y, w, h));
                 if (currViewSpec >= end || *currViewSpec != ')')
diff --git a/WebCore/svg/SVGViewSpec.h b/WebCore/svg/SVGViewSpec.h
index 8624089..090b7ae 100644
--- a/WebCore/svg/SVGViewSpec.h
+++ b/WebCore/svg/SVGViewSpec.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -53,11 +51,16 @@ namespace WebCore {
         String viewTargetString() const { return m_viewTargetString; }
         SVGElement* viewTarget() const;
 
-        virtual const SVGElement* contextElement() const;
+        const SVGSVGElement* contextElement() const { return m_contextElement; }
 
     private:
-        mutable RefPtr<SVGTransformList> m_transform;
         const SVGSVGElement* m_contextElement;
+
+        // SVGFitToViewBox
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::viewBoxAttrString, FloatRect, ViewBox, viewBox)
+        ANIMATED_PROPERTY_DECLARATIONS(SVGViewSpec, SVGFitToViewBoxIdentifier, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
+
+        mutable RefPtr<SVGTransformList> m_transform;
         String m_viewTargetString;
     };
 
diff --git a/WebCore/svg/SynchronizablePropertyController.cpp b/WebCore/svg/SynchronizablePropertyController.cpp
new file mode 100644
index 0000000..be8ab78
--- /dev/null
+++ b/WebCore/svg/SynchronizablePropertyController.cpp
@@ -0,0 +1,145 @@
+/*
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SynchronizablePropertyController.h"
+
+#include "NamedNodeMap.h"
+#include "Node.h"
+#include "SVGAnimatedProperty.h"
+
+namespace WebCore {
+
+void SynchronizableProperties::addProperty(SVGAnimatedPropertyBase* base)
+{
+    m_bases.add(base);
+}
+
+void SynchronizableProperties::synchronize()
+{
+    ASSERT(!m_bases.isEmpty());
+    if (m_shouldSynchronize) {
+        BaseSet::iterator it = m_bases.begin();
+        BaseSet::iterator end = m_bases.end();
+
+        for (; it != end; ++it) {
+            SVGAnimatedPropertyBase* base = *it;
+            ASSERT(base);
+            base->synchronize();
+        }
+    }
+}
+
+void SynchronizableProperties::startAnimation()
+{
+    ASSERT(!m_bases.isEmpty());
+    BaseSet::iterator it = m_bases.begin();
+    BaseSet::iterator end = m_bases.end();
+
+    for (; it != end; ++it) {
+        SVGAnimatedPropertyBase* base = *it;
+        ASSERT(base);
+        base->startAnimation();
+    }
+}
+
+void SynchronizableProperties::stopAnimation()
+{
+    ASSERT(!m_bases.isEmpty());
+    BaseSet::iterator it = m_bases.begin();
+    BaseSet::iterator end = m_bases.end();
+
+    for (; it != end; ++it) {
+        SVGAnimatedPropertyBase* base = *it;
+        ASSERT(base);
+        base->stopAnimation();
+    }
+}
+
+SynchronizablePropertyController::SynchronizablePropertyController()
+{
+}
+
+void SynchronizablePropertyController::registerProperty(const QualifiedName& attrName, SVGAnimatedPropertyBase* base)
+{
+    // 'attrName' is ambigious. For instance in SVGMarkerElement both 'orientType' / 'orientAngle'
+    // SVG DOM objects are synchronized with the 'orient' attribute. This why we need a HashSet.
+    PropertyMap::iterator it = m_map.find(attrName.localName());
+    if (it == m_map.end()) {
+        SynchronizableProperties properties;
+        properties.addProperty(base);
+        m_map.set(attrName.localName(), properties);
+        return;
+    }
+
+    it->second.addProperty(base);
+}
+
+void SynchronizablePropertyController::setPropertyNeedsSynchronization(const QualifiedName& attrName)
+{
+    PropertyMap::iterator itProp = m_map.find(attrName.localName());
+    ASSERT(itProp != m_map.end());
+
+    itProp->second.setNeedsSynchronization();
+}
+
+void SynchronizablePropertyController::synchronizeProperty(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    itProp->second.synchronize();
+}
+
+void SynchronizablePropertyController::synchronizeAllProperties()
+{
+    if (m_map.isEmpty())
+        return;
+
+    PropertyMap::iterator itProp = m_map.begin();
+    PropertyMap::iterator endProp = m_map.end();
+
+    for (; itProp != endProp; ++itProp)
+        itProp->second.synchronize();
+}
+
+void SynchronizablePropertyController::startAnimation(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    itProp->second.startAnimation();
+}
+
+void SynchronizablePropertyController::stopAnimation(const String& name)
+{
+    PropertyMap::iterator itProp = m_map.find(name);
+    if (itProp == m_map.end())
+        return;
+
+    itProp->second.stopAnimation();
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/svg/SynchronizablePropertyController.h b/WebCore/svg/SynchronizablePropertyController.h
new file mode 100644
index 0000000..1ec5026
--- /dev/null
+++ b/WebCore/svg/SynchronizablePropertyController.h
@@ -0,0 +1,84 @@
+/*
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SynchronizablePropertyController_h
+#define SynchronizablePropertyController_h
+
+#if ENABLE(SVG)
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class QualifiedName;
+class SVGAnimatedPropertyBase;
+
+class SynchronizableProperties {
+public:
+    SynchronizableProperties()
+        : m_shouldSynchronize(false)
+    {
+    }
+
+    void setNeedsSynchronization()
+    {
+        m_shouldSynchronize = true;
+    }
+
+    void addProperty(SVGAnimatedPropertyBase*);
+    void synchronize();
+    void startAnimation();
+    void stopAnimation();
+
+private:
+    typedef HashSet<SVGAnimatedPropertyBase*> BaseSet;
+
+    BaseSet m_bases;
+    bool m_shouldSynchronize;
+};
+
+// Helper class used exclusively by SVGElement to keep track of all animatable properties within a SVGElement,
+// and wheter they are supposed to be synchronized or not (depending wheter AnimatedPropertyTearOff's have been created)
+class SynchronizablePropertyController : public Noncopyable {
+public:
+    void registerProperty(const QualifiedName&, SVGAnimatedPropertyBase*);
+    void setPropertyNeedsSynchronization(const QualifiedName&);
+
+    void synchronizeProperty(const String&);
+    void synchronizeAllProperties();
+
+    void startAnimation(const String&);
+    void stopAnimation(const String&);
+
+private:
+    friend class SVGElement;
+    SynchronizablePropertyController();
+
+private:
+    typedef HashMap<String, SynchronizableProperties> PropertyMap;
+
+    PropertyMap m_map;
+};
+
+};
+
+#endif // ENABLE(SVG)
+#endif // SynchronizablePropertyController_h
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index dc63582..0a506f8 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -239,14 +239,13 @@ bool SVGImage::dataChanged(bool allDataReceived)
         static DragClient* dummyDragClient = 0;
 #endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
-        static PluginHalterClient* dummyPluginHalterClient = new EmptyPluginHalterClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
         // FIXME: If this SVG ends up loading itself, we might leak the world.
         // The comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, dummyPluginHalterClient));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, 0));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
diff --git a/WebCore/svg/graphics/SVGResourceFilter.cpp b/WebCore/svg/graphics/SVGResourceFilter.cpp
index 4a4bdd5..973743c 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.cpp
+++ b/WebCore/svg/graphics/SVGResourceFilter.cpp
@@ -31,52 +31,44 @@
 #include "PlatformString.h"
 #include "SVGFilter.h"
 #include "SVGFilterBuilder.h"
+#include "SVGFilterElement.h"
 #include "SVGRenderTreeAsText.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
 
 namespace WebCore {
 
-SVGResourceFilter::SVGResourceFilter()
-    : m_filterBBoxMode(false)
+SVGResourceFilter::SVGResourceFilter(const SVGFilterElement* ownerElement)
+    : SVGResource()
+    , m_ownerElement(ownerElement)
+    , m_filterBBoxMode(false)
     , m_effectBBoxMode(false)
-    , m_xBBoxMode(false)
-    , m_yBBoxMode(false)
     , m_savedContext(0)
     , m_sourceGraphicBuffer(0)
 {
     m_filterBuilder.set(new SVGFilterBuilder());
 }
 
-void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
+SVGResourceFilter::~SVGResourceFilter()
 {
-    effectAttributes->setStandardAttributes(this, effect.get());
-    builder()->add(effectAttributes->result(), effect);
 }
 
-FloatRect SVGResourceFilter::filterBBoxForItemBBox(const FloatRect& itemBBox) const
+void SVGResourceFilter::addFilterEffect(SVGFilterPrimitiveStandardAttributes* effectAttributes, PassRefPtr<FilterEffect> effect)
 {
-    FloatRect filterBBox = filterRect();
-
-    if (filterBoundingBoxMode())
-        filterBBox = FloatRect(itemBBox.x() + filterBBox.x() * itemBBox.width(),
-                               itemBBox.y() + filterBBox.y() * itemBBox.height(),
-                               filterBBox.width() * itemBBox.width(),
-                               filterBBox.height() * itemBBox.height());
-
-    return filterBBox;
+    effectAttributes->setStandardAttributes(this, effect.get());
+    builder()->add(effectAttributes->result(), effect);
 }
 
 void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObject* object)
 {
-    m_itemBBox = object->objectBoundingBox();
-    m_filterBBox = filterBBoxForItemBBox(m_itemBBox);
+    FloatRect targetRect = object->objectBoundingBox();
+    m_ownerElement->buildFilter(targetRect);
 
     // clip sourceImage to filterRegion
-    FloatRect clippedSourceRect = m_itemBBox;
+    FloatRect clippedSourceRect = targetRect;
     clippedSourceRect.intersect(m_filterBBox);
 
     // prepare Filters
-    m_filter = SVGFilter::create(m_itemBBox, m_filterBBox, m_effectBBoxMode, m_filterBBoxMode);
+    m_filter = SVGFilter::create(targetRect, m_filterBBox, m_effectBBoxMode);
 
     FilterEffect* lastEffect = m_filterBuilder->lastEffect();
     if (lastEffect)
@@ -91,8 +83,8 @@ void SVGResourceFilter::prepareFilter(GraphicsContext*& context, const RenderObj
         return;
 
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
-    sourceGraphicContext->translate(-m_itemBBox.x(), -m_itemBBox.y());
-    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), m_itemBBox.size()));
+    sourceGraphicContext->translate(-targetRect.x(), -targetRect.y());
+    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), targetRect.size()));
     m_sourceGraphicBuffer.set(sourceGraphic.release());
     m_savedContext = context;
 
diff --git a/WebCore/svg/graphics/SVGResourceFilter.h b/WebCore/svg/graphics/SVGResourceFilter.h
index ee1efca..86b11fe 100644
--- a/WebCore/svg/graphics/SVGResourceFilter.h
+++ b/WebCore/svg/graphics/SVGResourceFilter.h
@@ -43,11 +43,13 @@ class Filter;
 class FilterEffect;
 class GraphicsContext;
 class SVGFilterBuilder;
+class SVGFilterElement;
 class SVGFilterPrimitiveStandardAttributes;
 
 class SVGResourceFilter : public SVGResource {
 public:
-    SVGResourceFilter();
+    static PassRefPtr<SVGResourceFilter> create(const SVGFilterElement* ownerElement) { return adoptRef(new SVGResourceFilter(ownerElement)); }
+    virtual ~SVGResourceFilter();
     
     virtual SVGResourceType resourceType() const { return FilterResourceType; }
 
@@ -57,44 +59,31 @@ public:
     bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
     void setEffectBoundingBoxMode(bool bboxMode) { m_effectBBoxMode = bboxMode; }
 
-    bool xBoundingBoxMode() const { return m_xBBoxMode; }
-    void setXBoundingBoxMode(bool bboxMode) { m_xBBoxMode = bboxMode; }
-
-    bool yBoundingBoxMode() const { return m_yBBoxMode; }
-    void setYBoundingBoxMode(bool bboxMode) { m_yBBoxMode = bboxMode; }
-
     FloatRect filterRect() const { return m_filterRect; }
     void setFilterRect(const FloatRect& rect) { m_filterRect = rect; }
 
     FloatRect filterBoundingBox() { return m_filterBBox; }
     void setFilterBoundingBox(const FloatRect& rect) { m_filterBBox = rect; }
 
-    FloatRect itemBoundingBox() { return m_itemBBox; }
-    void setItemBoundingBox(const FloatRect& rect) { m_itemBBox = rect; }
-
-    FloatRect filterBBoxForItemBBox(const FloatRect& itemBBox) const;
-
-    virtual TextStream& externalRepresentation(TextStream&) const;
-
     void prepareFilter(GraphicsContext*&, const RenderObject*);
     void applyFilter(GraphicsContext*&, const RenderObject*);
 
     void addFilterEffect(SVGFilterPrimitiveStandardAttributes*, PassRefPtr<FilterEffect>);
 
     SVGFilterBuilder* builder() { return m_filterBuilder.get(); }
+
+    virtual TextStream& externalRepresentation(TextStream&) const;
     
 private:
+    SVGResourceFilter(const SVGFilterElement*);
+
+    const SVGFilterElement* m_ownerElement;
 
     bool m_filterBBoxMode : 1;
     bool m_effectBBoxMode : 1;
 
-    bool m_xBBoxMode : 1;
-    bool m_yBBoxMode : 1;
-
     FloatRect m_filterRect;
-
     FloatRect m_filterBBox;
-    FloatRect m_itemBBox;
 
     OwnPtr<SVGFilterBuilder> m_filterBuilder;
     GraphicsContext* m_savedContext;
diff --git a/WebCore/svg/graphics/filters/SVGFEFlood.cpp b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
index 3f4a6d7..668209f 100644
--- a/WebCore/svg/graphics/filters/SVGFEFlood.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEFlood.cpp
@@ -31,17 +31,16 @@
 
 namespace WebCore {
 
-FEFlood::FEFlood(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
+FEFlood::FEFlood(const Color& floodColor, const float& floodOpacity)
     : FilterEffect()
-    , m_in(in)
     , m_floodColor(floodColor)
     , m_floodOpacity(floodOpacity)
 {
 }
 
-PassRefPtr<FEFlood> FEFlood::create(FilterEffect* in, const Color& floodColor, const float& floodOpacity)
+PassRefPtr<FEFlood> FEFlood::create(const Color& floodColor, const float& floodOpacity)
 {
-    return adoptRef(new FEFlood(in, floodColor, floodOpacity));
+    return adoptRef(new FEFlood(floodColor, floodOpacity));
 }
 
 Color FEFlood::floodColor() const
diff --git a/WebCore/svg/graphics/filters/SVGFEFlood.h b/WebCore/svg/graphics/filters/SVGFEFlood.h
index 21985db..91795dd 100644
--- a/WebCore/svg/graphics/filters/SVGFEFlood.h
+++ b/WebCore/svg/graphics/filters/SVGFEFlood.h
@@ -31,7 +31,7 @@ namespace WebCore {
 
     class FEFlood : public FilterEffect {
     public:
-        static PassRefPtr<FEFlood> create(FilterEffect*, const Color&, const float&);
+        static PassRefPtr<FEFlood> create(const Color&, const float&);
 
         Color floodColor() const;
         void setFloodColor(const Color &);
@@ -44,9 +44,8 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEFlood(FilterEffect*, const Color&, const float&);
+        FEFlood(const Color&, const float&);
 
-        RefPtr<FilterEffect> m_in;
         Color m_floodColor;
         float m_floodOpacity;
     };
diff --git a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp b/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
deleted file mode 100644
index 601c39e..0000000
--- a/WebCore/svg/graphics/filters/SVGFEGaussianBlur.cpp
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
-    Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
-                  2004, 2005 Rob Buis <buis@kde.org>
-                  2005 Eric Seidel <eric@webkit.org>
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    aint with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#if ENABLE(SVG) && ENABLE(FILTERS)
-#include "SVGFEGaussianBlur.h"
-#include "SVGRenderTreeAsText.h"
-#include "Filter.h"
-
-namespace WebCore {
-
-FEGaussianBlur::FEGaussianBlur(FilterEffect* in, const float& x, const float& y)
-    : FilterEffect()
-    , m_in(in)
-    , m_x(x)
-    , m_y(y)
-{
-}
-
-PassRefPtr<FEGaussianBlur> FEGaussianBlur::create(FilterEffect* in, const float& x, const float& y)
-{
-    return adoptRef(new FEGaussianBlur(in, x, y));
-}
-
-float FEGaussianBlur::stdDeviationX() const
-{
-    return m_x;
-}
-
-void FEGaussianBlur::setStdDeviationX(float x)
-{
-    m_x = x;
-}
-
-float FEGaussianBlur::stdDeviationY() const
-{
-    return m_y;
-}
-
-void FEGaussianBlur::setStdDeviationY(float y)
-{
-    m_y = y;
-}
-
-void FEGaussianBlur::apply(Filter*)
-{
-}
-
-void FEGaussianBlur::dump()
-{
-}
-
-TextStream& FEGaussianBlur::externalRepresentation(TextStream& ts) const
-{
-    ts << "[type=GAUSSIAN-BLUR] ";
-    FilterEffect::externalRepresentation(ts);
-    ts << " [std dev. x=" << stdDeviationX() << " y=" << stdDeviationY() << "]";
-    return ts;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
index 3767734..f7fc5d8 100644
--- a/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEMorphology.cpp
@@ -28,7 +28,7 @@
 
 namespace WebCore {
 
-FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, const float& radiusX, const float& radiusY)
+FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, float radiusX, float radiusY)
     : FilterEffect()
     , m_in(in)
     , m_type(type)
@@ -37,7 +37,7 @@ FEMorphology::FEMorphology(FilterEffect* in, MorphologyOperatorType type, const
 {
 }
 
-PassRefPtr<FEMorphology> FEMorphology::create(FilterEffect* in, MorphologyOperatorType type, const float& radiusX, const float& radiusY)
+PassRefPtr<FEMorphology> FEMorphology::create(FilterEffect* in, MorphologyOperatorType type, float radiusX, float radiusY)
 {
     return adoptRef(new FEMorphology(in, type, radiusX, radiusY));
 }
@@ -88,8 +88,8 @@ static TextStream& operator<<(TextStream& ts, MorphologyOperatorType t)
             ts << "UNKNOWN"; break;
         case FEMORPHOLOGY_OPERATOR_ERODE:
             ts << "ERODE"; break;
-        case FEMORPHOLOGY_OPERATOR_DIALATE:
-            ts << "DIALATE"; break;
+        case FEMORPHOLOGY_OPERATOR_DILATE:
+            ts << "DILATE"; break;
     }
     return ts;
 }
diff --git a/WebCore/svg/graphics/filters/SVGFEMorphology.h b/WebCore/svg/graphics/filters/SVGFEMorphology.h
index bdc2b9b..6a321c8 100644
--- a/WebCore/svg/graphics/filters/SVGFEMorphology.h
+++ b/WebCore/svg/graphics/filters/SVGFEMorphology.h
@@ -31,12 +31,12 @@ namespace WebCore {
     enum MorphologyOperatorType {
         FEMORPHOLOGY_OPERATOR_UNKNOWN = 0,
         FEMORPHOLOGY_OPERATOR_ERODE   = 1,
-        FEMORPHOLOGY_OPERATOR_DIALATE = 2
+        FEMORPHOLOGY_OPERATOR_DILATE  = 2
     };
 
     class FEMorphology : public FilterEffect {
     public:
-        PassRefPtr<FEMorphology> create(FilterEffect*, MorphologyOperatorType, const float&, const float&);  
+        static PassRefPtr<FEMorphology> create(FilterEffect*, MorphologyOperatorType, float radiusX, float radiusY);  
         MorphologyOperatorType morphologyOperator() const;
         void setMorphologyOperator(MorphologyOperatorType);
 
@@ -52,7 +52,7 @@ namespace WebCore {
         TextStream& externalRepresentation(TextStream& ts) const;
 
     private:
-        FEMorphology(FilterEffect*, MorphologyOperatorType, const float&, const float&);
+        FEMorphology(FilterEffect*, MorphologyOperatorType, float radiusX, float radiusY);
         
         RefPtr<FilterEffect> m_in;
         MorphologyOperatorType m_type;
diff --git a/WebCore/svg/graphics/filters/SVGFilter.cpp b/WebCore/svg/graphics/filters/SVGFilter.cpp
index c892ee9..6bfcf39 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -24,12 +24,11 @@
 
 namespace WebCore {
 
-SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+SVGFilter::SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
     : Filter()
     , m_itemBox(itemBox)
     , m_filterRect(filterRect)
     , m_effectBBoxMode(effectBBoxMode)
-    , m_filterBBoxMode(filterBBoxMode)
 {
 }
 
@@ -37,7 +36,6 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
 {
     FloatRect subRegionBBox = effect->subRegion();
     FloatRect useBBox = effect->unionOfChildEffectSubregions();
-
     FloatRect newSubRegion = subRegionBBox;
 
     if (m_effectBBoxMode) {
@@ -55,17 +53,17 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
         if (effect->hasHeight())
             newSubRegion.setHeight(subRegionBBox.height() * m_itemBox.height());
     } else {
-        if (effect->xBoundingBoxMode())
-            newSubRegion.setX(useBBox.x() + subRegionBBox.x() * useBBox.width());
+        if (!effect->hasX())
+            newSubRegion.setX(useBBox.x());
 
-        if (effect->yBoundingBoxMode())
-            newSubRegion.setY(useBBox.y() + subRegionBBox.y() * useBBox.height());
+        if (!effect->hasY())
+            newSubRegion.setY(useBBox.y());
 
-        if (effect->widthBoundingBoxMode())
-            newSubRegion.setWidth(subRegionBBox.width() * useBBox.width());
+        if (!effect->hasWidth())
+            newSubRegion.setWidth(useBBox.width());
 
-        if (effect->heightBoundingBoxMode())
-            newSubRegion.setHeight(subRegionBBox.height() * useBBox.height());
+        if (!effect->hasHeight())
+            newSubRegion.setHeight(useBBox.height());
     }
 
     // clip every filter effect to the filter region
@@ -74,9 +72,9 @@ void SVGFilter::calculateEffectSubRegion(FilterEffect* effect)
     effect->setSubRegion(newSubRegion);
 }
 
-PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode, bool filterBBoxMode)
+PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode)
 {
-    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode, filterBBoxMode));
+    return adoptRef(new SVGFilter(itemBox, filterRect, effectBBoxMode));
 }
 
 } // namespace WebCore
diff --git a/WebCore/svg/graphics/filters/SVGFilter.h b/WebCore/svg/graphics/filters/SVGFilter.h
index d6e5f77..f23d1ea 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/WebCore/svg/graphics/filters/SVGFilter.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
     class SVGFilter : public Filter {
     public:
-        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool, bool);
+        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
 
         bool effectBoundingBoxMode() { return m_effectBBoxMode; }
 
@@ -42,12 +42,11 @@ namespace WebCore {
         void calculateEffectSubRegion(FilterEffect*);
 
     private:
-        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool itemBBoxMode, bool filterBBoxMode);
+        SVGFilter(const FloatRect& itemBox, const FloatRect& filterRect, bool effectBBoxMode);
 
         FloatRect m_itemBox;
         FloatRect m_filterRect;
         bool m_effectBBoxMode;
-        bool m_filterBBoxMode;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index 471c77b..30a0e4c 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -47,9 +47,7 @@ feGaussianBlur createWithNew
 feImage createWithNew
 feMerge createWithNew
 feMergeNode createWithNew
-#if 0
 feMorphology createWithNew
-#endif
 feOffset createWithNew
 fePointLight createWithNew
 feSpecularLighting createWithNew
diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 16211a7..32e0559 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -86,6 +86,22 @@ static bool isValidProtocolString(const WebCore::String& protocol)
     return true;
 }
 
+#if USE(V8)
+
+static bool webSocketsAvailable = false;
+
+void WebSocket::setIsAvailable(bool available)
+{
+    webSocketsAvailable = available;
+}
+
+bool WebSocket::isAvailable()
+{
+    return webSocketsAvailable;
+}
+
+#endif
+
 WebSocket::WebSocket(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
@@ -94,7 +110,8 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
 
 WebSocket::~WebSocket()
 {
-    close();
+    if (m_channel.get())
+        m_channel->disconnect();
 }
 
 void WebSocket::connect(const KURL& url, ExceptionCode& ec)
@@ -174,7 +191,7 @@ ScriptExecutionContext* WebSocket::scriptExecutionContext() const
 void WebSocket::didConnect()
 {
     LOG(Network, "WebSocket %p didConnect", this);
-    if (m_state != CONNECTING) {
+    if (m_state != CONNECTING || !scriptExecutionContext()) {
         didClose();
         return;
     }
@@ -185,7 +202,7 @@ void WebSocket::didConnect()
 void WebSocket::didReceiveMessage(const String& msg)
 {
     LOG(Network, "WebSocket %p didReceiveMessage %s", this, msg.utf8().data());
-    if (m_state != OPEN)
+    if (m_state != OPEN || !scriptExecutionContext())
         return;
     RefPtr<MessageEvent> evt = MessageEvent::create();
     // FIXME: origin, lastEventId, source, messagePort.
@@ -197,7 +214,8 @@ void WebSocket::didClose()
 {
     LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
+    if (scriptExecutionContext())
+        scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
 }
 
 EventTargetData* WebSocket::eventTargetData()
diff --git a/WebCore/websockets/WebSocket.h b/WebCore/websockets/WebSocket.h
index c5b7ee7..9ecbed7 100644
--- a/WebCore/websockets/WebSocket.h
+++ b/WebCore/websockets/WebSocket.h
@@ -50,6 +50,10 @@ namespace WebCore {
 
     class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
     public:
+#if USE(V8)
+        static void setIsAvailable(bool);
+        static bool isAvailable();
+#endif
         static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
         virtual ~WebSocket();
 
diff --git a/WebCore/websockets/WebSocket.idl b/WebCore/websockets/WebSocket.idl
index 04606fe..c662940 100644
--- a/WebCore/websockets/WebSocket.idl
+++ b/WebCore/websockets/WebSocket.idl
@@ -55,13 +55,13 @@ module websockets {
         void close();
 
         // EventTarget interface
-        // [Custom] void addEventListener(in DOMString type,
-        //   in EventListener listener,
-        //   in boolean useCapture);
-        // [Custom] void removeEventListener(in DOMString type,
-        //   in EventListener listener,
-        //   in boolean useCapture);
-        // boolean dispatchEvent(in Event evt)
-        //   raises(EventException);
+        [Custom] void addEventListener(in DOMString type,
+                                       in EventListener listener,
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
     };
 }
diff --git a/WebCore/websockets/WebSocketChannel.cpp b/WebCore/websockets/WebSocketChannel.cpp
index 145cd34..be388b4 100644
--- a/WebCore/websockets/WebSocketChannel.cpp
+++ b/WebCore/websockets/WebSocketChannel.cpp
@@ -71,6 +71,7 @@ void WebSocketChannel::connect()
     LOG(Network, "WebSocketChannel %p connect", this);
     ASSERT(!m_handle.get());
     m_handshake.reset();
+    ref();
     m_handle = SocketStreamHandle::create(m_handshake.url(), this);
 }
 
@@ -103,6 +104,14 @@ void WebSocketChannel::close()
         m_handle->close();  // will call didClose()
 }
 
+void WebSocketChannel::disconnect()
+{
+    LOG(Network, "WebSocketChannel %p disconnect", this);
+    m_client = 0;
+    if (m_handle.get())
+        m_handle->close();
+}
+
 void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
 {
 }
@@ -126,13 +135,15 @@ void WebSocketChannel::didClose(SocketStreamHandle* handle)
 {
     LOG(Network, "WebSocketChannel %p didClose", this);
     ASSERT(handle == m_handle.get() || !m_handle.get());
-    if (!m_handle.get())
-        return;
-    m_unhandledBufferSize = handle->bufferedAmount();
-    WebSocketChannelClient* client = m_client;
-    m_client = 0;
-    m_handle = 0;
-    client->didClose();
+    if (m_handle.get()) {
+        m_unhandledBufferSize = handle->bufferedAmount();
+        WebSocketChannelClient* client = m_client;
+        m_client = 0;
+        m_handle = 0;
+        if (client)
+            client->didClose();
+    }
+    deref();
 }
 
 void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
@@ -143,6 +154,10 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
         handle->close();
         return;
     }
+    if (!m_client) {
+        handle->close();
+        return;
+    }
     if (m_handshake.mode() != WebSocketHandshake::Connected) {
         int headerLength = m_handshake.readServerHandshake(m_buffer, m_bufferSize);
         if (headerLength <= 0)
@@ -184,7 +199,7 @@ void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* da
                     handle->close();
                     return;
                 }
-                length = length * 128 + *p & 0x7f;
+                length = length * 128 + (*p & 0x7f);
                 ++p;
             }
             if (p + length < end) {
diff --git a/WebCore/websockets/WebSocketChannel.h b/WebCore/websockets/WebSocketChannel.h
index 75f41f6..ad38163 100644
--- a/WebCore/websockets/WebSocketChannel.h
+++ b/WebCore/websockets/WebSocketChannel.h
@@ -47,7 +47,7 @@ namespace WebCore {
 
     class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient {
     public:
-        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return new WebSocketChannel(context, client, url, protocol); }
+        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return adoptRef(new WebSocketChannel(context, client, url, protocol)); }
         virtual ~WebSocketChannel();
 
         virtual void connect();
@@ -57,6 +57,8 @@ namespace WebCore {
 
         virtual void close();
 
+        virtual void disconnect();
+
         virtual void willOpenStream(SocketStreamHandle*, const KURL&);
         virtual void willSendData(SocketStreamHandle*, const char*, int);
         virtual void didOpen(SocketStreamHandle*);
diff --git a/WebCore/wml/WMLImageElement.cpp b/WebCore/wml/WMLImageElement.cpp
index d47868a..e577218 100644
--- a/WebCore/wml/WMLImageElement.cpp
+++ b/WebCore/wml/WMLImageElement.cpp
@@ -94,13 +94,12 @@ void WMLImageElement::attach()
 {
     WMLElement::attach();
 
-    if (renderer() && renderer()->isImage()) {
+    if (renderer() && renderer()->isImage() && m_imageLoader.haveFiredBeforeLoadEvent()) {
         RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
-
         imageObj->setCachedImage(m_imageLoader.image());
-
+        
         // If we have no image at all because we have no src attribute, set
         // image height and width for the alt text instead.
         if (!m_imageLoader.image() && !imageObj->cachedImage())
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index f85dd8e..e960514 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -49,9 +49,15 @@
 #include "WorkerThreadableLoader.h"
 #include "XMLHttpRequestException.h"
 #include <wtf/RefPtr.h>
+<<<<<<< HEAD:WebCore/workers/WorkerContext.cpp
 #if PLATFORM(ANDROID)
+=======
+>>>>>>> webkit.org at r50258.:WebCore/workers/WorkerContext.cpp
 #include <wtf/UnusedParam.h>
+<<<<<<< HEAD:WebCore/workers/WorkerContext.cpp
 #endif
+=======
+>>>>>>> webkit.org at r50258.:WebCore/workers/WorkerContext.cpp
 
 #if ENABLE(NOTIFICATIONS)
 #include "NotificationCenter.h"
diff --git a/WebCore/workers/WorkerContext.idl b/WebCore/workers/WorkerContext.idl
index 17bee55..0a5817c 100644
--- a/WebCore/workers/WorkerContext.idl
+++ b/WebCore/workers/WorkerContext.idl
@@ -72,7 +72,7 @@ module threads {
 
 #if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
         // Notification interface
-        readonly attribute NotificationCenter webkitNotifications;
+        readonly attribute [EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
 
         // Constructors
diff --git a/WebCore/wscript b/WebCore/wscript
index f183071..3719b84 100644
--- a/WebCore/wscript
+++ b/WebCore/wscript
@@ -31,7 +31,6 @@ webcore_sources = {}
 
 if build_port == "wx":
     webcore_sources['plugins'] = [  'plugins/PluginDataNone.cpp',
-                                    'plugins/PluginPackageNone.cpp',
                                     'plugins/PluginViewNone.cpp'
                                   ]
     
@@ -43,15 +42,17 @@ if build_port == "wx":
                # widely available (it was fixed in 2.8.10).
                'platform/win/SharedTimerWin.cpp',
                'page/win/PageWin.cpp',
-        
+               'plugins/win/PluginPackageWin.cpp',
         ]
     elif sys.platform.startswith('darwin'):
         webcore_dirs.append('platform/wx/wxcode/mac/carbon')
         webcore_sources['wx-mac'] = [
                'platform/mac/PurgeableBufferMac.cpp',
         ]
+        webcore_sources['plugins'].append('plugins/PluginPackageNone.cpp')
     else:
         webcore_dirs.append('platform/wx/wxcode/gtk')
+        webcore_sources['plugins'].append('plugins/PluginPackageNone.cpp')
         
 from TaskGen import taskgen, feature, after
 import Task, ccroot
@@ -116,7 +117,7 @@ def build(bld):
         source = ' '.join(flattenSources(webcore_sources.values())),
         cxxflags = cxxflags,
         target = 'webcore',
-        uselib = 'WX ICU XML XSLT CURL ' + get_config(),
+        uselib = 'WX ICU XML XSLT CURL SQLITE3 ' + get_config(),
         uselib_local = '',
         install_path = output_dir,
         )
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index ca48d8d..87a6540 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -33,6 +33,7 @@
 #include "EventNames.h"
 #include "File.h"
 #include "HTTPParsers.h"
+#include "InspectorTimelineAgent.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "SecurityOrigin.h"
@@ -47,7 +48,9 @@
 #include <wtf/RefCountedLeakCounter.h>
 
 #if USE(JSC)
+#include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
+#include <runtime/Protect.h>
 #endif
 
 namespace WebCore {
@@ -248,10 +251,32 @@ void XMLHttpRequest::callReadyStateChangeListener()
     if (!scriptExecutionContext())
         return;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
+    if (timelineAgent)
+        timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);
+#endif
+
     dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
 
-    if (m_state == DONE && !m_error)
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didChangeXHRReadyState();
+#endif
+
+    if (m_state == DONE && !m_error) {
+#if ENABLE(INSPECTOR)
+        if (timelineAgent)
+            timelineAgent->willLoadXHR(m_url.string());
+#endif
+
         dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
+
+#if ENABLE(INSPECTOR)
+        if (timelineAgent)
+            timelineAgent->didLoadXHR();
+#endif
+    }
 }
 
 void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
@@ -604,10 +629,8 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
-
-    if (JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext()))
-        if (DOMObject* wrapper = getCachedDOMObjectWrapper(*globalObject->globalData(), this))
-            JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*scriptExecutionContext()->globalData(), this))
+        JSC::Heap::heap(wrapper)->reportExtraMemoryCost(m_responseText.size() * 2);
 #endif
 
     unsetPendingActivity(this);
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index 30744a0..c7e0192 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -182,7 +182,7 @@ private:
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
     ExceptionCode m_exceptionCode;
-    
+
     EventTargetData m_eventTargetData;
 };
 
diff --git a/WebCore/xml/XPathFunctions.cpp b/WebCore/xml/XPathFunctions.cpp
index da39443..1089f7c 100644
--- a/WebCore/xml/XPathFunctions.cpp
+++ b/WebCore/xml/XPathFunctions.cpp
@@ -667,12 +667,13 @@ Value FunRound::evaluate() const
     return round(arg(0)->evaluate().toNumber());
 }
 
+struct FunctionMapping {
+    const char* name;
+    FunctionRec function;
+};
+
 static void createFunctionMap()
 {
-    struct FunctionMapping {
-        const char *name;
-        FunctionRec function;
-    };
     static const FunctionMapping functions[] = {
         { "boolean", { &createFunBoolean, 1 } },
         { "ceiling", { &createFunCeiling, 1 } },
diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index 9293336..5006da7 100644
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,48 @@
+2009-10-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Updated license
+
+        * LICENSE:
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move some WebView event handling code into its own file, WebViewEventHandling.mm
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2009-10-19  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        set ENABLE_NOTIFICATIONS=1 for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=29949
+
+        * chromium/features.gypi:
+
+2009-10-13  Drew Wilson  <atwilson@atwilson-macpro.local>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS for Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=30289
+
+        * chromium/features.gypi:
+        Turned on ENABLE_SHARED_WORKERS by default. This doesn't actually turn on
+        SharedWorkers yet, as Chromium overrides this flag in its feature_overrides.gypi.
+
+2009-10-12  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Port - Windows
+        https://bugs.webkit.org/show_bug.cgi?id=29969
+
+        * chromium/DEPS: Added gtest dep required by windows and incremented some of the deps revisions.
+
 2009-10-06  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Mark Rowe.
diff --git a/WebKit/LICENSE b/WebKit/LICENSE
index 47dee86..f29b41c 100644
--- a/WebKit/LICENSE
+++ b/WebKit/LICENSE
@@ -1,25 +1,21 @@
-Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions
 are met:
-
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
-3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
-    its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    documentation and/or other materials provided with the distribution.
 
-THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/WebKit/WebKit.xcodeproj/project.pbxproj b/WebKit/WebKit.xcodeproj/project.pbxproj
index db25bf9..a5a2e39 100644
--- a/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -330,6 +330,7 @@
 		BC2E464E0FD8A96800A9D9DE /* WebViewData.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC2E464C0FD8A96800A9D9DE /* WebViewData.mm */; };
 		BC542C420FD7766F00D8AB5D /* WebDelegateImplementationCaching.h in Headers */ = {isa = PBXBuildFile; fileRef = BC542C400FD7766F00D8AB5D /* WebDelegateImplementationCaching.h */; };
 		BC542C430FD7766F00D8AB5D /* WebDelegateImplementationCaching.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC542C410FD7766F00D8AB5D /* WebDelegateImplementationCaching.mm */; };
+		BC97E7E210963D260010D361 /* WebViewEventHandling.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC97E7E110963D260010D361 /* WebViewEventHandling.mm */; };
 		C0167BF80D7F5DD00028696E /* WebScriptDebugger.h in Headers */ = {isa = PBXBuildFile; fileRef = C0167BF60D7F5DD00028696E /* WebScriptDebugger.h */; };
 		C0167BF90D7F5DD00028696E /* WebScriptDebugger.mm in Sources */ = {isa = PBXBuildFile; fileRef = C0167BF70D7F5DD00028696E /* WebScriptDebugger.mm */; };
 		DD7CDEE70A23BA9E00069928 /* WebTypesInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = DD7CDEE60A23BA9E00069928 /* WebTypesInternal.h */; };
@@ -604,6 +605,7 @@
 		BC2E464C0FD8A96800A9D9DE /* WebViewData.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebViewData.mm; sourceTree = "<group>"; };
 		BC542C400FD7766F00D8AB5D /* WebDelegateImplementationCaching.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebDelegateImplementationCaching.h; sourceTree = "<group>"; };
 		BC542C410FD7766F00D8AB5D /* WebDelegateImplementationCaching.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebDelegateImplementationCaching.mm; sourceTree = "<group>"; };
+		BC97E7E110963D260010D361 /* WebViewEventHandling.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebViewEventHandling.mm; sourceTree = "<group>"; };
 		BE4FBECB0653DF47005EDE15 /* WebEditingDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebEditingDelegate.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BE6DC39904C62C4E004D0EF6 /* WebNSURLExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSURLExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BE6DC39A04C62C4E004D0EF6 /* WebNSURLExtras.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNSURLExtras.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -1144,6 +1146,7 @@
 				BC2E464C0FD8A96800A9D9DE /* WebViewData.mm */,
 				930D02BB06275F640076701E /* WebViewInternal.h */,
 				51A8B57D0428353A00CA2D3A /* WebViewPrivate.h */,
+				BC97E7E110963D260010D361 /* WebViewEventHandling.mm */,
 				0FD3B0F61076C3F700039B96 /* WebWindowAnimation.h */,
 				0FD3B0F71076C3F700039B96 /* WebWindowAnimation.m */,
 			);
@@ -1849,6 +1852,7 @@
 				0FD3B0F51076C3E900039B96 /* WebVideoFullscreenHUDWindowController.mm in Sources */,
 				0FD3B0F91076C3F700039B96 /* WebWindowAnimation.m in Sources */,
 				0A2D87FE107AF52B00CDDEE3 /* WebPluginHalterClient.mm in Sources */,
+				BC97E7E210963D260010D361 /* WebViewEventHandling.mm in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
index 514a640..5f5b9b8 100644
--- a/WebKit/chromium/DEPS
+++ b/WebKit/chromium/DEPS
@@ -35,17 +35,18 @@ vars = {
   'chromium_deps_svn': 'http://src.chromium.org/svn/trunk/deps/third_party',
 
   # Dependencies' revisions to use:
-  'chromium_rev': '27692',
+  'chromium_rev': '28710',
   'google-url_rev': '119',
-  'gyp_rev': '671',
+  'gtest_rev': '329',
+  'gyp_rev': '685',
   'icu_rev': '27687',
-  'openvcdiff_rev': '26',
-  'skia_rev': '341',
-  'v8_rev': '2966',
+  'openvcdiff_rev': '28',
+  'skia_rev': '376',
+  'v8_rev': '3030',
 
   # Windows:
   'cygwin_rev': '11984',
-  'ffmpeg_ia32_rev': '26428',
+  'ffmpeg_ia32_rev': '28488',
   'pthreads-win32_rev': '26716',
   'python_24_rev': '22967',
 }
@@ -72,11 +73,15 @@ deps = {
   # testing
   'testing':
     Var('chromium_svn')+'/testing@'+Var('chromium_rev'),
+  'testing/gtest':
+    'http://googletest.googlecode.com/svn/trunk@'+Var('gtest_rev'),
 
   # v8 javascript engine
   'v8':
     'http://v8.googlecode.com/svn/trunk@'+Var('v8_rev'),
-  
+  'testing/gtest':
+    'http://googletest.googlecode.com/svn/trunk@'+Var('gtest_rev'),
+
   # net dependencies
   'net':
     Var('chromium_svn')+'/net@'+Var('chromium_rev'),
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
index f91598c..e3bc7d3 100644
--- a/WebKit/chromium/features.gypi
+++ b/WebKit/chromium/features.gypi
@@ -49,11 +49,11 @@
         'ENABLE_JAVASCRIPT_DEBUGGER=0',
         'ENABLE_JSC_MULTIPLE_THREADS=0',
         'ENABLE_ICONDATABASE=0',
-        'ENABLE_NOTIFICATIONS=0',
+        'ENABLE_NOTIFICATIONS=1',
         'ENABLE_ORIENTATION_EVENTS=0',
         'ENABLE_XSLT=1',
         'ENABLE_XPATH=1',
-        'ENABLE_SHARED_WORKERS=0',
+        'ENABLE_SHARED_WORKERS=1',
         'ENABLE_SVG=1',
         'ENABLE_SVG_ANIMATION=1',
         'ENABLE_SVG_AS_IMAGE=1',
diff --git a/WebKit/gtk/ChangeLog b/WebKit/gtk/ChangeLog
index 370fb2b..62aa3da 100644
--- a/WebKit/gtk/ChangeLog
+++ b/WebKit/gtk/ChangeLog
@@ -1,3 +1,244 @@
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] API to start inspector for a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=22551
+
+        Provide a simple, coordinates-based API to start the inspector.
+
+        * WebCoreSupport/InspectorClientGtk.cpp:
+        (WebKit::InspectorClient::createPage): Use files from the source
+        tree when running from the top of the source directory.
+        (WebKit::InspectorClient::localizedStringsURL): Ditto.
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebinspector.cpp:
+        (webkit_web_inspector_inspect_coordinates):
+        (webkit_web_inspector_close):
+        (webkit_web_inspector_execute_script):
+        * webkit/webkitwebinspector.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_counter_value_for_element_by_id):
+
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Call the shared FrameLoader::defaultObjectContentType instead of
+        copying code into FrameLoaderClient::objectContentType.  This causes no
+        behavioural change.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::objectContentType):
+
+2009-10-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        [Gtk] Extraneous object of ROLE_PANEL in hierarchy for entries
+        https://bugs.webkit.org/show_bug.cgi?id=25897
+
+        Update test to also check that entries implement the AtkText
+        interface.
+
+        * tests/testatk.c:
+        (run_get_text_tests):
+        (test_webkit_atk_get_text_at_offset_forms):
+        (test_webkit_atk_get_text_at_offset):
+        (main):
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Update documentation control files for 1.1.16.
+
+        * docs/webkitgtk-docs.sgml:
+        * docs/webkitgtk-sections.txt:
+
+2009-10-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30759
+        [GTK] Should use WebKitNetworkResponse, and expose it
+
+        WebKitDownload now uses our WebKitNetworkResponse instead of using
+        ResourceResponse directly. By exposing the response, like we do
+        with the request, we give our users the ability to look at the
+        response headers, status code, and so on, through the SoupMessage
+        object.
+
+        * webkit/webkitdownload.cpp:
+        (webkit_download_dispose):
+        (webkit_download_finalize):
+        (webkit_download_get_property):
+        (webkit_download_set_property):
+        (webkit_download_class_init):
+        (webkit_download_get_network_response):
+        (webkit_download_set_response):
+        (webkit_download_get_total_size):
+        (webkit_download_get_progress):
+        (webkit_download_received_data):
+        * webkit/webkitdownload.h:
+
+2009-10-26  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Update for 1.1.16 release.
+
+        * NEWS:
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Build fix following bug #30696.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::windowObjectCleared):
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_get_global_context):
+
+2009-10-22  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        m_webView should be private attribute of the EditorClientGtk.
+        https://bugs.webkit.org/show_bug.cgi?id=30664
+
+        * WebKit/gtk/WebCoreSupport/EditorClientGtk.h:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Removed WebSocket runtime settings.
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        WebSocket runtime configuration is supported by chromium/v8 only.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2009-10-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [Gtk] ApplicationCacheStorage error while compiling WebKit/gtk/webkit/webkitapplicationcache.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30358
+
+        Guard calls to cacheStorage() with ENABLE(OFFLINE_WEB_APPLICATIONS).
+
+        * webkit/webkitapplicationcache.cpp:
+
+2009-10-19  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add a settings to allow DOM pastes to be performed.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2009-10-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Make WebKitHitTestResult actually appear in the
+        documentation index.
+
+        * docs/webkitgtk-docs.sgml:
+
+2009-10-15  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Protect WebSocket calls in case the feature is not compiled in.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2009-10-15  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Add a settings to enable support for experimental Web Sockets.
+        Currently this comes in handy in layout tests.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2009-10-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        page transition may crash webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29890
+
+        There are actually cases in which a resource may be asked using
+        webkit_web_view_get_resource after a new load has already been
+        started, so protect ourselves from crashes in this case.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidFinishLoading):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_get_resource):
+
+2009-10-12  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Remove unnecessary self-include.
+
+        * webkit/webkitsecurityorigin.h:
+
+2009-10-12  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Crash when right-clicking misspelled word
+        https://bugs.webkit.org/show_bug.cgi?id=29772
+
+        Make sure the dictionary exist before adding it to the list of
+        dictionaries.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::checkSpellingOfString):
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_set_property):
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_execute_script):
+
 2009-10-07  Xan Lopez  <xlopez@igalia.com>
 
         Fix the GTK+ build.
@@ -2001,7 +2242,7 @@
 
         Refactor how SoupMessage is handled, so that our ResourceRequest
         object doesn't have to store it as a member, which complicates
-        managing ResourceRequest's lifetime.
+        managing ResourceRequest's lifetvime.
 
         * tests/testhttpbackend.c:
         (navigation_policy_decision_requested_cb):
diff --git a/WebKit/gtk/NEWS b/WebKit/gtk/NEWS
index 8d0803c..b901f4b 100644
--- a/WebKit/gtk/NEWS
+++ b/WebKit/gtk/NEWS
@@ -1,4 +1,28 @@
 =================
+WebKitGTK+ 1.1.16
+=================
+
+What's new in WebKitGTK+ 1.1.16?
+
+  - Add optional support to generate the gobject-introspection
+    gir/typelib files. Enable with --enable-introspection, it's off by
+    default.
+  - Add a new load status value, WEBKIT_LOAD_FAILED, emitted when
+    there's an error during the load process. This is the natural
+    companion to WEBKIT_LOAD_FINISHED, which is only emitted when the
+    load finished succesfuly.
+  - Ensure that keyboard events filtered by GtkIMContext still create
+    the proper DOM events.
+  - Many a11y improvements: caret browsing fixes, expose heading
+    levels, more accessible roles supported, more work in correctly
+    showing the element's ancestry list, improved support for lists,
+    etc.
+  - Many improvements to our media support.
+  - Add a new setting to control DOM pastes
+    (document.execCommand("Paste"))
+  - Many, many bugfixes all over the place.
+
+=================
 WebKitGTK+ 1.1.15
 =================
 
diff --git a/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
index 7121163..6ec6baf 100644
--- a/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
@@ -615,6 +615,10 @@ void EditorClient::learnWord(const String& text)
 
 void EditorClient::checkSpellingOfString(const UChar* text, int length, int* misspellingLocation, int* misspellingLength)
 {
+    GSList* langs = webkit_web_settings_get_spell_languages(m_webView);
+    if (!langs)
+        return;
+
     gchar* ctext = g_utf16_to_utf8(const_cast<gunichar2*>(text), length, 0, 0, 0);
     int utflen = g_utf8_strlen(ctext, -1);
 
@@ -632,7 +636,6 @@ void EditorClient::checkSpellingOfString(const UChar* text, int length, int* mis
             int start = i;
             int end = i;
             int wordLength;
-            GSList* langs = webkit_web_settings_get_spell_languages(m_webView);
 
             while (attrs[end].is_word_end < 1)
                 end++;
diff --git a/WebKit/gtk/WebCoreSupport/EditorClientGtk.h b/WebKit/gtk/WebCoreSupport/EditorClientGtk.h
index 68034cf..9292651 100644
--- a/WebKit/gtk/WebCoreSupport/EditorClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/EditorClientGtk.h
@@ -118,6 +118,7 @@ namespace WebKit {
         virtual void getGuessesForWord(const WebCore::String&, WTF::Vector<WebCore::String>& guesses);
         virtual void setInputMethodState(bool enabled);
 
+    private:
         WebKitWebView* m_webView;
     };
 }
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index 1cf9aee..d53df88 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -4,6 +4,7 @@
  *  Copyright (C) 2007 Christian Dywan <christian@twotoasts.de>
  *  Copyright (C) 2008, 2009 Collabora Ltd.  All rights reserved.
  *  Copyright (C) 2009 Gustavo Noronha Silva <gns@gnome.org>
+ *  Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -490,24 +491,7 @@ PassRefPtr<Widget> FrameLoaderClient::createJavaAppletWidget(const IntSize&, HTM
 
 ObjectContentType FrameLoaderClient::objectContentType(const KURL& url, const String& mimeType)
 {
-    String type = mimeType;
-    // We don't use MIMETypeRegistry::getMIMETypeForPath() because it returns "application/octet-stream" upon failure
-    if (type.isEmpty())
-        type = MIMETypeRegistry::getMIMETypeForExtension(url.path().substring(url.path().reverseFind('.') + 1));
-
-    if (type.isEmpty())
-        return WebCore::ObjectContentFrame;
-
-    if (MIMETypeRegistry::isSupportedImageMIMEType(type))
-        return WebCore::ObjectContentImage;
-
-    if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
-        return WebCore::ObjectContentNetscapePlugin;
-
-    if (MIMETypeRegistry::isSupportedNonImageMIMEType(type))
-        return WebCore::ObjectContentFrame;
-
-    return WebCore::ObjectContentNone;
+    return FrameLoader::defaultObjectContentType(url, mimeType);
 }
 
 String FrameLoaderClient::overrideMediaType() const
@@ -530,8 +514,8 @@ void FrameLoaderClient::windowObjectCleared()
 
     // TODO: Consider using g_signal_has_handler_pending() to avoid the overhead
     // when there are no handlers.
-    JSGlobalContextRef context = toGlobalRef(coreFrame->script()->globalObject()->globalExec());
-    JSObjectRef windowObject = toRef(coreFrame->script()->globalObject());
+    JSGlobalContextRef context = toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
+    JSObjectRef windowObject = toRef(coreFrame->script()->globalObject(mainThreadNormalWorld()));
     ASSERT(windowObject);
 
     WebKitWebView* webView = getViewFromFrame(m_frame);
@@ -847,6 +831,11 @@ void FrameLoaderClient::dispatchDidFinishLoading(WebCore::DocumentLoader* loader
     GOwnPtr<gchar> identifierString(toString(identifier));
     WebKitWebResource* webResource = webkit_web_view_get_resource(webView, identifierString.get());
 
+    // A NULL WebResource means the load has been interrupted, and
+    // replaced by another one while this resource was being loaded.
+    if (!webResource)
+        return;
+
     const char* uri = webkit_web_resource_get_uri(webResource);
     RefPtr<ArchiveResource> coreResource(loader->subresource(KURL(KURL(), uri)));
 
diff --git a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
index fef07c1..78f5543 100644
--- a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
@@ -97,9 +97,17 @@ Page* InspectorClient::createPage()
     g_signal_connect(m_webView, "destroy",
                      G_CALLBACK(notifyWebViewDestroyed), (gpointer)this);
 
-    gchar* inspectorURI = g_filename_to_uri(DATA_DIR"/webkit-1.0/webinspector/inspector.html", NULL, NULL);
-    webkit_web_view_load_uri(m_webView, inspectorURI);
-    g_free(inspectorURI);
+    GOwnPtr<gchar> inspectorURI;
+
+    // Make the Web Inspector work when running tests
+    if (g_file_test("WebCore/inspector/front-end/inspector.html", G_FILE_TEST_EXISTS)) {
+        GOwnPtr<gchar> currentDirectory(g_get_current_dir());
+        GOwnPtr<gchar> fullPath(g_strdup_printf("%s/WebCore/inspector/front-end/inspector.html", currentDirectory.get()));
+        inspectorURI.set(g_filename_to_uri(fullPath.get(), NULL, NULL));
+    } else
+        inspectorURI.set(g_filename_to_uri(DATA_DIR"/webkit-1.0/webinspector/inspector.html", NULL, NULL));
+
+    webkit_web_view_load_uri(m_webView, inspectorURI.get());
 
     gtk_widget_show(GTK_WIDGET(m_webView));
 
@@ -108,8 +116,18 @@ Page* InspectorClient::createPage()
 
 String InspectorClient::localizedStringsURL()
 {
+    GOwnPtr<gchar> URL;
+
+    // Make the Web Inspector work when running tests
+    if (g_file_test("WebCore/English.lproj/localizedStrings.js", G_FILE_TEST_EXISTS)) {
+        GOwnPtr<gchar> currentDirectory(g_get_current_dir());
+        GOwnPtr<gchar> fullPath(g_strdup_printf("%s/WebCore/English.lproj/localizedStrings.js", currentDirectory.get()));
+        URL.set(g_filename_to_uri(fullPath.get(), NULL, NULL));
+    } else
+        URL.set(g_filename_to_uri(DATA_DIR"/webkit-1.0/webinspector/localizedStrings.js", NULL, NULL));
+
     // FIXME: support l10n of localizedStrings.js
-    return String::fromUTF8(g_filename_to_uri(DATA_DIR"/webkit-1.0/webinspector/localizedStrings.js", NULL, NULL));
+    return String::fromUTF8(URL.get());
 }
 
 String InspectorClient::hiddenPanels()
diff --git a/WebKit/gtk/docs/webkitgtk-docs.sgml b/WebKit/gtk/docs/webkitgtk-docs.sgml
index ca608d4..7719336 100644
--- a/WebKit/gtk/docs/webkitgtk-docs.sgml
+++ b/WebKit/gtk/docs/webkitgtk-docs.sgml
@@ -25,6 +25,7 @@
     <xi:include href="xml/webkitwebdatasource.xml"/>
     <xi:include href="xml/webkitwebresource.xml"/>
     <xi:include href="xml/webkitdownload.xml"/>
+    <xi:include href="xml/webkithittestresult.xml"/>
     <xi:include href="xml/webkitsoupauthdialog.xml"/>
     <xi:include href="xml/webkitsecurityorigin.xml"/>
     <xi:include href="xml/webkitwebwindowfeatures.xml"/>
@@ -89,4 +90,7 @@
   <index id="index-1.1.15" role="1.1.15">
     <title>Index of new symbols in 1.1.15</title>
   </index>
+  <index id="index-1.1.16" role="1.1.16">
+    <title>Index of new symbols in 1.1.16</title>
+  </index>
 </book>
diff --git a/WebKit/gtk/docs/webkitgtk-sections.txt b/WebKit/gtk/docs/webkitgtk-sections.txt
index a7b636c..8bdd3b3 100644
--- a/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -132,6 +132,7 @@ webkit_download_get_current_size
 webkit_download_get_destination_uri
 webkit_download_get_elapsed_time
 webkit_download_get_network_request
+webkit_download_get_network_response
 webkit_download_get_progress
 webkit_download_get_status
 webkit_download_get_suggested_filename
diff --git a/WebKit/gtk/po/ChangeLog b/WebKit/gtk/po/ChangeLog
index 68321ad..d7eee3a 100644
--- a/WebKit/gtk/po/ChangeLog
+++ b/WebKit/gtk/po/ChangeLog
@@ -1,3 +1,32 @@
+2009-10-19  Daniel Macks  <dmacks@netspace.org>
+
+        Reviewed by Adam Barth.
+
+        Inconsistent handling of gettext domain can cause compile failure
+        https://bugs.webkit.org/show_bug.cgi?id=30292
+
+        * GNUmakefile.am: Use DOMAIN variable instead of hard-coded value
+
+2009-10-15  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] marshal stamp files are not cleaned after a distclean
+        https://bugs.webkit.org/show_bug.cgi?id=30156
+
+        Add stamp-po to CLEANFILES.
+
+        * GNUmakefile.am:
+
+2009-10-09  Rimas Kudelis  <rq@akl.lt>
+
+        Rubber-stamped by Gustavo Noronha
+
+        https://bugs.webkit.org/show_bug.cgi?id=30054
+        Localization of WebKit GTK into Lithuanian
+
+        * lt.po: Added.
+
 2009-07-18  Jorge González  <aloriel@gmail.com>
 
         Rubber-stamped by Jan Alonzo.
diff --git a/WebKit/gtk/po/GNUmakefile.am b/WebKit/gtk/po/GNUmakefile.am
index b5b0c4c..2c5ff94 100644
--- a/WebKit/gtk/po/GNUmakefile.am
+++ b/WebKit/gtk/po/GNUmakefile.am
@@ -73,7 +73,7 @@ $(DOMAIN).pot-update: $(POTFILES) $(srcdir)/WebKit/gtk/po/POTFILES
 	      --files-from=$(srcdir)/WebKit/gtk/po/POTFILES \
 	      --copyright-holder='$(COPYRIGHT_HOLDER)' \
 	      --msgid-bugs-address="$$msgid_bugs_address" \
-	      --keyword=_ --keyword=N_ -o $(srcdir)/WebKit/gtk/po/webkit.pot \
+	      --keyword=_ --keyword=N_ -o $(srcdir)/WebKit/gtk/po/$(DOMAIN).pot \
 	    ;; \
 	  *) \
 	    $(XGETTEXT) --default-domain=$(DOMAIN) --directory=$(srcdir) \
@@ -83,7 +83,7 @@ $(DOMAIN).pot-update: $(POTFILES) $(srcdir)/WebKit/gtk/po/POTFILES
 	      --package-name="$${package_gnu}@PACKAGE@" \
 	      --package-version='@VERSION@' \
 	      --msgid-bugs-address="$$msgid_bugs_address" \
-	      --keyword=_ --keyword=N_ -o $(srcdir)/WebKit/gtk/po/webkit.pot \
+	      --keyword=_ --keyword=N_ -o $(srcdir)/WebKit/gtk/po/$(DOMAIN).pot \
 	    ;; \
 	esac
 
@@ -116,8 +116,8 @@ update-po: GNUmakefile
 	exit 1
 
 # clean rules
-stamp_files += \
-	stamp-po
+CLEANFILES += \
+	$(top_builddir)/stamp-po
 
 MAINTAINERCLEANFILES += \
 	$(MOFILES)
diff --git a/WebKit/gtk/po/lt.po b/WebKit/gtk/po/lt.po
new file mode 100644
index 0000000..a212b29
--- /dev/null
+++ b/WebKit/gtk/po/lt.po
@@ -0,0 +1,702 @@
+# Lithuanian translation for WebKit GTK.
+# This file is put in the public domain.
+# Rimas Kudelis <rq@akl.lt>, 2009.
+msgid ""
+msgstr ""
+"Project-Id-Version: webkit 1.1.4\n"
+"Report-Msgid-Bugs-To: http://bugs.webkit.org/\n"
+"POT-Creation-Date: 2009-04-09 19:09-0300\n"
+"PO-Revision-Date: 2009-10-09 18:42+0200\n"
+"Last-Translator: Rimas Kudelis <rq@akl.lt>\n"
+"Language-Team: Lithuanian <komp_lt@konferencijos.lt>\n"
+"Language: lt\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+"X-Generator: Virtaal 0.4.0\n"
+
+#: WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:425
+msgid "Upload File"
+msgstr "Failo išsiuntimas"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:61
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:139
+msgid "Input _Methods"
+msgstr "Įvesties _metodai"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:78
+msgid "LRM _Left-to-right mark"
+msgstr "Krypties iš _kairės į dešinę ženklas (LRM)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:79
+msgid "RLM _Right-to-left mark"
+msgstr "Krypties iš _dešinės į kairę ženklas (RLM)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:80
+msgid "LRE Left-to-right _embedding"
+msgstr "Į_terpimo iš kairės į dešinę ženklas (LRE)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:81
+msgid "RLE Right-to-left e_mbedding"
+msgstr "Įt_erpimo iš dešinės į kairę ženklas (RLE)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:82
+msgid "LRO Left-to-right _override"
+msgstr "_Perdengiantis iš kairės į dešinę ženklas (LRO)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:83
+msgid "RLO Right-to-left o_verride"
+msgstr "Pe_rdengiantis iš dešinės į kairę ženklas (RLO)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:84
+msgid "PDF _Pop directional formatting"
+msgstr "_Ankstesnio lygmens krypties ženklas (PDF)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:85
+msgid "ZWS _Zero width space"
+msgstr "_Nulinio pločio tarpas (ZWS)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:86
+msgid "ZWJ Zero width _joiner"
+msgstr "Nulinio pločio _jungimo ženklas (ZWJ)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:87
+msgid "ZWNJ Zero width _non-joiner"
+msgstr "Nulinio pločio _skėlimo ženklas (ZWNJ)"
+
+#: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:109
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:134
+msgid "_Insert Unicode Control Character"
+msgstr "Įterpti unikodo valdymo ženklą"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:250
+#, fuzzy
+msgid "Network Request"
+msgstr "Tinklo užklausa"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:251
+#, fuzzy
+msgid "The network request for the URI that should be downloaded"
+msgstr "Tinklo užklausa parsiųstino failo universaliajam ištekliaus identifikatoriui (URI)"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:265
+msgid "Destination URI"
+msgstr "Paskirties URI"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:266
+msgid "The destination URI where to save the file"
+msgstr "Paskirties failo universalusis ištekliaus identifikatorius (URI)"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:280
+msgid "Suggested Filename"
+msgstr "Siūlomas failo vardas"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:281
+msgid "The filename suggested as default when saving"
+msgstr "Numatytasis siūlomas įrašomo failo vardas"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:294
+msgid "Progress"
+msgstr "Progresas"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:295
+#, fuzzy
+msgid "Determines the current progress of the download"
+msgstr "Nurodo atsiuntimo progresą"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:308
+msgid "Status"
+msgstr "Būsena"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:309
+#, fuzzy
+msgid "Determines the current status of the download"
+msgstr "Nurodo atsiuntimo būseną"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:324
+msgid "Current Size"
+msgstr "Esamasis dydis"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:325
+msgid "The length of the data already downloaded"
+msgstr "Jau parsiųstų duomenų kiekis"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:339
+msgid "Total Size"
+msgstr "Visas dydis"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:340
+msgid "The total size of the file"
+msgstr "Visas failo dydis"
+
+#: WebKit/gtk/webkit/webkitdownload.cpp:469
+msgid "User cancelled the download"
+msgstr "Naudotojas atsisakė siuntimo"
+
+#: WebKit/gtk/webkit/webkitsoupauthdialog.c:244
+#, c-format
+msgid "A username and password are being requested by the site %s"
+msgstr "Svetainei %s reikalingas naudotojo vardas ir slaptažodis"
+
+#: WebKit/gtk/webkit/webkitsoupauthdialog.c:269
+msgid "Username:"
+msgstr "Naudotojo vardas:"
+
+#: WebKit/gtk/webkit/webkitsoupauthdialog.c:271
+msgid "Password:"
+msgstr "Slaptažodis:"
+
+#: WebKit/gtk/webkit/webkitsoupauthdialog.c:281
+msgid "Remember password"
+msgstr "Įsiminti slaptažodį"
+
+#: WebKit/gtk/webkit/webkitwebframe.cpp:211
+msgid "Name"
+msgstr "Pavadinimas"
+
+#: WebKit/gtk/webkit/webkitwebframe.cpp:212
+msgid "The name of the frame"
+msgstr "Kadro pavadinimas"
+
+#: WebKit/gtk/webkit/webkitwebframe.cpp:218
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:154
+#: WebKit/gtk/webkit/webkitwebview.cpp:1715
+msgid "Title"
+msgstr "Antraštė"
+
+#: WebKit/gtk/webkit/webkitwebframe.cpp:219
+msgid "The document title of the frame"
+msgstr "Kadre atverto tinklalapio pavadinimas"
+
+#: WebKit/gtk/webkit/webkitwebframe.cpp:225
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:186
+#: WebKit/gtk/webkit/webkitwebview.cpp:1729
+msgid "URI"
+msgstr "URI"
+
+#: WebKit/gtk/webkit/webkitwebframe.cpp:226
+msgid "The current URI of the contents displayed by the frame"
+msgstr "Kadre atverto tinklalapio universalusis ištekliaus identifikatorius (URI)"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:155
+msgid "The title of the history item"
+msgstr "Žurnalo įrašo pavadinimas"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:170
+msgid "Alternate Title"
+msgstr "Alternatyvus pavadinimas"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:171
+msgid "The alternate title of the history item"
+msgstr "Alternatyvus žurnalo įrašo pavadinimas"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:187
+msgid "The URI of the history item"
+msgstr "Žurnalo įrašo universalusis ištekliaus identifikatorius (URI)"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:202
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:167
+msgid "Original URI"
+msgstr "Pirminis URI"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:203
+msgid "The original URI of the history item"
+msgstr "Pirminis žurnalo įrašo universalusis ištekliaus identifikatorius (URI)"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:218
+msgid "Last visited Time"
+msgstr "Paskutinis apsilankymas"
+
+#: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:219
+msgid "The time at which the history item was last visited"
+msgstr "Paskutinio apsilankymo data ir laikas"
+
+#: WebKit/gtk/webkit/webkitwebinspector.cpp:260
+msgid "Web View"
+msgstr "Žiniatinklio rodinys"
+
+#: WebKit/gtk/webkit/webkitwebinspector.cpp:261
+msgid "The Web View that renders the Web Inspector itself"
+msgstr "Žiniatinklio rodinys, rodantis žiniatinklio analizatorių"
+
+#: WebKit/gtk/webkit/webkitwebinspector.cpp:274
+msgid "Inspected URI"
+msgstr "Analizuojamas URI"
+
+#: WebKit/gtk/webkit/webkitwebinspector.cpp:275
+msgid "The URI that is currently being inspected"
+msgstr "Šiuo metu analizuojamo failo universalusi ištekliaus identifikatorius (URI)"
+
+#: WebKit/gtk/webkit/webkitwebinspector.cpp:291
+msgid "Enable JavaScript profiling"
+msgstr "Įjungti „JavaScript“ profiliavimą"
+
+#: WebKit/gtk/webkit/webkitwebinspector.cpp:292
+msgid "Profile the executed JavaScript."
+msgstr "Profiliuoti vykdomą „JavaScript“ kodą."
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:152
+msgid "Reason"
+msgstr "Priežastis"
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:153
+#, fuzzy
+msgid "The reason why this navigation is occurring"
+msgstr "Tinklalapio atvėrimo priežastis"
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:168
+msgid "The URI that was requested as the target for the navigation"
+msgstr "Mėginamo atverti tinklalapio universalusis ištekliaus identifikatorius (URI)"
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:180
+msgid "Button"
+msgstr "Mygtukas"
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:181
+msgid "The button used to click"
+msgstr "Mygtukas, kurį galima paspausti"
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:196
+msgid "Modifier state"
+msgstr "Modifikatorių būsena"
+
+#: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:197
+msgid "A bitmask representing the state of the modifier keys"
+msgstr "Bitų kaukė, atspindinti modifikavimo klavišų būseną"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:129
+msgid "Default Encoding"
+msgstr "Numatytoji koduotė"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:130
+msgid "The default encoding used to display text."
+msgstr "Numatytoji teksto koduotė."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:138
+msgid "Cursive Font Family"
+msgstr "Rankraštinių šriftų šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:139
+msgid "The default Cursive font family used to display text."
+msgstr "Numatytoji tekstui atvaizduoti naudojama rankraštinių šriftų šeima."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:147
+msgid "Default Font Family"
+msgstr "Numatytoji šriftų šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:148
+msgid "The default font family used to display text."
+msgstr "Numatytoji tekstui atvaizduoti naudojama šriftų šeima."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:156
+msgid "Fantasy Font Family"
+msgstr "Dekoratyvių šriftų šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:157
+msgid "The default Fantasy font family used to display text."
+msgstr "Numatytoji tekstui atvaizduoti naudojama dekoratyvių šriftų šeima."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:165
+msgid "Monospace Font Family"
+msgstr "Lygiapločių šriftų šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:166
+msgid "The default font family used to display monospace text."
+msgstr "Numatytoji tekstui atvaizduoti naudojama lygiapločių šriftų šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:174
+msgid "Sans Serif Font Family"
+msgstr "Šriftų be užraitų šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:175
+msgid "The default Sans Serif font family used to display text."
+msgstr "Numatytoji tekstui atvaizduoti naudojama šriftų be užraitų šeima."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:183
+msgid "Serif Font Family"
+msgstr "Šriftų su užraitais šeima"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:184
+msgid "The default Serif font family used to display text."
+msgstr "Numatytoji tekstui atvaizduoti naudojama šriftų su užraitais šeima."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:192
+msgid "Default Font Size"
+msgstr "Numatytasis šrifto dydis"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:193
+msgid "The default font size used to display text."
+msgstr "Numatytasis tekstui atvaizduoti naudojamo šrifto dydis."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:201
+msgid "Default Monospace Font Size"
+msgstr "Numatytasis lygiapločio šrifto dydis"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:202
+msgid "The default font size used to display monospace text."
+msgstr "Numatytasis tekstui atvaizduoti naudojamo lygiapločio šrifto dydis"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:210
+msgid "Minimum Font Size"
+msgstr "Minimalus šrifto dydis"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:211
+msgid "The minimum font size used to display text."
+msgstr "Mažiausias leistinas tekstui atvaizduoti naudojamo šrifto dydis."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:219
+#, fuzzy
+msgid "Minimum Logical Font Size"
+msgstr "Minimalus loginis šrifto dydis"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:220
+#, fuzzy
+msgid "The minimum logical font size used to display text."
+msgstr "Mažiausias leistinas loginis tekstui atvaizduoti naudojamo šrifto dydis."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:239
+msgid "Enforce 96 DPI"
+msgstr "Naudoti 96 tašk./colyje"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:240
+msgid "Enforce a resolution of 96 DPI"
+msgstr "Priverstinai naudoti 96 tašk./colyje skiriamąją gebą"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:248
+msgid "Auto Load Images"
+msgstr "Įkelti paveikslus"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:249
+msgid "Load images automatically."
+msgstr "Automatiškai įkelti paveikslus."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:257
+msgid "Auto Shrink Images"
+msgstr "Mažinti paveikslus"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:258
+msgid "Automatically shrink standalone images to fit."
+msgstr "Automatiškai mažinti pavienius paveikslus, kad sutilptų į langą."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:266
+msgid "Print Backgrounds"
+msgstr "Spausdinti foną"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:267
+msgid "Whether background images should be printed."
+msgstr "Ar spausdinti fono piešinius."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:275
+msgid "Enable Scripts"
+msgstr "Įjungti scenarijus"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:276
+msgid "Enable embedded scripting languages."
+msgstr "Įjungti įtaisytuosius scenarijus."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:284
+msgid "Enable Plugins"
+msgstr "Įjungti papildinius"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:285
+msgid "Enable embedded plugin objects."
+msgstr "Įjungti įtaisytuosius papildinius."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:293
+msgid "Resizable Text Areas"
+msgstr "Keičiamo dydžio teksto laukai"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:294
+msgid "Whether text areas are resizable."
+msgstr "Ar leisti keisti teksto laukų dydį."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:301
+msgid "User Stylesheet URI"
+msgstr "Naudotojo stiliaus aprašo URI"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:302
+msgid "The URI of a stylesheet that is applied to every page."
+msgstr "Visiems tinklalapiams taikytino naudotojo stiliaus aprašo failo universalusis ištekliaus identifikatorius (URI)."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:317
+msgid "Zoom Stepping Value"
+msgstr "Mastelio keitimo žingsnis"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:318
+msgid "The value by which the zoom level is changed when zooming in or out."
+msgstr "Žingsnis, kuriuo keičiamas mastelis, jį didinant ar mažinant."
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:336
+msgid "Enable Developer Extras"
+msgstr "Įjungti programuotojų įrankius"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:337
+msgid "Enables special extensions that help developers"
+msgstr "Įjungti specialius tinklalapių programuotojams skirtus įrankius"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:357
+msgid "Enable Private Browsing"
+msgstr "Įjungti privatųjį naršymą"
+
+#: WebKit/gtk/webkit/webkitwebsettings.cpp:358
+msgid "Enables private browsing mode"
+msgstr "Įjungti privačiojo naršymo veikseną"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1716
+msgid "Returns the @web_view's document title"
+msgstr "Grąžina @web_view objekte atverto tinklalapio pavadinimą"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1730
+msgid "Returns the current URI of the contents displayed by the @web_view"
+msgstr "Grąžina @web_view objekte atverto tinklalapio universalųjį ištekliaus identifikatorių (URI)"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1743
+msgid "Copy target list"
+msgstr ""
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1744
+msgid "The list of targets this web view supports for clipboard copying"
+msgstr ""
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1757
+msgid "Paste target list"
+msgstr ""
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1758
+msgid "The list of targets this web view supports for clipboard pasting"
+msgstr ""
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1764
+msgid "Settings"
+msgstr "Nuostatos"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1765
+msgid "An associated WebKitWebSettings instance"
+msgstr "Susietasis „WebKitWebSettings“ tipo objektas"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1778
+msgid "Web Inspector"
+msgstr "Žiniatinklio analizatorius"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1779
+msgid "The associated WebKitWebInspector instance"
+msgstr "Susietasis „WebKitWebInspector“ tipo objektas"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1799
+msgid "Editable"
+msgstr "Keičiamas"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1800
+msgid "Whether content can be modified by the user"
+msgstr "Ar turinys gali būti keičiamas naudotojo"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1806
+msgid "Transparent"
+msgstr "Permatomas"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1807
+msgid "Whether content has a transparent background"
+msgstr "Ar turinio fonas permatomas"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1820
+msgid "Zoom level"
+msgstr "Mastelis"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1821
+msgid "The level of zoom of the content"
+msgstr "Turinio rodymo mastelio dydis"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1836
+msgid "Full content zoom"
+msgstr "Taikyti mastelį visam turiniui"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1837
+msgid "Whether the full content is scaled when zooming"
+msgstr "Ar mastelis keičiamas visam tinklalapio turiniui"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1850
+msgid "Encoding"
+msgstr "Koduotė"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1851
+msgid "The default encoding of the web view"
+msgstr "Numatytoji žiniatinklio rodinio koduotė"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1864
+msgid "Custom Encoding"
+msgstr "Pasirinktinė koduotė"
+
+#: WebKit/gtk/webkit/webkitwebview.cpp:1865
+msgid "The custom encoding of the web view"
+msgstr "Pasirinktinė žiniatinklio rodinio koduotė"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:51
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:56
+msgid "Submit"
+msgstr "Pateikti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:61
+msgid "Reset"
+msgstr "Atkurti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:66
+msgid "_Searchable Index"
+msgstr ""
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:71
+msgid "Choose File"
+msgstr "Parinkite failą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:76
+msgid "(None)"
+msgstr "(Joks)"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:81
+msgid "Open Link in New _Window"
+msgstr "Atverti saistomą objektą naujame _lange"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:86
+msgid "_Download Linked File"
+msgstr "At_siųsti saistomą objektą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:91
+msgid "Copy Link Loc_ation"
+msgstr "Kopijuoti saito _adresą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:96
+msgid "Open _Image in New Window"
+msgstr "Atverti _paveikslą naujame lange"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:101
+msgid "Sa_ve Image As"
+msgstr "Į_rašyti paveikslą kaip"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:106
+msgid "Cop_y Image"
+msgstr "_Kopijuoti paveikslą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:111
+msgid "Open _Frame in New Window"
+msgstr "_Atverti kadrą naujame lange"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:162
+msgid "_Reload"
+msgstr "At_siųsti iš naujo"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:179
+msgid "No Guesses Found"
+msgstr "Pasiūlymų nėra"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:184
+msgid "_Ignore Spelling"
+msgstr "_Nepaisyti rašybos"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:189
+msgid "_Learn Spelling"
+msgstr "Įsi_minti rašybą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:194
+msgid "_Search the Web"
+msgstr "_Ieškoti žiniatinklyje"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:199
+msgid "_Look Up in Dictionary"
+msgstr "Ieškoti _žodyne"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:204
+msgid "_Open Link"
+msgstr "_Atverti saistomą objektą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:209
+msgid "Ignore _Grammar"
+msgstr "Nepaisyti _gramatikos"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:214
+msgid "Spelling and _Grammar"
+msgstr "Rašyba ir _gramatika"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:219
+msgid "_Show Spelling and Grammar"
+msgstr "_Rodyti rašybą ir gramatiką"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:219
+msgid "_Hide Spelling and Grammar"
+msgstr "_Nerodyti rašybos ir gramatikos"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:224
+msgid "_Check Document Now"
+msgstr "Pa_tikrinti dokumentą dabar"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:229
+msgid "Check Spelling While _Typing"
+msgstr "Tikrinti _rašybą rašant tekstą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:234
+msgid "Check _Grammar With Spelling"
+msgstr "Tikrinti _gramatiką kartu su rašyba"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:239
+msgid "_Font"
+msgstr "Šri_ftas"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:262
+msgid "_Outline"
+msgstr "_Kontūras"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:267
+msgid "Inspect _Element"
+msgstr "Analizuoti _elementą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:272
+msgid "No recent searches"
+msgstr "Paskiausių paieškų nėra"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:277
+msgid "Recent searches"
+msgstr "Paskiausios paieškos"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:282
+msgid "_Clear recent searches"
+msgstr "_Valyti paskiausias paieškas"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:287
+msgid "term"
+msgstr "terminas"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:292
+msgid "definition"
+msgstr "apibrėžtis"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:297
+msgid "press"
+msgstr "spustelėti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:302
+msgid "select"
+msgstr "pasirinkti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:307
+msgid "activate"
+msgstr "aktyvinti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:312
+msgid "uncheck"
+msgstr "nuimti žymėjimą"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:317
+msgid "check"
+msgstr "pažymėti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:322
+msgid "jump"
+msgstr "šokti"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:328
+msgid " files"
+msgstr " failai"
+
+#: WebCore/platform/gtk/LocalizedStringsGtk.cpp:333
+msgid "Unknown"
+msgstr "Nežinoma"
+
diff --git a/WebKit/gtk/tests/testatk.c b/WebKit/gtk/tests/testatk.c
index 3910347..e47898b 100644
--- a/WebKit/gtk/tests/testatk.c
+++ b/WebKit/gtk/tests/testatk.c
@@ -50,36 +50,9 @@ static void test_get_text_function(AtkText* text_obj, AtkGetTextFunction fn, Atk
     g_free(text);
 }
 
-static void test_webkit_atk_get_text_at_offset(void)
+static void run_get_text_tests(AtkText* text_obj)
 {
-    WebKitWebView* webView;
-    AtkObject *obj;
-    GMainLoop* loop;
-    AtkText* text_obj;
-    char* text;
-
-    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
-    g_object_ref_sink(webView);
-    GtkAllocation alloc = { 0, 0, 800, 600 };
-    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
-    webkit_web_view_load_string(webView, contents, NULL, NULL, NULL);
-    loop = g_main_loop_new(NULL, TRUE);
-
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
-    g_main_loop_run(loop);
-
-    /* Get to the inner AtkText object */
-    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
-    g_assert(obj);
-    obj = atk_object_ref_accessible_child(obj, 0);
-    g_assert(obj);
-    obj = atk_object_ref_accessible_child(obj, 0);
-    g_assert(obj);
-
-    text_obj = ATK_TEXT(obj);
-    g_assert(ATK_IS_TEXT(text_obj));
-
-    text = atk_text_get_text(text_obj, 0, -1);
+    char* text = atk_text_get_text(text_obj, 0, -1);
     g_assert_cmpstr(text, ==, "This is a test. This is the second sentence. And this the third.");
     g_free(text);
 
@@ -218,6 +191,70 @@ static void test_webkit_atk_get_text_at_offset(void)
     /* ATK_TEXT_BOUNDARY_LINE_END */
     test_get_text_function(text_obj, atk_text_get_text_at_offset, ATK_TEXT_BOUNDARY_LINE_END,
                            0, "This is a test. This is the second sentence. And this the third.", 0, 64);
+}
+
+static void test_webkit_atk_get_text_at_offset_forms(void)
+{
+    WebKitWebView* webView;
+    AtkObject* obj;
+    GMainLoop* loop;
+    AtkText* text_obj;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, contents, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    /* Get to the inner AtkText object */
+    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+
+    text_obj = ATK_TEXT(obj);
+    g_assert(ATK_IS_TEXT(text_obj));
+
+    run_get_text_tests(text_obj);
+
+    g_object_unref(webView);
+}
+
+static void test_webkit_atk_get_text_at_offset(void)
+{
+    WebKitWebView* webView;
+    AtkObject* obj;
+    GMainLoop* loop;
+    AtkText* text_obj;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, contents, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    /* Get to the inner AtkText object */
+    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+    obj = atk_object_ref_accessible_child(obj, 0);
+    g_assert(obj);
+
+    text_obj = ATK_TEXT(obj);
+    g_assert(ATK_IS_TEXT(text_obj));
+
+    run_get_text_tests(text_obj);
 
     g_object_unref(webView);
 }
@@ -229,6 +266,7 @@ int main(int argc, char** argv)
 
     g_test_bug_base("https://bugs.webkit.org/");
     g_test_add_func("/webkit/atk/get_text_at_offset", test_webkit_atk_get_text_at_offset);
+    g_test_add_func("/webkit/atk/get_text_at_offset_forms", test_webkit_atk_get_text_at_offset_forms);
     return g_test_run ();
 }
 
diff --git a/WebKit/gtk/webkit/webkitapplicationcache.cpp b/WebKit/gtk/webkit/webkitapplicationcache.cpp
index 2c6b71f..e967d34 100644
--- a/WebKit/gtk/webkit/webkitapplicationcache.cpp
+++ b/WebKit/gtk/webkit/webkitapplicationcache.cpp
@@ -20,13 +20,17 @@
 #include "config.h"
 #include "webkitprivate.h"
 
+#include <wtf/UnusedParam.h>
+
 #include "ApplicationCacheStorage.h"
 
 void webkit_application_cache_set_maximum_size(unsigned long long size)
 {
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)   
     WebCore::cacheStorage().empty();
     WebCore::cacheStorage().vacuumDatabaseFile();
     WebCore::cacheStorage().setMaximumSize(size);
+#else
+    UNUSED_PARAM(size);
+#endif
 }
-
-
diff --git a/WebKit/gtk/webkit/webkitdownload.cpp b/WebKit/gtk/webkit/webkitdownload.cpp
index 568378c..dd6629b 100644
--- a/WebKit/gtk/webkit/webkitdownload.cpp
+++ b/WebKit/gtk/webkit/webkitdownload.cpp
@@ -31,6 +31,7 @@
 #include "webkitdownload.h"
 #include "webkitenumtypes.h"
 #include "webkitmarshal.h"
+#include "webkitnetworkresponse.h"
 #include "webkitprivate.h"
 
 #include <glib/gstdio.h>
@@ -74,7 +75,7 @@ struct _WebKitDownloadPrivate {
     GFileOutputStream* outputStream;
     DownloadClient* downloadClient;
     WebKitNetworkRequest* networkRequest;
-    ResourceResponse* networkResponse;
+    WebKitNetworkResponse* networkResponse;
     RefPtr<ResourceHandle> resourceHandle;
 };
 
@@ -95,7 +96,8 @@ enum {
     PROP_PROGRESS,
     PROP_STATUS,
     PROP_CURRENT_SIZE,
-    PROP_TOTAL_SIZE
+    PROP_TOTAL_SIZE,
+    PROP_NETWORK_RESPONSE
 };
 
 G_DEFINE_TYPE(WebKitDownload, webkit_download, G_TYPE_OBJECT);
@@ -119,6 +121,11 @@ static void webkit_download_dispose(GObject* object)
         priv->networkRequest = NULL;
     }
 
+    if (priv->networkResponse) {
+        g_object_unref(priv->networkResponse);
+        priv->networkResponse = NULL;
+    }
+
     G_OBJECT_CLASS(webkit_download_parent_class)->dispose(object);
 }
 
@@ -138,7 +145,6 @@ static void webkit_download_finalize(GObject* object)
     }
 
     delete priv->downloadClient;
-    delete priv->networkResponse;
 
     // The download object may never have _start called on it, so we
     // need to make sure timer is non-NULL.
@@ -159,6 +165,9 @@ static void webkit_download_get_property(GObject* object, guint prop_id, GValue*
     case PROP_NETWORK_REQUEST:
         g_value_set_object(value, webkit_download_get_network_request(download));
         break;
+    case PROP_NETWORK_RESPONSE:
+        g_value_set_object(value, webkit_download_get_network_response(download));
+        break;
     case PROP_DESTINATION_URI:
         g_value_set_string(value, webkit_download_get_destination_uri(download));
         break;
@@ -191,6 +200,9 @@ static void webkit_download_set_property(GObject* object, guint prop_id, const G
     case PROP_NETWORK_REQUEST:
         priv->networkRequest = WEBKIT_NETWORK_REQUEST(g_value_dup_object(value));
         break;
+    case PROP_NETWORK_RESPONSE:
+        priv->networkResponse = WEBKIT_NETWORK_RESPONSE(g_value_dup_object(value));
+        break;
     case PROP_DESTINATION_URI:
         webkit_download_set_destination_uri(download, g_value_get_string(value));
         break;
@@ -252,6 +264,21 @@ static void webkit_download_class_init(WebKitDownloadClass* downloadClass)
                                                         (GParamFlags)(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
 
     /**
+     * WebKitDownload:network-response
+     *
+     * The #WebKitNetworkResponse instance associated with the download.
+     *
+     * Since: 1.1.16
+     */
+    g_object_class_install_property(objectClass,
+                                    PROP_NETWORK_RESPONSE,
+                                    g_param_spec_object("network-response",
+                                                        _("Network Response"),
+                                                        _("The network response for the URI that should be downloaded"),
+                                                        WEBKIT_TYPE_NETWORK_RESPONSE,
+                                                        (GParamFlags)(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
+
+    /**
      * WebKitDownload:destination-uri
      *
      * The URI of the save location for this download.
@@ -530,11 +557,29 @@ WebKitNetworkRequest* webkit_download_get_network_request(WebKitDownload* downlo
     return priv->networkRequest;
 }
 
+/**
+ * webkit_download_get_network_response:
+ * @download: the #WebKitDownload
+ *
+ * Retrieves the #WebKitNetworkResponse object that backs the download
+ * process.
+ *
+ * Returns: the #WebKitNetworkResponse instance
+ *
+ * Since: 1.1.16
+ */
+WebKitNetworkResponse* webkit_download_get_network_response(WebKitDownload* download)
+{
+    g_return_val_if_fail(WEBKIT_IS_DOWNLOAD(download), NULL);
+
+    WebKitDownloadPrivate* priv = download->priv;
+    return priv->networkResponse;
+}
+
 static void webkit_download_set_response(WebKitDownload* download, const ResourceResponse& response)
 {
-    // FIXME Use WebKitNetworkResponse when it's merged.
     WebKitDownloadPrivate* priv = download->priv;
-    priv->networkResponse = new ResourceResponse(response);
+    priv->networkResponse = webkit_network_response_new_with_core_response(response);
 
     if (!response.isNull() && !response.suggestedFilename().isEmpty())
         webkit_download_set_suggested_filename(download, response.suggestedFilename().utf8().data());
@@ -704,10 +749,12 @@ guint64 webkit_download_get_total_size(WebKitDownload* download)
     g_return_val_if_fail(WEBKIT_IS_DOWNLOAD(download), 0);
 
     WebKitDownloadPrivate* priv = download->priv;
-    if (!priv->networkResponse)
+    SoupMessage* message = priv->networkResponse ? webkit_network_response_get_message(priv->networkResponse) : NULL;
+
+    if (!message)
         return 0;
 
-    return MAX(priv->currentSize, priv->networkResponse->expectedContentLength());
+    return MAX(priv->currentSize, soup_message_headers_get_content_length(message->response_headers));
 }
 
 /**
@@ -744,9 +791,9 @@ gdouble webkit_download_get_progress(WebKitDownload* download)
 
     WebKitDownloadPrivate* priv = download->priv;
     if (!priv->networkResponse)
-        return 0;
+        return 0.0;
 
-    gdouble total_size = (gdouble)priv->networkResponse->expectedContentLength();
+    gdouble total_size = static_cast<gdouble>(webkit_download_get_total_size(download));
 
     if (total_size == 0)
         return 1.0;
@@ -803,7 +850,7 @@ static void webkit_download_received_data(WebKitDownload* download, const gchar*
     g_object_notify(G_OBJECT(download), "current-size");
 
     ASSERT(priv->networkResponse);
-    if (priv->currentSize > priv->networkResponse->expectedContentLength())
+    if (priv->currentSize > webkit_download_get_total_size(download))
         g_object_notify(G_OBJECT(download), "total-size");
 
     gdouble lastProgress = webkit_download_get_progress(download);
diff --git a/WebKit/gtk/webkit/webkitdownload.h b/WebKit/gtk/webkit/webkitdownload.h
index 6e7f38b..a732a57 100644
--- a/WebKit/gtk/webkit/webkitdownload.h
+++ b/WebKit/gtk/webkit/webkitdownload.h
@@ -84,6 +84,9 @@ webkit_download_get_uri                     (WebKitDownload       *download);
 WEBKIT_API WebKitNetworkRequest*
 webkit_download_get_network_request         (WebKitDownload       *download);
 
+WEBKIT_API WebKitNetworkResponse*
+webkit_download_get_network_response         (WebKitDownload       *download);
+
 WEBKIT_API const gchar*
 webkit_download_get_suggested_filename      (WebKitDownload       *download);
 
diff --git a/WebKit/gtk/webkit/webkitprivate.h b/WebKit/gtk/webkit/webkitprivate.h
index 44dac04..088175f 100644
--- a/WebKit/gtk/webkit/webkitprivate.h
+++ b/WebKit/gtk/webkit/webkitprivate.h
@@ -224,6 +224,10 @@ extern "C" {
     void
     webkit_web_inspector_set_inspected_uri(WebKitWebInspector* web_inspector, const gchar* inspected_uri);
 
+    WEBKIT_API void
+    webkit_web_inspector_execute_script(WebKitWebInspector* inspector, long callId, const gchar* script);
+
+
     WebKitWebWindowFeatures*
     webkit_web_window_features_new_from_core_features (const WebCore::WindowFeatures& features);
 
@@ -285,6 +289,9 @@ extern "C" {
     WEBKIT_API gchar*
     webkit_web_frame_dump_render_tree (WebKitWebFrame* frame);
 
+    WEBKIT_API gchar*
+    webkit_web_frame_counter_value_for_element_by_id (WebKitWebFrame* frame, const gchar* id);
+
     WEBKIT_API guint
     webkit_web_frame_get_pending_unload_event_count(WebKitWebFrame* frame);
 
diff --git a/WebKit/gtk/webkit/webkitsecurityorigin.h b/WebKit/gtk/webkit/webkitsecurityorigin.h
index 57bcd19..24ebe06 100644
--- a/WebKit/gtk/webkit/webkitsecurityorigin.h
+++ b/WebKit/gtk/webkit/webkitsecurityorigin.h
@@ -20,7 +20,6 @@
 #ifndef webkitsecurityorigin_h
 #define webkitsecurityorigin_h
 
-#include "webkitsecurityorigin.h"
 #include "webkitwebdatabase.h"
 
 G_BEGIN_DECLS
diff --git a/WebKit/gtk/webkit/webkitwebframe.cpp b/WebKit/gtk/webkit/webkitwebframe.cpp
index 67fa632..843f923 100644
--- a/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -683,7 +683,7 @@ JSGlobalContextRef webkit_web_frame_get_global_context(WebKitWebFrame* frame)
     if (!coreFrame)
         return NULL;
 
-    return toGlobalRef(coreFrame->script()->globalObject()->globalExec());
+    return toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
 }
 
 /**
@@ -799,6 +799,28 @@ gchar* webkit_web_frame_dump_render_tree(WebKitWebFrame* frame)
 }
 
 /**
+ * webkit_web_frame_counter_value_for_element_by_id:
+ * @frame: a #WebKitWebFrame
+ * @id: an element ID string
+ *
+ * Return value: The counter value of element @id in @frame
+ */
+gchar* webkit_web_frame_counter_value_for_element_by_id(WebKitWebFrame* frame, const gchar* id)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), NULL);
+
+    Frame* coreFrame = core(frame);
+    if (!coreFrame)
+        return 0;
+
+    Element* coreElement = coreFrame->document()->getElementById(AtomicString(id));
+    if (!coreElement)
+        return 0;
+    String counterValue = counterValueForElement(coreElement);
+    return g_strdup(counterValue.utf8().data());
+}
+
+/**
  * webkit_web_frame_get_pending_unload_event_count:
  * @frame: a #WebKitWebFrame
  *
diff --git a/WebKit/gtk/webkit/webkitwebinspector.cpp b/WebKit/gtk/webkit/webkitwebinspector.cpp
index 4e4f8de..ee2815c 100644
--- a/WebKit/gtk/webkit/webkitwebinspector.cpp
+++ b/WebKit/gtk/webkit/webkitwebinspector.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2008 Gustavo Noronha Silva
  * Copyright (C) 2008, 2009 Holger Hans Peter Freyther
+ * Copyright (C) 2009 Collabora Ltd.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,11 +20,18 @@
  */
 
 #include "config.h"
+#include "webkitwebinspector.h"
 
+#include "FocusController.h"
+#include "Frame.h"
 #include <glib/gi18n-lib.h>
-#include "webkitwebinspector.h"
-#include "webkitmarshal.h"
+#include "HitTestRequest.h"
+#include "HitTestResult.h"
 #include "InspectorClientGtk.h"
+#include "IntPoint.h"
+#include "Page.h"
+#include "RenderView.h"
+#include "webkitmarshal.h"
 #include "webkitprivate.h"
 
 /**
@@ -56,6 +64,7 @@
  */
 
 using namespace WebKit;
+using namespace WebCore;
 
 enum {
     INSPECT_WEB_VIEW,
@@ -426,3 +435,66 @@ webkit_web_inspector_set_inspector_client(WebKitWebInspector* web_inspector, Web
 
     priv->page = page;
 }
+
+/**
+ * webkit_web_inspector_inspect_coordinates:
+ * @web_inspector: the #WebKitWebInspector that will do the inspection
+ * @x: the X coordinate of the node to be inspected
+ * @y: the Y coordinate of the node to be inspected
+ *
+ * Causes the Web Inspector to inspect the node that is located at the
+ * given coordinates of the widget. The coordinates should be relative
+ * to the #WebKitWebView widget, not to the scrollable content, and
+ * may be obtained from a #GdkEvent directly.
+ *
+ * This means @x, and @y being zero doesn't guarantee you will hit the
+ * left-most top corner of the content, since the contents may have
+ * been scrolled.
+ *
+ * Since: 1.1.17
+ */
+void webkit_web_inspector_inspect_coordinates(WebKitWebInspector* webInspector, gdouble x, gdouble y)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_INSPECTOR(webInspector));
+    g_return_if_fail(x >= 0 && y >= 0);
+
+    WebKitWebInspectorPrivate* priv = webInspector->priv;
+
+    Frame* frame = priv->page->focusController()->focusedOrMainFrame();
+    FrameView* view = frame->view();
+
+    if (!view)
+        return;
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    IntPoint documentPoint = view->windowToContents(IntPoint(static_cast<int>(x), static_cast<int>(y)));
+    HitTestResult result(documentPoint);
+
+    frame->contentRenderer()->layer()->hitTest(request, result);
+    priv->page->inspectorController()->inspect(result.innerNonSharedNode());
+}
+
+/**
+ * webkit_web_inspector_close:
+ * @web_inspector: the #WebKitWebInspector that will be closed
+ *
+ * Causes the Web Inspector to be closed.
+ *
+ * Since: 1.1.17
+ */
+void webkit_web_inspector_close(WebKitWebInspector* webInspector)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_INSPECTOR(webInspector));
+
+    WebKitWebInspectorPrivate* priv = webInspector->priv;
+    priv->page->inspectorController()->close();
+}
+
+void webkit_web_inspector_execute_script(WebKitWebInspector* webInspector, long callId, const gchar* script)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_INSPECTOR(webInspector));
+    g_return_if_fail(script);
+
+    WebKitWebInspectorPrivate* priv = webInspector->priv;
+    priv->page->inspectorController()->evaluateForTestInFrontend(callId, script);
+}
diff --git a/WebKit/gtk/webkit/webkitwebinspector.h b/WebKit/gtk/webkit/webkitwebinspector.h
index 9010e26..94fd806 100644
--- a/WebKit/gtk/webkit/webkitwebinspector.h
+++ b/WebKit/gtk/webkit/webkitwebinspector.h
@@ -60,6 +60,12 @@ webkit_web_inspector_get_web_view(WebKitWebInspector* web_inspector);
 WEBKIT_API const gchar*
 webkit_web_inspector_get_inspected_uri(WebKitWebInspector* web_inspector);
 
+WEBKIT_API void
+webkit_web_inspector_inspect_coordinates(WebKitWebInspector* web_inspector, gdouble x, gdouble y);
+
+WEBKIT_API void
+webkit_web_inspector_close(WebKitWebInspector* webInspector);
+
 G_END_DECLS
 
 #endif /* webkitwebinspector_h */
diff --git a/WebKit/gtk/webkit/webkitwebsettings.cpp b/WebKit/gtk/webkit/webkitwebsettings.cpp
index 588d5bd..89c5233 100644
--- a/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -96,6 +96,8 @@ struct _WebKitWebSettingsPrivate {
     gboolean enable_offline_web_application_cache;
     WebKitEditingBehavior editing_behavior;
     gboolean enable_universal_access_from_file_uris;
+    gboolean enable_web_sockets;
+    gboolean enable_dom_paste;
 };
 
 #define WEBKIT_WEB_SETTINGS_GET_PRIVATE(obj) (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_SETTINGS, WebKitWebSettingsPrivate))
@@ -135,7 +137,9 @@ enum {
     PROP_JAVASCRIPT_CAN_OPEN_WINDOWS_AUTOMATICALLY,
     PROP_ENABLE_OFFLINE_WEB_APPLICATION_CACHE,
     PROP_EDITING_BEHAVIOR,
-    PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS
+    PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS,
+    PROP_ENABLE_WEB_SOCKETS,
+    PROP_ENABLE_DOM_PASTE
 };
 
 // Create a default user agent string
@@ -647,6 +651,40 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          FALSE,
                                                          flags));
 
+    /**
+     * WebKitWebSettings:enable-web-sockets
+     *
+     * Whether to enable support for Web Sockets.
+     *
+     * Implementation of Web Sockets is currently considered experimental.
+     * Name of this property and the behavior could change in the future.
+     *
+     * Since: 1.1.16
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_WEB_SOCKETS,
+                                    g_param_spec_boolean("enable-web-sockets",
+                                                         _("Enable Web Sockets"),
+                                                         _("Whether to enable Web Sockets"),
+                                                         FALSE,
+                                                         flags));
+
+    /**
+     * WebKitWebSettings:enable-dom-paste
+     *
+     * Whether to enable DOM paste. If set to %TRUE, document.execCommand("Paste")
+     * will correctly execute and paste content of the clipboard.
+     *
+     * Since: 1.1.16
+     */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_DOM_PASTE,
+                                    g_param_spec_boolean("enable-dom-paste",
+                                                         _("Enable DOM paste"),
+                                                         _("Whether to enable DOM paste"),
+                                                         FALSE,
+                                                         flags));
+
     g_type_class_add_private(klass, sizeof(WebKitWebSettingsPrivate));
 }
 
@@ -694,6 +732,7 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
 {
     WebKitWebSettings* web_settings = WEBKIT_WEB_SETTINGS(object);
     WebKitWebSettingsPrivate* priv = web_settings->priv;
+    EnchantBroker* broker;
     SpellLanguage* lang;
     GSList* spellLanguages = NULL;
 
@@ -787,26 +826,32 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_SPELL_CHECKING_LANGUAGES:
         priv->spell_checking_languages = g_strdup(g_value_get_string(value));
 
+        broker = enchant_broker_init();
         if (priv->spell_checking_languages) {
             char** langs = g_strsplit(priv->spell_checking_languages, ",", -1);
             for (int i = 0; langs[i]; i++) {
-                lang = g_slice_new0(SpellLanguage);
-                lang->config = enchant_broker_init();
-                lang->speller = enchant_broker_request_dict(lang->config, langs[i]);
+                if (enchant_broker_dict_exists(broker, langs[i])) {
+                    lang = g_slice_new0(SpellLanguage);
+                    lang->config = enchant_broker_init();
+                    lang->speller = enchant_broker_request_dict(lang->config, langs[i]);
 
-                spellLanguages = g_slist_append(spellLanguages, lang);
+                    spellLanguages = g_slist_append(spellLanguages, lang);
+                }
             }
 
             g_strfreev(langs);
         } else {
             const char* language = pango_language_to_string(gtk_get_default_language());
 
-            lang = g_slice_new0(SpellLanguage);
-            lang->config = enchant_broker_init();
-            lang->speller = enchant_broker_request_dict(lang->config, language);
+            if (enchant_broker_dict_exists(broker, language)) {
+                lang = g_slice_new0(SpellLanguage);
+                lang->config = enchant_broker_init();
+                lang->speller = enchant_broker_request_dict(lang->config, language);
 
-            spellLanguages = g_slist_append(spellLanguages, lang);
+                spellLanguages = g_slist_append(spellLanguages, lang);
+            }
         }
+        enchant_broker_free(broker);
         g_slist_foreach(priv->spell_checking_languages_list, free_spell_checking_language, NULL);
         g_slist_free(priv->spell_checking_languages_list);
         priv->spell_checking_languages_list = spellLanguages;
@@ -833,6 +878,12 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS:
         priv->enable_universal_access_from_file_uris = g_value_get_boolean(value);
         break;
+    case PROP_ENABLE_WEB_SOCKETS:
+        priv->enable_web_sockets = g_value_get_boolean(value);
+        break;
+    case PROP_ENABLE_DOM_PASTE:
+        priv->enable_dom_paste = g_value_get_boolean(value);
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -944,6 +995,12 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
    case PROP_ENABLE_UNIVERSAL_ACCESS_FROM_FILE_URIS:
         g_value_set_boolean(value, priv->enable_universal_access_from_file_uris);
         break;
+    case PROP_ENABLE_WEB_SOCKETS:
+        g_value_set_boolean(value, priv->enable_web_sockets);
+        break;
+    case PROP_ENABLE_DOM_PASTE:
+        g_value_set_boolean(value, priv->enable_dom_paste);
+        break;
    default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
         break;
@@ -1008,6 +1065,8 @@ WebKitWebSettings* webkit_web_settings_copy(WebKitWebSettings* web_settings)
                  "enable-offline-web-application-cache", priv->enable_offline_web_application_cache,
                  "editing-behavior", priv->editing_behavior,
                  "enable-universal-access-from-file-uris", priv->enable_universal_access_from_file_uris,
+                 "enable-web-sockets", priv->enable_web_sockets,
+                 "enable-dom-paste", priv->enable_dom_paste,
                  NULL));
 
     return copy;
diff --git a/WebKit/gtk/webkit/webkitwebview.cpp b/WebKit/gtk/webkit/webkitwebview.cpp
index 47d7d98..9f668f4 100644
--- a/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/WebKit/gtk/webkit/webkitwebview.cpp
@@ -2392,7 +2392,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
         enableScripts, enablePlugins, enableDeveloperExtras, resizableTextAreas,
         enablePrivateBrowsing, enableCaretBrowsing, enableHTML5Database, enableHTML5LocalStorage,
         enableXSSAuditor, javascriptCanOpenWindows, enableOfflineWebAppCache,
-        enableUniversalAccessFromFileURI;
+        enableUniversalAccessFromFileURI, enableDOMPaste;
 
     WebKitEditingBehavior editingBehavior;
 
@@ -2421,6 +2421,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
                  "enable-offline-web-application-cache", &enableOfflineWebAppCache,
                  "editing-behavior", &editingBehavior,
                  "enable-universal-access-from-file-uris", &enableUniversalAccessFromFileURI,
+                 "enable-dom-paste", &enableDOMPaste,
                  NULL);
 
     settings->setDefaultTextEncodingName(defaultEncoding);
@@ -2447,6 +2448,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     settings->setOfflineWebApplicationCacheEnabled(enableOfflineWebAppCache);
     settings->setEditingBehavior(core(editingBehavior));
     settings->setAllowUniversalAccessFromFileURLs(enableUniversalAccessFromFileURI);
+    settings->setDOMPasteAllowed(enableDOMPaste);
 
     g_free(defaultEncoding);
     g_free(cursiveFontFamily);
@@ -2533,6 +2535,8 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setEditingBehavior(core(static_cast<WebKitEditingBehavior>(g_value_get_enum(&value))));
     else if (name == g_intern_string("enable-universal-access-from-file-uris"))
         settings->setAllowUniversalAccessFromFileURLs(g_value_get_boolean(&value));
+    else if (name == g_intern_string("enable-dom-paste"))
+        settings->setDOMPasteAllowed(g_value_get_boolean(&value));
     else if (!g_object_class_find_property(G_OBJECT_GET_CLASS(webSettings), name))
         g_warning("Unexpected setting '%s'", name);
     g_value_unset(&value);
@@ -3152,8 +3156,7 @@ void webkit_web_view_execute_script(WebKitWebView* webView, const gchar* script)
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
     g_return_if_fail(script);
 
-    if (FrameLoader* loader = core(webView)->mainFrame()->loader())
-        loader->executeScript(String::fromUTF8(script), true);
+    core(webView)->mainFrame()->script()->executeScript(String::fromUTF8(script), true);
 }
 
 /**
@@ -3894,8 +3897,12 @@ WebKitWebResource* webkit_web_view_get_resource(WebKitWebView* webView, char* id
 
     gboolean resourceFound = g_hash_table_lookup_extended(priv->subResources, identifier, NULL, &webResource);
 
-    // The only resource we do not store in this hash table is the main!
-    g_return_val_if_fail(resourceFound || g_str_equal(identifier, priv->mainResourceIdentifier), NULL);
+    // The only resource we do not store in this hash table is the
+    // main!  If we did not find a request, it probably means the load
+    // has been interrupted while while a resource was still being
+    // loaded.
+    if (!resourceFound && !g_str_equal(identifier, priv->mainResourceIdentifier))
+        return NULL;
 
     if (!webResource)
         return webkit_web_view_get_main_resource(webView);
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index 63c888a..9104b89 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,553 @@
+2009-10-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7303145> 
+        Can't exit full screen mode or restart movie after pressing command -R.
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController _requestExit]): 
+            New, call media element's exitFullscreen method.
+        (-[WebVideoFullscreenController requestExitFullscreenWithAnimation:]): 
+            Call mediaElement->exitFullscreen() after a delay as it turns around and calls
+            WebVideoFullscreenController:exitFullscreen.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h:
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindow resignFirstResponder]):
+            New, don't give up responder status.
+        (-[WebVideoFullscreenHUDWindow performKeyEquivalent:]):
+            New, block all command key events.
+        (-[WebVideoFullscreenHUDWindowController exitFullscreen:]):
+            Remember when we are in the process of exiting fullscreen, don't allow recursion.
+
+        * WebView/WebView.mm:
+        (-[WebView _exitFullscreen]):
+            Early return if fullscreen controller is nil.
+
+        * WebView/WebWindowAnimation.h: 
+            Correct comment about _window retain status.
+        * WebView/WebWindowAnimation.m:
+        (-[WebWindowScaleAnimation dealloc]):
+            Don't release _window, we never reatained it.
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Add counterValueForElement in WebFrame to call WebCore::counterValueForElement.
+
+        * Misc/WebCoreStatistics.h:
+        * Misc/WebCoreStatistics.mm:
+        (-[WebFrame counterValueForElement:]):
+
+2009-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for refactoring in the date code.
+
+        * WebView/WebView.mm:
+        (aeDescFromJSValue): Since we just want a number of milliseconds, do that
+        instead of something more complicated.
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move some WebView event handling code into its own file, WebViewEventHandling.mm
+
+        * WebView/WebView.mm:
+        (-[WebView _close]):
+        (-[WebView _selectedOrMainFrame]):
+        * WebView/WebViewEventHandling.mm: Added.
+        (-[WebView _closingEventHandling]):
+        (-[WebView _setMouseDownEvent:]):
+        (-[WebView mouseDown:]):
+        (-[WebView mouseUp:]):
+        (+[WebView _updateMouseoverWithEvent:]):
+        (-[WebView _updateMouseoverWithFakeEvent]):
+        (_updateMouseoverWithEvent:fakeEvent::if):
+        (-[WebView _stopAutoscrollTimer]):
+        (-[WebView _setToolTip:]):
+        * WebView/WebViewInternal.h:
+
+2009-10-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6988966> Hardware layers do not show up in page snapshots
+
+        * WebView/WebHTMLViewPrivate.h:
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _compositingLayersHostingView]):
+        Add a private method that returns the NSView used to host compositing layers.
+        
+2009-10-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix engineering builds in the mysterious future.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * WebView/WebFramePrivate.h:
+        * WebView/WebFrame.mm:
+        (-[WebFrame contextForWorldID:]):
+
+2009-10-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/7322847>
+        Pressing space bar key in full screen mode should pause movie but doesn't
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController keyDown:]):  New, toggle playback on space key.
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Play button action is now called togglePlaying.
+        (-[WebVideoFullscreenHUDWindowController togglePlaying:]): Rename from playingChanged.
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Build fix following bug #30696.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::getWindowNPObject):
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+        (WebKit::NetscapePluginInstanceProxy::construct):
+        (WebKit::NetscapePluginInstanceProxy::getProperty):
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+        (WebKit::NetscapePluginInstanceProxy::removeProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasMethod):
+        (WebKit::NetscapePluginInstanceProxy::enumerate):
+
+2009-10-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Update to incorporate support for IsolatedWorlds in JSC bindings.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _attachScriptDebugger]):
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        (-[WebFrame globalContext]):
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame evaluateWebScript:]):
+        * WebView/WebView.mm:
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+
+2009-10-22  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein & Simon Fraser.
+
+        <rdar://problem/7297717>
+        https://bugs.webkit.org/show_bug.cgi?id=30323
+        Play/pause button in full-screen video controller does not reflect current state
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController setMediaElement:WebCore::]): Register for QTMovieRateDidChangeNotification
+        (-[WebVideoFullscreenController rateChanged:]): Call HUD controller when rate changes.
+
+        * WebView/WebVideoFullscreenHUDWindowController.h:
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController scheduleTimeUpdate]): Call updateRate so play button
+        reflects playback state.
+        (-[WebVideoFullscreenHUDWindowController updateRate]): New, set play button state according to
+        movie state.
+        (-[WebVideoFullscreenHUDWindowController playingChanged:]): Only call [self playing] once.
+
+2009-10-21  John Sullivan  <sullivan@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        * WebView/WebDynamicScrollBarsView.h:
+        Corrected a couple of long-obsolete comments regarding Safari's use of this class.
+
+2009-10-20  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        <rdar://problem/7319749> REGRESSION(r49806): Contextual Menu items missing
+        https://bugs.webkit.org/show_bug.cgi?id=30568
+
+        Revert accidental change from r49806.
+
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::getCustomMenuFromDefaultItems):
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Removed WebSocket runtime settings.
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        WebSocket runtime configuration is supported by chromium/v8 only.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Update call to loadFrameRequest to match new parameters.
+
+        * WebView/WebPDFView.mm:
+        (-[WebPDFView PDFViewWillClickOnLink:withURL:]): Update call to loadFrameRequest.
+
+2009-10-19  David Kilzer  <ddkilzer@apple.com>
+
+        Documentation fix for -[NSObject(WebResourceLoadDelegate) webView:resource:willSendRequest:redirectResponse:fromDataSource:]
+
+        Reviewed by Dan Bernstein.
+
+        * WebView/WebResourceLoadDelegate.h: Prepended "webView:" to the
+        @method declaration of
+        -webView:resource:willSendRequest:redirectResponse:fromDataSource:
+        which was absent before r3953 and was missed during the great
+        documentation clean up of r4269.
+
+2009-10-19  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView saveAndSetNewPortStateForUpdate:]):
+
+2009-10-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Split assertions of conjunctions into separate statements or remove
+        redundant assertions.
+
+        * Plugins/Hosted/NetscapePluginHostProxy.mm:
+        (WebKit::NetscapePluginHostProxy::deadNameNotificationCallback):
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView setAttributeKeys:andValues:]):
+        (-[WebHostedNetscapePluginView _webPluginContainerCancelCheckIfAllowedToLoadRequest:]):
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView halt]):
+        (-[WebBaseNetscapePluginView resumeFromHalt]):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView saveAndSetNewPortStateForUpdate:]):
+        (-[WebNetscapePluginView _webPluginContainerCancelCheckIfAllowedToLoadRequest:]):
+        * WebCoreSupport/WebContextMenuClient.mm:
+        (WebContextMenuClient::getCustomMenuFromDefaultItems):
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::checkGrammarOfString):
+        (WebEditorClient::checkTextOfParagraph):
+        * WebView/WebTextCompletionController.mm:
+        (-[WebTextCompletionController _reflectSelection]):
+
+2009-10-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7309062> Crashes in WebCore::DocumentLoader::isStopping below WebKit::NetscapePluginInstanceProxy::loadRequest.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::loadRequest): Null-check the DocumentLoader before deferencing it.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        <rdar://problem/7304575>
+        
+        * Plugins/WebBaseNetscapePluginView.h: Added new boolean ivar and -hasBeenHalted instance method.
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView halt]):Update _hasBeenHalted.
+        (-[WebBaseNetscapePluginView hasBeenHalted]): Added.
+        * WebView/WebView.mm:
+        (+[WebView _hasPluginForNodeBeenHalted:]): Checks to see if a plug-in node's been halted.
+        * WebView/WebViewPrivate.h: Added -_hasPluginForNodeBeenHalted method.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlson.
+
+        Small code cleanup
+        
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::halt): Just call -[WebBaseNetscapePluginView halt].
+        (WebHaltablePlugin::restart): Just call -[WebBaseNetscapePluginView resumeFromHalt]
+        (-[WebBaseNetscapePluginView halt]): 
+        (-[WebBaseNetscapePluginView resumeFromHalt]):
+        * WebView/WebView.mm:
+        (_pluginViewForNode): Added a check if a render is a widget. This prevents a later assertion.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlson.
+
+        Last part of:
+        <rdar://problem/7273354>
+
+        * WebView/WebView.mm: 
+        (_pluginViewForNode): Added with code extracted from _isNodeHaltedPlugin
+        (+[WebView _isNodeHaltedPlugin:]): Made this a class method.
+        (+[WebView _restartHaltedPluginForNode:]): Added. Restarts a plug-in
+        * WebView/WebViewPrivate.h: Added +_restartHaltedPluginForNode to header.
+
+2009-10-16  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders.
+
+        <rdar://problem/7273354> 
+
+        * Plugins/WebBaseNetscapePluginView.h: Added _isHalted ivar and three new methods: -halt, -resumeFromHalt, and -isHalted
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::halt): Call -halt instead of -stop.  
+        (WebHaltablePlugin::restart):Call -resumeFromHalt instead of -start. 
+        (-[WebBaseNetscapePluginView halt]): Added. Stop the plug-in, update _isHalted.
+        (-[WebBaseNetscapePluginView resumeFromHalt]): Added. Start the plug-in, update _isHalted.
+        (-[WebBaseNetscapePluginView isHalted]): Added.
+        * WebView/WebView.mm:
+        (-[WebView _isNodeHaltedPlugin:]): Added. Queries a DOMNode to determine if it's a halted plug-in.
+        * WebView/WebViewPrivate.h: Added _isNodeHaltedPlugin.
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7306052> Fullscreen max/min volume buttons non-functional
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController windowDidLoad]): Set volume buttons target and action.
+        (-[WebVideoFullscreenHUDWindowController decrementVolume:]): New, decrement the volume by 10%.
+        (-[WebVideoFullscreenHUDWindowController incrementVolume:]): New, increment the volume by 10%.
+
+2009-10-15  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/7295738> No way to mute/unmute a movie in full screen video mode
+
+        * WebView/WebVideoFullscreenHUDWindowController.mm:
+        (-[WebVideoFullscreenHUDWindowController setVolume:]): Unmute movie before changing volume.
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Unbreak the world.
+        
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (WebHaltablePlugin::restart):
+
+2009-10-14  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlsson and Jon Honeycutt
+
+        <rdar://problem/7304295> snapshots of halted plug-ins are missing
+        
+        * Plugins/WebBaseNetscapePluginView.mm: Move bodies of WebHaltablePlugin virtual functions from WebHaltablePlugin class definition.
+        (WebHaltablePlugin::halt): Provide a substitute image to the RenderWidget for the plug-in view.
+        (WebHaltablePlugin::restart): Clear the substitute image.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Change the order of arguments on some methods.  Split removal for user stylesheets and script into
+        separate functions based off the type of object being removed.
+
+        * WebView/WebView.mm:
+        (+[WebView _addUserScriptToGroup:worldID:source:url:whitelist:blacklist:injectionTime:]):
+        (+[WebView _addUserStyleSheetToGroup:worldID:source:url:whitelist:blacklist:]):
+        (+[WebView _removeUserScriptFromGroup:worldID:url:]):
+        (+[WebView _removeUserStyleSheetFromGroup:worldID:url:]):
+        (+[WebView _removeUserScriptsFromGroup:worldID:]):
+        (+[WebView _removeUserStyleSheetsFromGroup:worldID:]):
+        * WebView/WebViewPrivate.h:
+
+2009-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6660507> Add "privacy mode" to Netscape Plug-in API
+
+        Listen for WebPreferences notifications and update the _isPrivateBrowsingEnabled ivar 
+        when the value changes. Also call -[WebBaseNetscapePluginView privateBrowsingModeDidChange] when the
+        value changes. In process this just calls NPP_SetValue, and OOP it sends a MIG message to the plug-in host.
+        
+        * Plugins/Hosted/NetscapePluginHostManager.h:
+        * Plugins/Hosted/NetscapePluginHostManager.mm:
+        (WebKit::NetscapePluginHostManager::instantiatePlugin):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.h:
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::privateBrowsingModeDidChange):
+        * Plugins/Hosted/WebHostedNetscapePluginView.mm:
+        (-[WebHostedNetscapePluginView createPlugin]):
+        (-[WebHostedNetscapePluginView privateBrowsingModeDidChange]):
+        * Plugins/Hosted/WebKitPluginHost.defs:
+        * Plugins/WebBaseNetscapePluginView.h:
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebBaseNetscapePluginView viewDidMoveToWindow]):
+        (-[WebBaseNetscapePluginView preferencesHaveChanged:]):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebNetscapePluginView getVariable:value:]):
+
+2009-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Video keeps playing after going fullscreen, then closing window
+        https://bugs.webkit.org/show_bug.cgi?id=30164
+        
+        Clear the QTMovie on the QTMovieView when coming out of fullscreen,
+        to fix issue where the underlying movie keeps playing.
+
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController windowDidExitFullscreen]):
+
+2009-10-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7294267> REGRESSION (r48492): Gmail voice and video chat
+        doesn’t work
+        https://bugs.webkit.org/show_bug.cgi?id=30295
+
+        Test: plugins/setProperty.html
+
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyInstance::setFieldValue): Fixed a typo. The function
+        should return early if m_instanceProxy is null.
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        Update API call.
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::restoreViewState):
+        * WebView/WebView.mm:
+        (-[WebView _loadBackForwardListFromOtherView:]):
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7290671> Crash after navigating away from a page with subframe containing plug-in
+
+        At the time that -stop is called on a WebBaseNetscapePluginView that is contained within a subframe
+        the WebFrame's data source has been zeroed out.  This was causing -[WebBaseNetscapePluginView webFrame]
+        to return nil during -stop, preventing the plug-in view from unregistering itself from the PluginHalter.
+        We fix this by having -webFrame retrieve the frame directly rather than retrieving it from the data source.
+
+        * Plugins/WebBaseNetscapePluginView.mm:
+        (-[WebBaseNetscapePluginView dataSource]): Get the data source from the WebFrame.
+        (-[WebBaseNetscapePluginView webFrame]): Get the Frame directly from the element's document rather
+        than taking a windy route through the WebDataSource.
+
+2009-10-09  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add SPI to specifically enable visited link tracking.
+
+        * History/WebHistory.mm:
+        (+[WebHistory _setVisitedLinkTrackingEnabled:]):
+        * History/WebHistoryPrivate.h:
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        Reviewed by Dan Bernstein.
+
+        * WebCoreSupport/WebPluginHalterClient.h:
+        Add declaration for new function.
+
+        * WebCoreSupport/WebPluginHalterClient.mm:
+        (WebPluginHalterClient::enabled):
+        Check whether the UIDelegate responds to shouldHaltPlugin.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        Remove the "enabled" preference key.
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        Remove the initialization of the pref.
+
+        * WebView/WebPreferencesPrivate.h:
+        Remove the getter/setter for this pref.
+
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+        Remove propagation of the pref. 
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        * WebView/WebView.mm:
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+
+2009-10-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Ask the History Delegate to populate the visited links hash.
+        <rdar://problem/7285293> and https://webkit.org/b/29904
+
+        * History/WebHistory.mm:
+        (+[WebHistory _removeAllVisitedLinks]):
+        * History/WebHistoryPrivate.h:
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::populateVisitedLinks):
+        * WebView/WebDelegateImplementationCaching.h:
+        * WebView/WebDelegateImplementationCaching.mm:
+        (CallHistoryDelegate):
+        * WebView/WebHistoryDelegate.h:
+        * WebView/WebView.mm:
+        (-[WebView _cacheHistoryDelegateImplementations]):
+        (-[WebView addVisitedLinks:]):
+        * WebView/WebViewPrivate.h:
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL implementation.
+
+        * WebCoreSupport/WebFrameLoaderClient.h:
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        * WebView/WebPolicyDelegatePrivate.h:
+
 2009-10-07  Simon Fraser  <simon.fraser@apple.com>
 
         Re-land 49269-49271 since reverting them did not fix the tests.
diff --git a/WebKit/mac/Configurations/DebugRelease.xcconfig b/WebKit/mac/Configurations/DebugRelease.xcconfig
index 50071e7..11a94ca 100644
--- a/WebKit/mac/Configurations/DebugRelease.xcconfig
+++ b/WebKit/mac/Configurations/DebugRelease.xcconfig
@@ -28,6 +28,7 @@ ARCHS_ = $(ARCHS_1040);
 ARCHS_1040 = $(NATIVE_ARCH);
 ARCHS_1050 = $(NATIVE_ARCH);
 ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -36,6 +37,7 @@ MACOSX_DEPLOYMENT_TARGET_ = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
 
 GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = YES;
 
@@ -46,3 +48,4 @@ WEBKIT_SYSTEM_INTERFACE_LIBRARY_ = WebKitSystemInterfaceTiger;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1040 = WebKitSystemInterfaceTiger;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1050 = WebKitSystemInterfaceLeopard;
 WEBKIT_SYSTEM_INTERFACE_LIBRARY_1060 = WebKitSystemInterfaceSnowLeopard;
+WEBKIT_SYSTEM_INTERFACE_LIBRARY_1070 = WebKitSystemInterfaceSnowLeopard;
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index ed387aa..42aa3cf 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -31,10 +31,12 @@
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
 ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1070 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
 ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
+ENABLE_3D_RENDERING_1070 = ENABLE_3D_RENDERING;
 
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
diff --git a/WebKit/mac/Configurations/Version.xcconfig b/WebKit/mac/Configurations/Version.xcconfig
index 66d574b..fabc009 100644
--- a/WebKit/mac/Configurations/Version.xcconfig
+++ b/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 2;
+MINOR_VERSION = 4;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
@@ -36,6 +36,7 @@ SYSTEM_VERSION_PREFIX_ = 4; // Some Tiger versions of Xcode don't set MAC_OS_X_V
 SYSTEM_VERSION_PREFIX_1040 = 4;
 SYSTEM_VERSION_PREFIX_1050 = 5;
 SYSTEM_VERSION_PREFIX_1060 = 6;
+SYSTEM_VERSION_PREFIX_1070 = 7;
 
 // The production build always uses the full version with a system version prefix.
 BUNDLE_VERSION_Production = $(SYSTEM_VERSION_PREFIX)$(FULL_VERSION);
diff --git a/WebKit/mac/History/WebHistory.mm b/WebKit/mac/History/WebHistory.mm
index 6304fd2..af40a24 100644
--- a/WebKit/mac/History/WebHistory.mm
+++ b/WebKit/mac/History/WebHistory.mm
@@ -801,6 +801,16 @@ static inline WebHistoryDateKey dateKey(NSTimeInterval date)
     return [_historyPrivate data];
 }
 
++ (void)_setVisitedLinkTrackingEnabled:(BOOL)visitedLinkTrackingEnabled
+{
+    PageGroup::setShouldTrackVisitedLinks(visitedLinkTrackingEnabled);
+}
+
++ (void)_removeAllVisitedLinks
+{
+    PageGroup::removeAllVisitedLinks();
+}
+
 @end
 
 @implementation WebHistory (WebInternal)
diff --git a/WebKit/mac/History/WebHistoryPrivate.h b/WebKit/mac/History/WebHistoryPrivate.h
index 4ab0924..b93472f 100644
--- a/WebKit/mac/History/WebHistoryPrivate.h
+++ b/WebKit/mac/History/WebHistoryPrivate.h
@@ -53,5 +53,6 @@ extern NSString *WebHistoryItemsDiscardedWhileLoadingNotification;
 */
 - (NSData *)_data;
 
-
++ (void)_setVisitedLinkTrackingEnabled:(BOOL)visitedLinkTrackingEnabled;
++ (void)_removeAllVisitedLinks;
 @end
diff --git a/WebKit/mac/Misc/WebCoreStatistics.h b/WebKit/mac/Misc/WebCoreStatistics.h
index d4370bf..7a189ae 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.h
+++ b/WebKit/mac/Misc/WebCoreStatistics.h
@@ -30,6 +30,8 @@
 
 #import <WebKit/WebFrame.h>
 
+@class DOMElement;
+
 @interface WebCoreStatistics : NSObject
 {
 }
@@ -81,4 +83,5 @@
 
 @interface WebFrame (WebKitDebug)
 - (NSString *)renderTreeAsExternalRepresentation;
+- (NSString *)counterValueForElement:(DOMElement*)element;
 @end
diff --git a/WebKit/mac/Misc/WebCoreStatistics.mm b/WebKit/mac/Misc/WebCoreStatistics.mm
index 57b59a4..6bac46e 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.mm
+++ b/WebKit/mac/Misc/WebCoreStatistics.mm
@@ -28,6 +28,7 @@
 
 #import "WebCoreStatistics.h"
 
+#import "DOMElementInternal.h"
 #import "WebCache.h"
 #import "WebFrameInternal.h"
 #import <runtime/JSLock.h>
@@ -244,4 +245,9 @@ using namespace WebCore;
     return externalRepresentation(_private->coreFrame->contentRenderer());
 }
 
+- (NSString *)counterValueForElement:(DOMElement*)element
+{
+    return counterValueForElement(core(element));
+}
+
 @end
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
index a1d9bad..9e29062 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.h
@@ -43,7 +43,7 @@ class NetscapePluginHostManager {
 public:
     static NetscapePluginHostManager& shared();
     
-    PassRefPtr<NetscapePluginInstanceProxy> instantiatePlugin(WebNetscapePluginPackage *, WebHostedNetscapePluginView *, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame);
+    PassRefPtr<NetscapePluginInstanceProxy> instantiatePlugin(WebNetscapePluginPackage *, WebHostedNetscapePluginView *, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame, bool isPrivateBrowsingEnabled);
 
     void pluginHostDied(NetscapePluginHostProxy*);
 
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
index 4aa290a..6b36a6d 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm
@@ -211,7 +211,7 @@ void NetscapePluginHostManager::pluginHostDied(NetscapePluginHostProxy* pluginHo
     }
 }
 
-PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePlugin(WebNetscapePluginPackage *pluginPackage, WebHostedNetscapePluginView *pluginView, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame)
+PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePlugin(WebNetscapePluginPackage *pluginPackage, WebHostedNetscapePluginView *pluginView, NSString *mimeType, NSArray *attributeKeys, NSArray *attributeValues, NSString *userAgent, NSURL *sourceURL, bool fullFrame, bool isPrivateBrowsingEnabled)
 {
     NetscapePluginHostProxy* hostProxy = hostForPackage(pluginPackage);
     if (!hostProxy)
@@ -235,6 +235,7 @@ PassRefPtr<NetscapePluginInstanceProxy> NetscapePluginHostManager::instantiatePl
         [properties.get() setObject:[sourceURL absoluteString] forKey:@"sourceURL"];
     
     [properties.get() setObject:[NSNumber numberWithBool:fullFrame] forKey:@"fullFrame"];
+    [properties.get() setObject:[NSNumber numberWithBool:isPrivateBrowsingEnabled] forKey:@"privateBrowsingEnabled"];
     
     NSData *data = [NSPropertyListSerialization dataFromPropertyList:properties.get() format:NSPropertyListBinaryFormat_v1_0 errorDescription:nil];
     ASSERT(data);
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
index e8874cd..970f5f5 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginHostProxy.mm
@@ -187,7 +187,8 @@ NetscapePluginInstanceProxy* NetscapePluginHostProxy::pluginInstance(uint32_t pl
 
 void NetscapePluginHostProxy::deadNameNotificationCallback(CFMachPortRef port, void *msg, CFIndex size, void *info)
 {
-    ASSERT(msg && static_cast<mach_msg_header_t*>(msg)->msgh_id == MACH_NOTIFY_DEAD_NAME);
+    ASSERT(msg);
+    ASSERT(static_cast<mach_msg_header_t*>(msg)->msgh_id == MACH_NOTIFY_DEAD_NAME);
     
     static_cast<NetscapePluginHostProxy*>(info)->pluginHostDied();
 }
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
index 280f161..c950ab7 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
@@ -163,6 +163,7 @@ public:
     void resolveURL(const char* url, const char* target, data_t& resolvedURLData, mach_msg_type_number_t& resolvedURLLength);
     
     void didDraw();
+    void privateBrowsingModeDidChange(bool isPrivateBrowsingEnabled);
     
     // Reply structs
     struct Reply {
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index 21f35e2..4ae0220 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -575,9 +575,10 @@ NPError NetscapePluginInstanceProxy::loadRequest(NSURLRequest *request, const ch
         return NPERR_INVALID_URL;
 
     // Don't allow requests to be loaded when the document loader is stopping all loaders.
-    if ([[m_pluginView dataSource] _documentLoader]->isStopping())
+    DocumentLoader* documentLoader = [[m_pluginView dataSource] _documentLoader];
+    if (!documentLoader || documentLoader->isStopping())
         return NPERR_GENERIC_ERROR;
-    
+
     NSString *target = nil;
     if (cTarget) {
         // Find the frame given the target string.
@@ -587,7 +588,7 @@ NPError NetscapePluginInstanceProxy::loadRequest(NSURLRequest *request, const ch
 
     // don't let a plugin start any loads if it is no longer part of a document that is being 
     // displayed unless the loads are in the same frame as the plugin.
-    if ([[m_pluginView dataSource] _documentLoader] != core([m_pluginView webFrame])->loader()->activeDocumentLoader() &&
+    if (documentLoader != core([m_pluginView webFrame])->loader()->activeDocumentLoader() &&
         (!cTarget || [frame findFrameNamed:target] != frame)) {
         return NPERR_GENERIC_ERROR; 
     }
@@ -665,7 +666,7 @@ bool NetscapePluginInstanceProxy::getWindowNPObject(uint32_t& objectID)
     if (!frame->script()->isEnabled())
         objectID = 0;
     else
-        objectID = idForObject(frame->script()->windowShell()->window());
+        objectID = idForObject(frame->script()->windowShell(pluginWorld())->window());
         
     return true;
 }
@@ -703,7 +704,7 @@ bool NetscapePluginInstanceProxy::evaluate(uint32_t objectID, const String& scri
 
     JSLock lock(SilenceAssertionsOnly);
     
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     ExecState* exec = globalObject->globalExec();
 
     bool oldAllowPopups = frame->script()->allowPopupsFromPlugin();
@@ -744,7 +745,7 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
     JSValue function = object->get(exec, methodName);
     CallData callData;
@@ -755,7 +756,7 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
     MarkedArgumentBuffer argList;
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     globalObject->globalData()->timeoutChecker.start();
     JSValue value = call(exec, function, callType, callData, object, argList);
     globalObject->globalData()->timeoutChecker.stop();
@@ -778,7 +779,7 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     CallData callData;
     CallType callType = object->getCallData(callData);
@@ -788,7 +789,7 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
     MarkedArgumentBuffer argList;
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     globalObject->globalData()->timeoutChecker.start();
     JSValue value = call(exec, object, callType, callData, object, argList);
     globalObject->globalData()->timeoutChecker.stop();
@@ -811,7 +812,7 @@ bool NetscapePluginInstanceProxy::construct(uint32_t objectID, data_t argumentsD
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
 
     ConstructData constructData;
@@ -822,7 +823,7 @@ bool NetscapePluginInstanceProxy::construct(uint32_t objectID, data_t argumentsD
     MarkedArgumentBuffer argList;
     demarshalValues(exec, argumentsData, argumentsLength, argList);
 
-    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject();
+    ProtectedPtr<JSGlobalObject> globalObject = frame->script()->globalObject(pluginWorld());
     globalObject->globalData()->timeoutChecker.start();
     JSValue value = JSC::construct(exec, object, constructType, constructData, argList);
     globalObject->globalData()->timeoutChecker.stop();
@@ -845,7 +846,7 @@ bool NetscapePluginInstanceProxy::getProperty(uint32_t objectID, const Identifie
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     JSValue value = object->get(exec, propertyName);
     
@@ -864,7 +865,7 @@ bool NetscapePluginInstanceProxy::getProperty(uint32_t objectID, unsigned proper
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     JSValue value = object->get(exec, propertyName);
     
@@ -886,7 +887,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, const Identifie
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
 
     JSValue value = demarshalValue(exec, valueData, valueLength);
@@ -910,7 +911,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, unsigned proper
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);    
     
     JSValue value = demarshalValue(exec, valueData, valueLength);
@@ -933,7 +934,7 @@ bool NetscapePluginInstanceProxy::removeProperty(uint32_t objectID, const Identi
     if (!frame)
         return false;
 
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     if (!object->hasProperty(exec, propertyName)) {
         exec->clearException();
         return false;
@@ -958,7 +959,7 @@ bool NetscapePluginInstanceProxy::removeProperty(uint32_t objectID, unsigned pro
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     if (!object->hasProperty(exec, propertyName)) {
         exec->clearException();
         return false;
@@ -983,7 +984,7 @@ bool NetscapePluginInstanceProxy::hasProperty(uint32_t objectID, const Identifie
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     bool result = object->hasProperty(exec, propertyName);
     exec->clearException();
     
@@ -1003,7 +1004,7 @@ bool NetscapePluginInstanceProxy::hasProperty(uint32_t objectID, unsigned proper
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     bool result = object->hasProperty(exec, propertyName);
     exec->clearException();
     
@@ -1023,7 +1024,7 @@ bool NetscapePluginInstanceProxy::hasMethod(uint32_t objectID, const Identifier&
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
     JSValue func = object->get(exec, methodName);
     exec->clearException();
@@ -1043,7 +1044,7 @@ bool NetscapePluginInstanceProxy::enumerate(uint32_t objectID, data_t& resultDat
     if (!frame)
         return false;
     
-    ExecState* exec = frame->script()->globalObject()->globalExec();
+    ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
     JSLock lock(SilenceAssertionsOnly);
  
     PropertyNameArray propertyNames(exec);
@@ -1442,6 +1443,11 @@ void NetscapePluginInstanceProxy::resolveURL(const char* url, const char* target
     memcpy(resolvedURLData, resolvedURL.data(), resolvedURLLength);
 }
 
+void NetscapePluginInstanceProxy::privateBrowsingModeDidChange(bool isPrivateBrowsingEnabled)
+{
+    _WKPHPluginInstancePrivateBrowsingModeDidChange(m_pluginHostProxy->port(), m_pluginID, isPrivateBrowsingEnabled);
+}
+
 } // namespace WebKit
 
 #endif // USE(PLUGIN_HOST_PROCESS)
diff --git a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
index 0b3a32f..6be3953 100644
--- a/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
+++ b/WebKit/mac/Plugins/Hosted/ProxyInstance.mm
@@ -370,7 +370,7 @@ JSC::JSValue ProxyInstance::fieldValue(ExecState* exec, const Field* field) cons
     
 void ProxyInstance::setFieldValue(ExecState* exec, const Field* field, JSValue value) const
 {
-    if (m_instanceProxy)
+    if (!m_instanceProxy)
         return;
     
     uint64_t serverIdentifier = static_cast<const ProxyField*>(field)->serverIdentifier();
diff --git a/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm b/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
index 34a2211..8de2aa6 100644
--- a/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
@@ -90,7 +90,8 @@ extern "C" {
 
 - (void)setAttributeKeys:(NSArray *)keys andValues:(NSArray *)values
 {
-    ASSERT(!_attributeKeys && !_attributeValues);
+    ASSERT(!_attributeKeys);
+    ASSERT(!_attributeValues);
     
     _attributeKeys.adoptNS([keys copy]);
     _attributeValues.adoptNS([values copy]);
@@ -102,7 +103,8 @@ extern "C" {
 
     NSString *userAgent = [[self webView] userAgentForURL:_baseURL.get()];
 
-    _proxy = NetscapePluginHostManager::shared().instantiatePlugin(_pluginPackage.get(), self, _MIMEType.get(), _attributeKeys.get(), _attributeValues.get(), userAgent, _sourceURL.get(), _mode == NP_FULL);
+    _proxy = NetscapePluginHostManager::shared().instantiatePlugin(_pluginPackage.get(), self, _MIMEType.get(), _attributeKeys.get(), _attributeValues.get(), userAgent, _sourceURL.get(), 
+                                                                   _mode == NP_FULL, _isPrivateBrowsingEnabled);
     if (!_proxy) 
         return NO;
 
@@ -128,6 +130,12 @@ extern "C" {
         [newLayer addSublayer:_pluginLayer.get()];
 }
 
+- (void)privateBrowsingModeDidChange
+{
+    if (_proxy)
+        _proxy->privateBrowsingModeDidChange(_isPrivateBrowsingEnabled);
+}
+
 - (void)loadStream
 {
 }
@@ -414,7 +422,7 @@ extern "C" {
     ASSERT([webPluginContainerCheck isKindOfClass:[WebPluginContainerCheck class]]);
     
     id contextInfo = [webPluginContainerCheck contextInfo];
-    ASSERT(contextInfo && [contextInfo isKindOfClass:[NSNumber class]]);
+    ASSERT([contextInfo isKindOfClass:[NSNumber class]]);
 
     if (!_proxy)
         return;
diff --git a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
index 04edf64..9882bb5 100644
--- a/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
+++ b/WebKit/mac/Plugins/Hosted/WebKitPluginHost.defs
@@ -236,4 +236,8 @@ simpleroutine PHBooleanAndDataReply(pluginHostPort :mach_port_t;
              
 simpleroutine PHPluginInstanceDidDraw(pluginHostPort :mach_port_t;
                                       pluginID :uint32_t);
+simpleroutine PHPluginInstancePrivateBrowsingModeDidChange(pluginHostPort :mach_port_t;
+                                                           pluginID :uint32_t;
+                                                           privateBrowsingEnabled :boolean_t);
+
                               
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
index bd05ebe..246fcf1 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
@@ -62,6 +62,9 @@ class WebHaltablePlugin;
     BOOL _isStarted;
     BOOL _hasFocus;
     BOOL _isCompletelyObscured;
+    BOOL _isPrivateBrowsingEnabled;
+    BOOL _isHalted;
+    BOOL _hasBeenHalted;
     
     RefPtr<WebCore::HTMLPlugInElement> _element;
     RetainPtr<NSString> _MIMEType;
@@ -109,6 +112,11 @@ class WebHaltablePlugin;
 - (void)start;
 - (void)stop;
 
+- (void)halt;
+- (void)resumeFromHalt;
+- (BOOL)isHalted;
+- (BOOL)hasBeenHalted;
+
 - (void)addWindowObservers;
 - (void)removeWindowObservers;
 
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
index e730419..0b4d56a 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
@@ -43,6 +43,7 @@
 
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/AuthenticationMac.h>
+#import <WebCore/BitmapImage.h>
 #import <WebCore/Credential.h>
 #import <WebCore/CredentialStorage.h>
 #import <WebCore/CString.h>
@@ -55,6 +56,7 @@
 #import <WebCore/Page.h>
 #import <WebCore/ProtectionSpace.h>
 #import <WebCore/RenderView.h>
+#import <WebCore/RenderWidget.h>
 #import <WebKit/DOMPrivate.h>
 #import <runtime/InitializeThreading.h>
 #import <wtf/Assertions.h>
@@ -72,13 +74,28 @@ public:
     }
     
 private:
-    virtual void halt() { [m_view stop]; }
-    virtual void restart() { [m_view start]; }
-    virtual Node* node() const { return [m_view element]; }
+    virtual void halt();
+    virtual void restart();
+    virtual Node* node() const;
 
     WebBaseNetscapePluginView* m_view;
 };
 
+void WebHaltablePlugin::halt()
+{
+    [m_view halt];
+}
+
+void WebHaltablePlugin::restart()
+{ 
+    [m_view resumeFromHalt];
+}
+    
+Node* WebHaltablePlugin::node() const
+{
+    return [m_view element];
+}
+
 @implementation WebBaseNetscapePluginView
 
 + (void)initialize
@@ -243,6 +260,10 @@ private:
     ASSERT_NOT_REACHED();
 }
 
+- (void)privateBrowsingModeDidChange
+{
+}
+
 - (void)removeTrackingRect
 {
     if (_trackingTag) {
@@ -455,6 +476,51 @@ private:
     [self destroyPlugin];
 }
 
+- (void)halt
+{
+    ASSERT(!_isHalted);
+    ASSERT(_isStarted);
+    Element *element = [self element];
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    CGImageRef cgImage = CGImageRetain([core([self webFrame])->nodeImage(element) CGImageForProposedRect:nil context:nil hints:nil]);
+#else
+    RetainPtr<CGImageSourceRef> imageRef(AdoptCF, CGImageSourceCreateWithData((CFDataRef)[core([self webFrame])->nodeImage(element) TIFFRepresentation], 0));
+    CGImageRef cgImage = CGImageSourceCreateImageAtIndex(imageRef.get(), 0, 0);
+#endif
+    ASSERT(cgImage);
+    
+    // BitmapImage will release the passed in CGImage on destruction.
+    RefPtr<Image> nodeImage = BitmapImage::create(cgImage);
+    ASSERT(element->renderer());
+    toRenderWidget(element->renderer())->showSubstituteImage(nodeImage);
+    [self stop];
+    _isHalted = YES;  
+    _hasBeenHalted = YES;
+}
+
+- (void)resumeFromHalt
+{
+    ASSERT(_isHalted);
+    ASSERT(!_isStarted);
+    [self start];
+    
+    if (_isStarted)
+        _isHalted = NO;
+    
+    ASSERT([self element]->renderer());
+    toRenderWidget([self element]->renderer())->showSubstituteImage(0);
+}
+
+- (BOOL)isHalted
+{
+    return _isHalted;
+}
+
+- (BOOL)hasBeenHalted
+{
+    return _hasBeenHalted;
+}
+
 - (void)viewWillMoveToWindow:(NSWindow *)newWindow
 {
     // We must remove the tracking rect before we move to the new window.
@@ -506,6 +572,8 @@ private:
                                                      name:WebPreferencesChangedNotification
                                                    object:nil];
 
+        _isPrivateBrowsingEnabled = [[[self webView] preferences] privateBrowsingEnabled];
+        
         // View moved to an actual window. Start it if not already started.
         [self start];
 
@@ -586,9 +654,12 @@ private:
 - (void)preferencesHaveChanged:(NSNotification *)notification
 {
     WebPreferences *preferences = [[self webView] preferences];
-    BOOL arePlugInsEnabled = [preferences arePlugInsEnabled];
+
+    if ([notification object] != preferences)
+        return;
     
-    if ([notification object] == preferences && _isStarted != arePlugInsEnabled) {
+    BOOL arePlugInsEnabled = [preferences arePlugInsEnabled];
+    if (_isStarted != arePlugInsEnabled) {
         if (arePlugInsEnabled) {
             if ([self currentWindow]) {
                 [self start];
@@ -598,6 +669,12 @@ private:
             [self invalidatePluginContentRect:[self bounds]];
         }
     }
+    
+    BOOL isPrivateBrowsingEnabled = [preferences privateBrowsingEnabled];
+    if (isPrivateBrowsingEnabled != _isPrivateBrowsingEnabled) {
+        _isPrivateBrowsingEnabled = isPrivateBrowsingEnabled;
+        [self privateBrowsingModeDidChange];
+    }
 }
 
 - (void)renewGState
@@ -640,13 +717,12 @@ private:
 
 - (WebDataSource *)dataSource
 {
-    WebFrame *webFrame = kit(_element->document()->frame());
-    return [webFrame _dataSource];
+    return [[self webFrame] _dataSource];
 }
 
 - (WebFrame *)webFrame
 {
-    return [[self dataSource] webFrame];
+    return kit(_element->document()->frame());
 }
 
 - (WebView *)webView
diff --git a/WebKit/mac/Plugins/WebNetscapePluginView.mm b/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 5debb97..135d45a 100644
--- a/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -402,7 +402,8 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
                     QDErr err = NewGWorldFromPtr(&newOffscreenGWorld,
                         getQDPixelFormatForBitmapContext(currentContext), &offscreenBounds, 0, 0, 0,
                         static_cast<char*>(offscreenData), CGBitmapContextGetBytesPerRow(currentContext));
-                    ASSERT(newOffscreenGWorld && !err);
+                    ASSERT(newOffscreenGWorld);
+                    ASSERT(!err);
                     if (!err) {
                         if (offscreenGWorld)
                             DisposeGWorld(offscreenGWorld);
@@ -838,6 +839,21 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     _eventHandler->syntheticKeyDownWithCommandModifier(keyCode, character);
 }
 
+- (void)privateBrowsingModeDidChange
+{
+    if (!_isStarted)
+        return;
+    
+    NPBool value = _isPrivateBrowsingEnabled;
+
+    [self willCallPlugInFunction];
+    {
+        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        [_pluginPackage.get() pluginFuncs]->setvalue(plugin, NPNVprivateModeBool, &value);
+    }
+    [self didCallPlugInFunction];
+}
+
 #pragma mark WEB_NETSCAPE_PLUGIN
 
 - (BOOL)isNewWindowEqualToOldWindow
@@ -1271,7 +1287,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
 {
     ASSERT([webPluginContainerCheck isKindOfClass:[WebPluginContainerCheck class]]);
     WebPluginContainerCheck *check = (WebPluginContainerCheck *)webPluginContainerCheck;
-    ASSERT([check contextInfo] && [[check contextInfo] isKindOfClass:[WebNetscapeContainerCheckContextInfo class]]);
+    ASSERT([[check contextInfo] isKindOfClass:[WebNetscapeContainerCheckContextInfo class]]);
     
     [self cancelCheckIfAllowedToLoadURL:[[check contextInfo] checkRequestID]];
 }
@@ -2022,13 +2038,19 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
             return NPERR_NO_ERROR;
         }
 #endif /* NP_NO_CARBON */
-            
+
         case NPNVsupportsCocoaBool:
         {
             *(NPBool *)value = TRUE;
             return NPERR_NO_ERROR;
         }
 
+        case NPNVprivateModeBool:
+        {
+            *(NPBool *)value = _isPrivateBrowsingEnabled;
+            return NPERR_NO_ERROR;
+        }
+
         case WKNVBrowserContainerCheckFuncs:
         {
             *(WKNBrowserContainerCheckFuncs **)value = browserContainerCheckFuncs();
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index a3f004e..c107299 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -548,6 +548,15 @@ void WebChromeClient::reachedMaxAppCacheSize(int64_t spaceNeeded)
     
 void WebChromeClient::populateVisitedLinks()
 {
+    if ([m_webView historyDelegate]) {
+        WebHistoryDelegateImplementationCache* implementations = WebViewGetHistoryDelegateImplementations(m_webView);
+        
+        if (implementations->populateVisitedLinksFunc)
+            CallHistoryDelegate(implementations->populateVisitedLinksFunc, m_webView, @selector(populateVisitedLinksForWebView:));
+
+        return;
+    }
+
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
     [[WebHistory optionalSharedHistory] _addVisitedLinksToPageGroup:[m_webView page]->group()];
     END_BLOCK_OBJC_EXCEPTIONS;
diff --git a/WebKit/mac/WebCoreSupport/WebEditorClient.mm b/WebKit/mac/WebCoreSupport/WebEditorClient.mm
index e8c37d5..1e03d88 100644
--- a/WebKit/mac/WebCoreSupport/WebEditorClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebEditorClient.mm
@@ -675,7 +675,8 @@ void WebEditorClient::checkGrammarOfString(const UChar* text, int length, Vector
         NSValue *detailRangeAsNSValue = [detail objectForKey:NSGrammarRange];
         ASSERT(detailRangeAsNSValue);
         NSRange detailNSRange = [detailRangeAsNSValue rangeValue];
-        ASSERT(detailNSRange.location != NSNotFound && detailNSRange.length > 0);
+        ASSERT(detailNSRange.location != NSNotFound);
+        ASSERT(detailNSRange.length > 0);
         grammarDetail.location = detailNSRange.location;
         grammarDetail.length = detailNSRange.length;
         grammarDetail.userDescription = [detail objectForKey:NSGrammarUserDescription];
@@ -696,7 +697,8 @@ void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64
     for (NSTextCheckingResult *incomingResult in incomingResults) {
         NSRange resultRange = [incomingResult range];
         NSTextCheckingType resultType = [incomingResult resultType];
-        ASSERT(resultRange.location != NSNotFound && resultRange.length > 0);
+        ASSERT(resultRange.location != NSNotFound);
+        ASSERT(resultRange.length > 0);
         if (NSTextCheckingTypeSpelling == resultType && 0 != (checkingTypes & NSTextCheckingTypeSpelling)) {
             TextCheckingResult result;
             result.type = TextCheckingTypeSpelling;
@@ -715,7 +717,8 @@ void WebEditorClient::checkTextOfParagraph(const UChar* text, int length, uint64
                 NSValue *detailRangeAsNSValue = [incomingDetail objectForKey:NSGrammarRange];
                 ASSERT(detailRangeAsNSValue);
                 NSRange detailNSRange = [detailRangeAsNSValue rangeValue];
-                ASSERT(detailNSRange.location != NSNotFound && detailNSRange.length > 0);
+                ASSERT(detailNSRange.location != NSNotFound);
+                ASSERT(detailNSRange.length > 0);
                 detail.location = detailNSRange.location;
                 detail.length = detailNSRange.length;
                 detail.userDescription = [incomingDetail objectForKey:NSGrammarUserDescription];
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
index 6259c80..6d365dd 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.h
@@ -208,7 +208,6 @@ private:
     NSDictionary *actionDictionary(const WebCore::NavigationAction&, PassRefPtr<WebCore::FormState>) const;
     
     virtual bool canCachePage() const;
-    virtual bool shouldLoadMediaElementURL(const WebCore::KURL&) const;
     
     RetainPtr<WebFrame> m_webFrame;
 
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index ec05572..bc6c8f4 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -988,7 +988,7 @@ void WebFrameLoaderClient::saveViewStateToItem(HistoryItem* item)
 
 void WebFrameLoaderClient::restoreViewState()
 {
-    HistoryItem* currentItem = core(m_webFrame.get())->loader()->currentHistoryItem();
+    HistoryItem* currentItem = core(m_webFrame.get())->loader()->history()->currentItem();
     ASSERT(currentItem);
 
     // FIXME: As the ASSERT attests, it seems we should always have a currentItem here.
@@ -1738,18 +1738,7 @@ jobject WebFrameLoaderClient::javaApplet(NSView* view)
 }
 #endif
 
-bool WebFrameLoaderClient::shouldLoadMediaElementURL(const KURL& url) const {
-    WebView *webView = getWebView(m_webFrame.get());
-    
-    if (id policyDelegate = [webView policyDelegate]) {
-        if ([policyDelegate respondsToSelector:@selector(webView:shouldLoadMediaURL:inFrame:)])
-            return [policyDelegate webView:webView shouldLoadMediaURL:url inFrame:m_webFrame.get()];
-    }
-    return true;
-}
-
 @implementation WebFramePolicyListener
-
 + (void)initialize
 {
     JSC::initializeThreading();
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
index 48c655d..0bab4e3 100644
--- a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.h
@@ -36,6 +36,7 @@ public:
     WebPluginHalterClient(WebView *);
     
     virtual bool shouldHaltPlugin(WebCore::Node*) const;
+    virtual bool enabled() const;
     
 private:
     WebView *m_webView;
diff --git a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
index 2384d0b..b83e4c8 100644
--- a/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebPluginHalterClient.mm
@@ -42,3 +42,8 @@ bool WebPluginHalterClient::shouldHaltPlugin(Node* pluginNode) const
     ASSERT_ARG(pluginNode, pluginNode);    
     return CallUIDelegateReturningBoolean(NO, m_webView, @selector(webView:shouldHaltPlugin:), kit(pluginNode));
 }
+
+bool WebPluginHalterClient::enabled() const
+{
+    return [[m_webView UIDelegate] respondsToSelector:@selector(webView:shouldHaltPlugin:)];
+}
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.h b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
index 907ba42..edf3cad 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.h
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.h
@@ -86,6 +86,7 @@ struct WebHistoryDelegateImplementationCache {
     IMP clientRedirectFunc;
     IMP serverRedirectFunc;
     IMP setTitleFunc;
+    IMP populateVisitedLinksFunc;
 };
 
 WebResourceDelegateImplementationCache* WebViewGetResourceLoadDelegateImplementations(WebView *);
@@ -130,5 +131,6 @@ id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, id, NSInteger, id
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, id, id, id);
 id CallScriptDebugDelegate(IMP, WebView *, SEL, id, NSInteger, NSInteger, id);
 
+id CallHistoryDelegate(IMP, WebView *, SEL);
 id CallHistoryDelegate(IMP, WebView *, SEL, id, id);
 id CallHistoryDelegate(IMP, WebView *, SEL, id, id, id);
diff --git a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
index 7757fc7..486d094 100644
--- a/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
+++ b/WebKit/mac/WebView/WebDelegateImplementationCaching.mm
@@ -548,6 +548,11 @@ id CallScriptDebugDelegate(IMP implementation, WebView *self, SEL selector, id o
     return CallDelegate(implementation, self, self->_private->scriptDebugDelegate, selector, object1, integer1, integer2, object2);
 }
 
+id CallHistoryDelegate(IMP implementation, WebView *self, SEL selector)
+{
+    return CallDelegate(implementation, self, self->_private->historyDelegate, selector);
+}
+
 id CallHistoryDelegate(IMP implementation, WebView *self, SEL selector, id object1, id object2)
 {
     return CallDelegate(implementation, self, self->_private->historyDelegate, selector, object1, object2);
diff --git a/WebKit/mac/WebView/WebDynamicScrollBarsView.h b/WebKit/mac/WebView/WebDynamicScrollBarsView.h
index 40aadc0..15ed7e4 100644
--- a/WebKit/mac/WebView/WebDynamicScrollBarsView.h
+++ b/WebKit/mac/WebView/WebDynamicScrollBarsView.h
@@ -29,8 +29,7 @@
 // This is a Private header (containing SPI), despite the fact that its name
 // does not contain the word Private.
 
-// FIXME: Does Safari really need to use this any more? AppKit added autohidesScrollers
-// in Panther, and that was the original reason we needed this view in Safari.
+// This was once used by Safari, but has not been for a long time.
 
 // FIXME: <rdar://problem/5898985> Mail currently expects this header to define WebCoreScrollbarAlwaysOn.
 extern const int WebCoreScrollbarAlwaysOn;
@@ -47,5 +46,8 @@ extern const int WebCoreScrollbarAlwaysOn;
     BOOL horizontallyPinnedByPreviousWheelEvent;
     unsigned inUpdateScrollersLayoutPass;
 }
-- (void)setAllowsHorizontalScrolling:(BOOL)flag; // This method is used by Safari, so it cannot be removed.
+
+// This was originally added for Safari's benefit, but Safari has not used it for a long time.
+// Perhaps it can be removed.
+- (void)setAllowsHorizontalScrolling:(BOOL)flag;
 @end
diff --git a/WebKit/mac/WebView/WebFrame.mm b/WebKit/mac/WebView/WebFrame.mm
index 27aac67..94fe997 100644
--- a/WebKit/mac/WebView/WebFrame.mm
+++ b/WebKit/mac/WebView/WebFrame.mm
@@ -85,6 +85,7 @@
 #import <WebCore/markup.h>
 #import <WebCore/visible_units.h>
 #import <runtime/JSLock.h>
+#import <runtime/JSObject.h>
 #import <runtime/JSValue.h>
 #import <wtf/CurrentTime.h>
 
@@ -270,11 +271,12 @@ WebView *getWebView(WebFrame *webFrame)
     ScriptController* scriptController = _private->coreFrame->script();
 
     // Calling ScriptController::globalObject() would create a window shell, and dispatch corresponding callbacks, which may be premature
-    //  if the script debugger is attached before a document is created.
-    if (!scriptController->haveWindowShell())
+    // if the script debugger is attached before a document is created.  These calls use the debuggerWorld(), we will need to pass a world
+    // to be able to debug isolated worlds.
+    if (!scriptController->existingWindowShell(debuggerWorld()))
         return;
 
-    JSGlobalObject* globalObject = scriptController->globalObject();
+    JSGlobalObject* globalObject = scriptController->globalObject(debuggerWorld());
     if (!globalObject)
         return;
 
@@ -595,7 +597,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
 {
     ASSERT(_private->coreFrame->document());
     
-    JSValue result = _private->coreFrame->loader()->executeScript(string, forceUserGesture).jsValue();
+    JSValue result = _private->coreFrame->script()->executeScript(string, forceUserGesture).jsValue();
 
     if (!_private->coreFrame) // In case the script removed our frame from the page.
         return @"";
@@ -607,7 +609,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
         return @"";
 
     JSLock lock(SilenceAssertionsOnly);
-    return String(result.toString(_private->coreFrame->script()->globalObject()->globalExec()));
+    return String(result.toString(_private->coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec()));
 }
 
 - (NSRect)_caretRectAtNode:(DOMNode *)node offset:(int)offset affinity:(NSSelectionAffinity)affinity
@@ -1202,6 +1204,42 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return SecurityOrigin::canLoad(URL, String(), _private->coreFrame->document());
 }
 
+- (NSString *)_stringByEvaluatingJavaScriptInIsolatedWorld:(unsigned)worldID WithGlobalObject:(JSObjectRef)globalObjectRef FromString:(NSString *)string
+{
+    // Start off with some guess at a frame and a global object, we'll try to do better...!
+    JSDOMWindow* anyWorldGlobalObject = _private->coreFrame->script()->globalObject(mainThreadNormalWorld());
+
+    // The global object is probably a shell object? - if so, we know how to use this!
+    JSC::JSObject* globalObjectObj = toJS(globalObjectRef);
+    if (!strcmp(globalObjectObj->classInfo()->className, "JSDOMWindowShell"))
+        anyWorldGlobalObject = static_cast<JSDOMWindowShell*>(globalObjectObj)->window();
+
+    // Get the frame frome the global object we've settled on.
+    Frame* frame = anyWorldGlobalObject->impl()->frame();
+    ASSERT(frame->document());
+    JSValue result = frame->script()->executeScriptInIsolatedWorld(worldID, string, true).jsValue();
+
+    if (!frame) // In case the script removed our frame from the page.
+        return @"";
+
+    // This bizarre set of rules matches behavior from WebKit for Safari 2.0.
+    // If you don't like it, use -[WebScriptObject evaluateWebScript:] or 
+    // JSEvaluateScript instead, since they have less surprising semantics.
+    if (!result || !result.isBoolean() && !result.isString() && !result.isNumber())
+        return @"";
+
+    JSLock lock(SilenceAssertionsOnly);
+    return String(result.toString(anyWorldGlobalObject->globalExec()));
+}
+
+- (JSGlobalContextRef)contextForWorldID:(unsigned)worldID;
+{
+    Frame* coreFrame = _private->coreFrame;
+    if (!coreFrame)
+        return 0;
+    return toGlobalRef(coreFrame->script()->globalObject(worldID)->globalExec());
+}
+
 @end
 
 @implementation WebFrame
@@ -1433,7 +1471,7 @@ static NSURL *createUniqueWebDataURL()
     Frame* coreFrame = _private->coreFrame;
     if (!coreFrame)
         return 0;
-    return toGlobalRef(coreFrame->script()->globalObject()->globalExec());
+    return toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
 }
 
 @end
diff --git a/WebKit/mac/WebView/WebFramePrivate.h b/WebKit/mac/WebView/WebFramePrivate.h
index 7446584..be13430 100644
--- a/WebKit/mac/WebView/WebFramePrivate.h
+++ b/WebKit/mac/WebView/WebFramePrivate.h
@@ -96,6 +96,9 @@ typedef enum {
 - (void)_recursive_pauseNullEventsForAllNetscapePlugins;
 #endif
 
+- (NSString *)_stringByEvaluatingJavaScriptInIsolatedWorld:(unsigned)worldID WithGlobalObject:(JSObjectRef)globalObject FromString:(NSString *)string;
+- (JSGlobalContextRef)contextForWorldID:(unsigned)worldID;
+
 // Pause a given CSS animation or transition on the target node at a specific time.
 // If the animation or transition is already paused, it will update its pause time.
 // This method is only intended to be used for testing the CSS animation and transition system.
diff --git a/WebKit/mac/WebView/WebHTMLView.mm b/WebKit/mac/WebView/WebHTMLView.mm
index 102f630..936b6d7 100644
--- a/WebKit/mac/WebView/WebHTMLView.mm
+++ b/WebKit/mac/WebView/WebHTMLView.mm
@@ -2173,6 +2173,15 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
 #endif
 }
 
+- (NSView *)_compositingLayersHostingView
+{
+#if USE(ACCELERATED_COMPOSITING)
+    return _private->layerHostingView;
+#else
+    return 0;
+#endif
+}
+
 @end
 
 @implementation NSView (WebHTMLViewFileInternal)
diff --git a/WebKit/mac/WebView/WebHTMLViewPrivate.h b/WebKit/mac/WebView/WebHTMLViewPrivate.h
index bb59a7b..cb121d8 100644
--- a/WebKit/mac/WebView/WebHTMLViewPrivate.h
+++ b/WebKit/mac/WebView/WebHTMLViewPrivate.h
@@ -117,8 +117,8 @@
 - (void)_pauseNullEventsForAllNetscapePlugins;
 #endif
 
-// SPI for DumpRenderTree
 - (BOOL)_isUsingAcceleratedCompositing;
+- (NSView *)_compositingLayersHostingView;
 
 // SPI for printing (should be converted to API someday). When the WebHTMLView isn't being printed
 // directly, this method must be called before paginating, or the computed height might be incorrect.
diff --git a/WebKit/mac/WebView/WebHistoryDelegate.h b/WebKit/mac/WebView/WebHistoryDelegate.h
index 4029eb0..4415365 100644
--- a/WebKit/mac/WebView/WebHistoryDelegate.h
+++ b/WebKit/mac/WebView/WebHistoryDelegate.h
@@ -39,4 +39,6 @@
 
 - (void)webView:(WebView *)webView updateHistoryTitle:(NSString *)title forURL:(NSString *)url;
 
+- (void)populateVisitedLinksForWebView:(WebView *)webView;
+
 @end
diff --git a/WebKit/mac/WebView/WebPDFView.mm b/WebKit/mac/WebView/WebPDFView.mm
index dea3819..a38412e 100644
--- a/WebKit/mac/WebView/WebPDFView.mm
+++ b/WebKit/mac/WebView/WebPDFView.mm
@@ -953,7 +953,7 @@ static BOOL _PDFSelectionsAreEqual(PDFSelection *selectionA, PDFSelection *selec
     }
 
     // Call to the frame loader because this is where our security checks are made.
-    core([dataSource webFrame])->loader()->loadFrameRequest(ResourceRequest(URL), false, false, event.get(), 0);
+    core([dataSource webFrame])->loader()->loadFrameRequest(ResourceRequest(URL), false, false, event.get(), 0, SendReferrer);
 }
 
 - (void)PDFViewOpenPDFInNativeApplication:(PDFView *)sender
diff --git a/WebKit/mac/WebView/WebPolicyDelegatePrivate.h b/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
index efdf007..45f8f45 100644
--- a/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebPolicyDelegatePrivate.h
@@ -49,6 +49,4 @@ typedef enum {
 @interface NSObject (WebPolicyDelegatePrivate)
 // Needed for <rdar://problem/3951283> can view pages from the back/forward cache that should be disallowed by Parental Controls
 - (BOOL)webView:(WebView *)webView shouldGoToHistoryItem:(WebHistoryItem *)item;
-
-- (BOOL)webView:(WebView *)webView shouldLoadMediaURL:(NSURL *)url inFrame:(WebFrame *)frame;
 @end
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index d6c9d3c..4a87337 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -56,7 +56,6 @@
 #define WebKitDatabasesEnabledPreferenceKey @"WebKitDatabasesEnabledPreferenceKey"
 #define WebKitLocalStorageEnabledPreferenceKey @"WebKitLocalStorageEnabledPreferenceKey"
 #define WebKitExperimentalNotificationsEnabledPreferenceKey @"WebKitExperimentalNotificationsEnabledPreferenceKey"
-#define WebKitExperimentalWebSocketsEnabledPreferenceKey @"WebKitExperimentalWebSocketsEnabledPreferenceKey"
 #define WebKitAllowAnimatedImagesPreferenceKey @"WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey @"WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey @"WebKitDisplayImagesKey"
@@ -87,7 +86,6 @@
 #define WebKitXSSAuditorEnabledPreferenceKey @"WebKitXSSAuditorEnabled"
 #define WebKitAcceleratedCompositingEnabledPreferenceKey @"WebKitAcceleratedCompositingEnabled"
 #define WebKitWebGLEnabledPreferenceKey @"WebKitWebGLEnabled"
-#define WebKitPluginHalterEnabledPreferenceKey @"WebKitPluginHalterEnabled"
 #define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 
 // These are private both because callers should be using the cover methods and because the
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index 2910d27..4914340 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -321,7 +321,6 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitDatabasesEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitLocalStorageEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitExperimentalNotificationsEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitExperimentalWebSocketsEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImagesPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAllowAnimatedImageLoopingPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitDisplayImagesKey,
@@ -353,7 +352,6 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitXSSAuditorEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitAcceleratedCompositingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebGLEnabledPreferenceKey,
-        [NSNumber numberWithBool:NO],   WebKitPluginHalterEnabledPreferenceKey,
         [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         nil];
 
@@ -1026,16 +1024,6 @@ static WebCacheModel cacheModelForMainBundle(void)
     [self _setBoolValue:experimentalNotificationsEnabled forKey:WebKitExperimentalNotificationsEnabledPreferenceKey];
 }
 
-- (BOOL)experimentalWebSocketsEnabled
-{
-    return [self _boolValueForKey:WebKitExperimentalWebSocketsEnabledPreferenceKey];
-}
-
-- (void)setExperimentalWebSocketsEnabled:(BOOL)experimentalWebSocketsEnabled
-{
-    [self _setBoolValue:experimentalWebSocketsEnabled forKey:WebKitExperimentalWebSocketsEnabledPreferenceKey];
-}
-
 + (WebPreferences *)_getInstanceForIdentifier:(NSString *)ident
 {
     LOG(Encoding, "requesting for %@\n", ident);
@@ -1173,16 +1161,6 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:enabled forKey:WebKitWebGLEnabledPreferenceKey];
 }
 
-- (BOOL)pluginHalterEnabled
-{
-    return [self _boolValueForKey:WebKitPluginHalterEnabledPreferenceKey];
-}
-
-- (void)setPluginHalterEnabled:(BOOL)enabled
-{
-    [self _setBoolValue:enabled forKey:WebKitPluginHalterEnabledPreferenceKey];
-}
-
 - (unsigned)pluginAllowedRunTime
 {
     return [self _integerValueForKey:WebKitPluginAllowedRunTimePreferenceKey];
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index 6a25921..c558cbb 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -110,12 +110,6 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)experimentalNotificationsEnabled;
 - (void)setExperimentalNotificationsEnabled:(BOOL)notificationsEnabled;
 
-- (BOOL)experimentalWebSocketsEnabled;
-- (void)setExperimentalWebSocketsEnabled:(BOOL)websocketsEnabled;
-
-- (BOOL)pluginHalterEnabled;
-- (void)setPluginHalterEnabled:(BOOL)enabled;
-
 - (unsigned)pluginAllowedRunTime;
 - (void)setPluginAllowedRunTime:(unsigned)allowedRunTime;
 
diff --git a/WebKit/mac/WebView/WebResourceLoadDelegate.h b/WebKit/mac/WebView/WebResourceLoadDelegate.h
index f92466b..77d84ad 100644
--- a/WebKit/mac/WebView/WebResourceLoadDelegate.h
+++ b/WebKit/mac/WebView/WebResourceLoadDelegate.h
@@ -67,7 +67,7 @@
 - (id)webView:(WebView *)sender identifierForInitialRequest:(NSURLRequest *)request fromDataSource:(WebDataSource *)dataSource;
 
 /*!
-    @method resource:willSendRequest:redirectResponse:fromDataSource:
+    @method webView:resource:willSendRequest:redirectResponse:fromDataSource:
     @discussion This message is sent before a load is initiated.  The request may be modified
     as necessary by the receiver.
     @param webView The WebView sending the message.
diff --git a/WebKit/mac/WebView/WebScriptDebugDelegate.mm b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
index 8489c9b..ef2cb67 100644
--- a/WebKit/mac/WebView/WebScriptDebugDelegate.mm
+++ b/WebKit/mac/WebView/WebScriptDebugDelegate.mm
@@ -249,7 +249,7 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     }
 
     JSValue exception;
-    JSValue result = _private->debuggerCallFrame->evaluate(String(script), exception);
+    JSValue result = DebuggerCallFrame_evaluateInWorld(*_private->debuggerCallFrame, String(script), exception);
     if (exception)
         return [self _convertValueToObjcValue:exception];
     return result ? [self _convertValueToObjcValue:result] : nil;
diff --git a/WebKit/mac/WebView/WebTextCompletionController.mm b/WebKit/mac/WebView/WebTextCompletionController.mm
index 6c37b98..4f8e6e0 100644
--- a/WebKit/mac/WebView/WebTextCompletionController.mm
+++ b/WebKit/mac/WebView/WebTextCompletionController.mm
@@ -298,7 +298,8 @@ using namespace std;
 - (void)_reflectSelection
 {
     int selectedRow = [_tableView selectedRow];
-    ASSERT(selectedRow >= 0 && selectedRow < (int)[_completions count]);
+    ASSERT(selectedRow >= 0);
+    ASSERT(selectedRow < (int)[_completions count]);
     [self _insertMatch:[_completions objectAtIndex:selectedRow]];
 }
 
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.mm b/WebKit/mac/WebView/WebVideoFullscreenController.mm
index 6592ad2..fe07f3e 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.mm
@@ -42,6 +42,10 @@
 SOFT_LINK_FRAMEWORK(QTKit)
 SOFT_LINK_CLASS(QTKit, QTMovieView)
 
+SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
+
+#define QTMovieRateDidChangeNotification getQTMovieRateDidChangeNotification()
+
 @interface WebVideoFullscreenWindow : NSWindow
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER)
 <NSAnimationDelegate>
@@ -76,6 +80,7 @@ SOFT_LINK_CLASS(QTKit, QTMovieView)
 {
     ASSERT(!_backgroundFullscreenWindow);
     ASSERT(!_fadeAnimation);
+    [[NSNotificationCenter defaultCenter] removeObserver:self];
     [super dealloc];
 }
 
@@ -109,7 +114,15 @@ SOFT_LINK_CLASS(QTKit, QTMovieView)
     _mediaElement = mediaElement;
     if ([self isWindowLoaded]) {
         QTMovieView *movieView = [[self fullscreenWindow] movieView];
-        [movieView setMovie:_mediaElement->platformMedia().qtMovie];
+        QTMovie *movie = _mediaElement->platformMedia().qtMovie;
+
+        ASSERT(movieView);
+        ASSERT(movie);
+        [movieView setMovie:movie];
+        [[NSNotificationCenter defaultCenter] addObserver:self
+                                                 selector:@selector(rateChanged:) 
+                                                     name:QTMovieRateDidChangeNotification 
+                                                   object:movie];
     }
 }
 
@@ -135,6 +148,9 @@ SOFT_LINK_CLASS(QTKit, QTMovieView)
 
 - (void)windowDidExitFullscreen
 {
+    // If we don't clear the movie, underlying movie data structures are leaked and the movie keeps playing <rdar://problem/7295070>
+    [[[self fullscreenWindow] movieView] setMovie:nil];
+
     [self clearFadeAnimation];
     [[self window] close];
     [self setWindow:nil];
@@ -264,14 +280,21 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
 #pragma mark -
 #pragma mark Window callback
 
+- (void)_requestExit
+{
+    if (_mediaElement)
+        _mediaElement->exitFullscreen();
+    _forceDisableAnimation = NO;
+}
+
 - (void)requestExitFullscreenWithAnimation:(BOOL)animation
 {
     if (_isEndingFullscreen)
         return;
 
     _forceDisableAnimation = !animation;
-    _mediaElement->exitFullscreen();
-    _forceDisableAnimation = NO;
+    [self performSelector:@selector(_requestExit) withObject:nil afterDelay:0];
+
 }
 
 - (void)requestExitFullscreen
@@ -283,6 +306,16 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
 {
     [_hudController fadeWindowIn];
 }
+
+#pragma mark -
+#pragma mark QTMovie callbacks
+
+- (void)rateChanged:(NSNotification *)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+    [_hudController updateRate];
+}
+
 @end
 
 @implementation WebVideoFullscreenWindow
@@ -439,6 +472,7 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
     [super resignKeyWindow];
     [[self windowController] requestExitFullscreenWithAnimation:NO];
 }
+
 @end
 
 #endif /* ENABLE(VIDEO) */
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
index 8b06c1c..1ffa596 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.h
@@ -38,6 +38,7 @@
     NSTrackingArea *_area;
 #endif
     BOOL _mouseIsInHUD;
+    BOOL _isEndingFullscreen;
 
     NSControl *_timeline;
     NSTextField *_remainingTimeText;
@@ -50,6 +51,7 @@
 - (void)fadeWindowIn;
 - (void)fadeWindowOut;
 - (void)closeWindow;
+- (void)updateRate;
 
 @end
 
diff --git a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
index 2edfccc..c61ae7c 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm
@@ -31,11 +31,16 @@
 #import "WebKitSystemInterface.h"
 #import "WebTypesInternal.h"
 #import <wtf/RetainPtr.h>
+#import <limits>
+
+using namespace std;
 
 #define HAVE_MEDIA_CONTROL (!defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD))
 
 @interface WebVideoFullscreenHUDWindowController (Private) <NSWindowDelegate>
 
+- (void)keyDown:(NSEvent *)event;
+
 - (void)updateTime;
 - (void)timelinePositionChanged:(id)sender;
 - (float)currentTime;
@@ -47,7 +52,7 @@
 - (double)volume;
 - (void)setVolume:(double)volume;
 
-- (void)playingChanged:(id)sender;
+- (void)togglePlaying:(id)sender;
 - (BOOL)playing;
 - (void)setPlaying:(BOOL)playing;
 
@@ -112,6 +117,23 @@
     [[self windowController] fadeWindowIn];
 }
 
+- (BOOL)resignFirstResponder
+{
+    return NO;
+}
+
+- (BOOL)performKeyEquivalent:(NSEvent *)event
+{
+    // Block all command key events while the fullscreen window is up.
+    if ([event type] != NSKeyDown)
+        return NO;
+    
+    if (!([event modifierFlags] & NSCommandKeyMask))
+        return NO;
+    
+    return YES;
+}
+
 @end
 
 //
@@ -162,11 +184,19 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 }
 #endif
 
+- (void)keyDown:(NSEvent *)event
+{
+    if ([[event characters] isEqualToString:@" "])
+        [_playButton performClick:self];
+    else
+        [super keyDown:event];
+}
+
 - (id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
 {
     return _delegate;
 }
-     
+
 - (void)setDelegate:(id<WebVideoFullscreenHUDWindowControllerDelegate>)delegate
 {
     _delegate = delegate;
@@ -178,6 +208,7 @@ static const NSTimeInterval HUDWindowFadeOutDelay = 3;
 
     // First, update right away, then schedule future update
     [self updateTime];
+    [self updateRate];
 
     [_timelineUpdateTimer invalidate];
     [_timelineUpdateTimer release];
@@ -311,7 +342,7 @@ static NSTextField *createTimeTextField(NSRect frame)
     CGFloat center = (windowWidth - kButtonSize) / 2;
     _playButton = createControlWithMediaUIControlType(WKMediaUIControlPlayPauseButton, NSMakeRect(center, top - kButtonSize, kButtonSize, kButtonSize));
     [_playButton setTarget:self];
-    [_playButton setAction:@selector(playingChanged:)];
+    [_playButton setAction:@selector(togglePlaying:)];
     [contentView addSubview:_playButton];
 
     CGFloat closeToRight = windowWidth - 2 * kMargin - kButtonMiniSize;
@@ -324,6 +355,8 @@ static NSTextField *createTimeTextField(NSRect frame)
     CGFloat left = kMargin;
     NSControl *volumeDownButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeDownButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
     [contentView addSubview:volumeDownButton];
+    [volumeDownButton setTarget:self];
+    [volumeDownButton setAction:@selector(decrementVolume:)];
     [volumeDownButton release];
 
     static const int volumeSliderWidth = 50;
@@ -336,9 +369,11 @@ static NSTextField *createTimeTextField(NSRect frame)
     [contentView addSubview:_volumeSlider];
 
     left = kMargin + kButtonMiniSize + volumeSliderWidth + kButtonMiniSize / 2;
-    NSControl *button = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
-    [contentView addSubview:button];
-    [button release];
+    NSControl *volumeUpButton = createControlWithMediaUIControlType(WKMediaUIControlVolumeUpButton, NSMakeRect(left, top - kButtonSize / 2 - kButtonMiniSize / 2, kButtonMiniSize, kButtonMiniSize));
+    [volumeUpButton setTarget:self];
+    [volumeUpButton setAction:@selector(incrementVolume:)];
+    [contentView addSubview:volumeUpButton];
+    [volumeUpButton release];
     
     static const int timeTextWidth = 50;
     static const int sliderHeight = 13;
@@ -426,6 +461,24 @@ static NSTextField *createTimeTextField(NSRect frame)
     [self setVolume:[_volumeSlider doubleValue]];
 }
 
+- (void)decrementVolume:(id)sender
+{
+    if (![_delegate mediaElement])
+        return;
+
+    double volume = [self volume] - 10;
+    [self setVolume:max(volume, 0.)];
+}
+
+- (void)incrementVolume:(id)sender
+{
+    if (![_delegate mediaElement])
+        return;
+
+    double volume = [self volume] + 10;
+    [self setVolume:min(volume, [self maxVolume])];
+}
+
 - (double)volume
 {
     return [_delegate mediaElement] ? [_delegate mediaElement]->volume() * [self maxVolume] : 0;
@@ -436,15 +489,23 @@ static NSTextField *createTimeTextField(NSRect frame)
     if (![_delegate mediaElement])
         return;
     WebCore::ExceptionCode e;
+    if ([_delegate mediaElement]->muted())
+        [_delegate mediaElement]->setMuted(false);
     [_delegate mediaElement]->setVolume(volume / [self maxVolume], e);
 }
 
-- (void)playingChanged:(id)sender
+- (void)updateRate
 {
-    [self setPlaying:![self playing]];
-    
+    [_playButton setIntValue:[self playing]];
+}
+
+- (void)togglePlaying:(id)sender
+{
+    BOOL nowPlaying = [self playing];
+    [self setPlaying:!nowPlaying];
+
     // Keep HUD visible when paused
-    if (![self playing])
+    if (!nowPlaying)
         [self fadeWindowIn];
     else if (!_mouseIsInHUD) {
         [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(fadeWindowOut) object:nil];
@@ -560,6 +621,9 @@ static NSString *stringToTimeTextAttributed(NSString *string, NSTextAlignment al
 
 - (void)exitFullscreen:(id)sender
 {
+    if (_isEndingFullscreen)
+        return;
+    _isEndingFullscreen = YES;
     [_delegate requestExitFullscreen]; 
 }
 
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 83c7e20..25da631 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -34,6 +34,7 @@
 #import "DOMNodeInternal.h"
 #import "DOMRangeInternal.h"
 #import "WebBackForwardListInternal.h"
+#import "WebBaseNetscapePluginView.h"
 #import "WebCache.h"
 #import "WebChromeClient.h"
 #import "WebContextMenuClient.h"
@@ -124,6 +125,7 @@
 #import <WebCore/PageGroup.h>
 #import <WebCore/PlatformMouseEvent.h>
 #import <WebCore/ProgressTracker.h>
+#import <WebCore/RenderWidget.h>
 #import <WebCore/ResourceHandle.h>
 #import <WebCore/RuntimeApplicationChecks.h>
 #import <WebCore/ScriptController.h>
@@ -158,12 +160,6 @@
 #import <WebKit/WebDashboardRegion.h>
 #endif
 
-@class NSTextInputContext;
-
-@interface NSResponder (WebNSResponderDetails)
-- (NSTextInputContext *)inputContext;
-@end
-
 @interface NSSpellChecker (WebNSSpellCheckerDetails)
 - (void)_preflightChosenSpellServer;
 @end
@@ -330,19 +326,10 @@ macro(yankAndSelect) \
 static BOOL s_didSetCacheModel;
 static WebCacheModel s_cacheModel = WebCacheModelDocumentViewer;
 
-static WebView *lastMouseoverView;
-
 #ifndef NDEBUG
 static const char webViewIsOpen[] = "At least one WebView is still open.";
 #endif
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-@interface NSObject (NSTextInputContextDetails)
-- (BOOL)wantsToHandleMouseEvents;
-- (BOOL)handleMouseEvent:(NSEvent *)event;
-@end
-#endif
-
 @interface NSObject (WebValidateWithoutDelegate)
 - (BOOL)validateUserInterfaceItemWithoutDelegate:(id <NSValidatedUserInterfaceItem>)item;
 @end
@@ -357,7 +344,6 @@ static const char webViewIsOpen[] = "At least one WebView is still open.";
 @end
 
 @interface WebView (WebFileInternal)
-- (WebFrame *)_selectedOrMainFrame;
 - (BOOL)_isLoading;
 - (WebFrameView *)_frameViewAtWindowPoint:(NSPoint)point;
 - (WebFrame *)_focusedFrame;
@@ -985,8 +971,7 @@ static bool fastDocumentTeardownEnabled()
     if (!_private || _private->closed)
         return;
 
-    if (lastMouseoverView == self)
-        lastMouseoverView = nil;
+    [self _closingEventHandling];
 
 #ifndef NDEBUG
     WTF::RefCountedLeakCounter::cancelMessageSuppression(webViewIsOpen);
@@ -1187,7 +1172,7 @@ static bool fastDocumentTeardownEnabled()
             // If this item is showing , save away its current scroll and form state,
             // since that might have changed since loading and it is normally not saved
             // until we leave that page.
-            otherView->_private->page->mainFrame()->loader()->saveDocumentAndScrollState();
+            otherView->_private->page->mainFrame()->loader()->history()->saveDocumentAndScrollState();
         }
         RefPtr<HistoryItem> newItem = otherBackForwardList->itemAtIndex(i)->copy();
         if (i == 0) 
@@ -1282,7 +1267,6 @@ static bool fastDocumentTeardownEnabled()
     settings->setDatabasesEnabled([preferences databasesEnabled]);
     settings->setLocalStorageEnabled([preferences localStorageEnabled]);
     settings->setExperimentalNotificationsEnabled([preferences experimentalNotificationsEnabled]);
-    settings->setExperimentalWebSocketsEnabled([preferences experimentalWebSocketsEnabled]);
     settings->setPrivateBrowsingEnabled([preferences privateBrowsingEnabled]);
     settings->setSansSerifFontFamily([preferences sansSerifFontFamily]);
     settings->setSerifFontFamily([preferences serifFontFamily]);
@@ -1317,7 +1301,6 @@ static bool fastDocumentTeardownEnabled()
     settings->setXSSAuditorEnabled([preferences isXSSAuditorEnabled]);
     settings->setEnforceCSSMIMETypeInStrictMode(!WKAppVersionCheckLessThan(@"com.apple.iWeb", -1, 2.1));
     settings->setAcceleratedCompositingEnabled([preferences acceleratedCompositingEnabled]);
-    settings->setPluginHalterEnabled([preferences pluginHalterEnabled]);
     settings->setPluginAllowedRunTime([preferences pluginAllowedRunTime]);
     settings->setWebGLEnabled([preferences webGLEnabled]);
 }
@@ -1421,6 +1404,7 @@ static inline IMP getMethod(id o, SEL s)
     cache->clientRedirectFunc = getMethod(delegate, @selector(webView:didPerformClientRedirectFromURL:toURL:inFrame:));
     cache->serverRedirectFunc = getMethod(delegate, @selector(webView:didPerformServerRedirectFromURL:toURL:inFrame:));
     cache->setTitleFunc = getMethod(delegate, @selector(webView:updateHistoryTitle:forURL:));
+    cache->populateVisitedLinksFunc = getMethod(delegate, @selector(populateVisitedLinksForWebView:));
 }
 
 - (id)_policyDelegateForwarder
@@ -2114,6 +2098,47 @@ static inline IMP getMethod(id o, SEL s)
 #endif
 }
 
+static WebBaseNetscapePluginView *_pluginViewForNode(DOMNode *node)
+{
+    if (!node)
+        return nil;
+    
+    Node* coreNode = core(node);
+    if (!coreNode)
+        return nil;
+    
+    RenderObject* renderer = coreNode->renderer();
+    if (!renderer || !renderer->isWidget())
+        return nil;
+    
+    Widget* widget = toRenderWidget(renderer)->widget();
+    if (!widget || !widget->platformWidget())
+        return nil;
+    
+    NSView *view = widget->platformWidget();
+    if (![view isKindOfClass:[WebBaseNetscapePluginView class]])
+        return nil;
+    
+    return (WebBaseNetscapePluginView *)view;
+}
+
++ (BOOL)_isNodeHaltedPlugin:(DOMNode *)node
+{
+    return [_pluginViewForNode(node) isHalted];
+}
+
++ (BOOL)_hasPluginForNodeBeenHalted:(DOMNode *)node
+{
+    return [_pluginViewForNode(node) hasBeenHalted];
+}
++ (void)_restartHaltedPluginForNode:(DOMNode *)node
+{
+    if (!node)
+        return;
+    
+    [_pluginViewForNode(node) resumeFromHalt];
+}
+
 - (NSPasteboard *)_insertionPasteboard
 {
     return _private ? _private->insertionPasteboard : nil;
@@ -2150,7 +2175,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     return patternsVector;
 }
 
-+ (void)_addUserScriptToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID 
++ (void)_addUserScriptToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url
                     whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime
 {
     String group(groupName);
@@ -2161,11 +2186,11 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
     
-    pageGroup->addUserScript(source, url, toStringVector(whitelist), toStringVector(blacklist), worldID, 
-                             injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
+    pageGroup->addUserScriptToWorld(worldID, source, url, toStringVector(whitelist), toStringVector(blacklist), 
+                                    injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
 }
 
-+ (void)_addUserStyleSheetToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url
                         whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist
 {
     String group(groupName);
@@ -2176,10 +2201,23 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->addUserStyleSheet(source, url, toStringVector(whitelist), toStringVector(blacklist), worldID);
+    pageGroup->addUserStyleSheetToWorld(worldID, source, url, toStringVector(whitelist), toStringVector(blacklist));
+}
+
++ (void)_removeUserScriptFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->removeUserScriptFromWorld(worldID, url);
 }
 
-+ (void)_removeUserContentFromGroup:(NSString *)groupName url:(NSURL *)url worldID:(unsigned)worldID
++ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2189,10 +2227,10 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserContentWithURLForWorld(url, worldID);
+    pageGroup->removeUserStyleSheetFromWorld(worldID, url);
 }
 
-+ (void)_removeUserContentFromGroup:(NSString *)groupName worldID:(unsigned)worldID
++ (void)_removeUserScriptsFromGroup:(NSString *)groupName worldID:(unsigned)worldID
 {
     String group(groupName);
     if (group.isEmpty())
@@ -2202,7 +2240,20 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!pageGroup)
         return;
 
-    pageGroup->removeUserContentForWorld(worldID);
+    pageGroup->removeUserScriptsFromWorld(worldID);
+}
+
++ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName worldID:(unsigned)worldID
+{
+    String group(groupName);
+    if (group.isEmpty())
+        return;
+    
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    if (!pageGroup)
+        return;
+
+    pageGroup->removeUserStyleSheetsFromWorld(worldID);
 }
 
 + (void)_removeAllUserContentFromGroup:(NSString *)groupName
@@ -3569,87 +3620,6 @@ static WebFrame *incrementFrame(WebFrame *frame, BOOL forward, BOOL wrapFlag)
     return [previousView previousValidKeyView];
 }
 
-- (void)mouseDown:(NSEvent *)event
-{
-    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
-    // do the same work in the usesDocumentViews case. We don't want to maintain two
-    // duplicate copies of this method.
-
-    if (_private->usesDocumentViews) {
-        [super mouseDown:event];
-        return;
-    }
-    
-    // There's a chance that responding to this event will run a nested event loop, and
-    // fetching a new event might release the old one. Retaining and then autoreleasing
-    // the current event prevents that from causing a problem inside WebKit or AppKit code.
-    [[event retain] autorelease];
-
-    RetainPtr<WebView> protector = self;
-    if ([[self inputContext] wantsToHandleMouseEvents] && [[self inputContext] handleMouseEvent:event])
-        return;
-
-    _private->handlingMouseDownEvent = YES;
-
-    // Record the mouse down position so we can determine drag hysteresis.
-    [self _setMouseDownEvent:event];
-
-    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
-    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
-        goto done;
-
-    [_private->completionController endRevertingChange:NO moveLeft:NO];
-
-    // If the web page handles the context menu event and menuForEvent: returns nil, we'll get control click events here.
-    // We don't want to pass them along to KHTML a second time.
-    if (!([event modifierFlags] & NSControlKeyMask)) {
-        _private->ignoringMouseDraggedEvents = NO;
-
-        // Don't do any mouseover while the mouse is down.
-        [self _cancelUpdateMouseoverTimer];
-
-        // Let WebCore get a chance to deal with the event. This will call back to us
-        // to start the autoscroll timer if appropriate.
-        if (Frame* frame = [self _mainCoreFrame])
-            frame->eventHandler()->mouseDown(event);
-    }
-
-done:
-    _private->handlingMouseDownEvent = NO;
-}
-
-- (void)mouseUp:(NSEvent *)event
-{
-    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
-    // do the same work in the usesDocumentViews case. We don't want to maintain two
-    // duplicate copies of this method.
-
-    if (_private->usesDocumentViews) {
-        [super mouseUp:event];
-        return;
-    }
-
-    // There's a chance that responding to this event will run a nested event loop, and
-    // fetching a new event might release the old one. Retaining and then autoreleasing
-    // the current event prevents that from causing a problem inside WebKit or AppKit code.
-    [[event retain] autorelease];
-
-    [self _setMouseDownEvent:nil];
-
-    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
-    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
-        return;
-
-    [self retain];
-
-    [self _stopAutoscrollTimer];
-    if (Frame* frame = [self _mainCoreFrame])
-        frame->eventHandler()->mouseUp(event);
-    [self _updateMouseoverWithFakeEvent];
-
-    [self release];
-}
-
 @end
 
 @implementation WebView (WebIBActions)
@@ -4051,9 +4021,8 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
         JSObject* object = jsValue.getObject();
         if (object->inherits(&DateInstance::info)) {
             DateInstance* date = static_cast<DateInstance*>(object);
-            double ms = 0;
-            int tzOffset = 0;
-            if (date->getTime(ms, tzOffset)) {
+            double ms = date->internalNumber();
+            if (!isnan(ms)) {
                 CFAbsoluteTime utcSeconds = ms / 1000 - kCFAbsoluteTimeIntervalSince1970;
                 LongDateTime ldt;
                 if (noErr == UCConvertCFAbsoluteTimeToLongDateTime(utcSeconds, &ldt))
@@ -4095,11 +4064,11 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
         return nil;
     if (!coreFrame->document())
         return nil;
-    JSValue result = coreFrame->loader()->executeScript(script, true).jsValue();
+    JSValue result = coreFrame->script()->executeScript(script, true).jsValue();
     if (!result) // FIXME: pass errors
         return 0;
     JSLock lock(SilenceAssertionsOnly);
-    return aeDescFromJSValue(coreFrame->script()->globalObject()->globalExec(), result);
+    return aeDescFromJSValue(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec(), result);
 }
 
 - (BOOL)canMarkAllTextMatches
@@ -4257,6 +4226,24 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
     return _private->page->mediaVolume();
 }
 
+- (void)addVisitedLinks:(NSArray *)visitedLinks
+{
+    PageGroup& group = core(self)->group();
+    
+    NSEnumerator *enumerator = [visitedLinks objectEnumerator];
+    while (NSString *url = [enumerator nextObject]) {
+        size_t length = [url length];
+        const UChar* characters = CFStringGetCharactersPtr(reinterpret_cast<CFStringRef>(url));
+        if (characters)
+            group.addVisitedLink(characters, length);
+        else {
+            Vector<UChar, 512> buffer(length);
+            [url getCharacters:buffer.data()];
+            group.addVisitedLink(buffer.data(), length);
+        }
+    }
+}
+
 @end
 
 @implementation WebView (WebViewPrintingPrivate)
@@ -5123,14 +5110,6 @@ static WebFrameView *containingFrameView(NSView *view)
     return nil;
 }
 
-- (WebFrame *)_selectedOrMainFrame
-{
-    WebFrame *result = [self selectedFrame];
-    if (result == nil)
-        result = [self mainFrame];
-    return result;
-}
-
 - (BOOL)_isLoading
 {
     WebFrame *mainFrame = [self mainFrame];
@@ -5401,102 +5380,6 @@ static WebFrameView *containingFrameView(NSView *view)
     _private->insertionPasteboard = pasteboard;
 }
 
-- (void)_setMouseDownEvent:(NSEvent *)event
-{
-    ASSERT(!event || [event type] == NSLeftMouseDown || [event type] == NSRightMouseDown || [event type] == NSOtherMouseDown);
-
-    if (event == _private->mouseDownEvent)
-        return;
-
-    [event retain];
-    [_private->mouseDownEvent release];
-    _private->mouseDownEvent = event;
-}
-
-- (void)_cancelUpdateMouseoverTimer
-{
-    if (_private->updateMouseoverTimer) {
-        CFRunLoopTimerInvalidate(_private->updateMouseoverTimer);
-        CFRelease(_private->updateMouseoverTimer);
-        _private->updateMouseoverTimer = NULL;
-    }
-}
-
-- (void)_stopAutoscrollTimer
-{
-    NSTimer *timer = _private->autoscrollTimer;
-    _private->autoscrollTimer = nil;
-    [_private->autoscrollTriggerEvent release];
-    _private->autoscrollTriggerEvent = nil;
-    [timer invalidate];
-    [timer release];
-}
-
-+ (void)_updateMouseoverWithEvent:(NSEvent *)event
-{
-    WebView *oldView = lastMouseoverView;
-
-    lastMouseoverView = nil;
-
-    NSView *contentView = [[event window] contentView];
-    NSPoint locationForHitTest = [[contentView superview] convertPoint:[event locationInWindow] fromView:nil];
-    for (NSView *hitView = [contentView hitTest:locationForHitTest]; hitView; hitView = [hitView superview]) {
-        if ([hitView isKindOfClass:[WebView class]]) {
-            lastMouseoverView = static_cast<WebView *>(hitView);
-            break;
-        }
-    }
-
-    if (lastMouseoverView && lastMouseoverView->_private->hoverFeedbackSuspended)
-        lastMouseoverView = nil;
-
-    if (lastMouseoverView != oldView) {
-        if (Frame* oldCoreFrame = [oldView _mainCoreFrame]) {
-            NSEvent *oldViewEvent = [NSEvent mouseEventWithType:NSMouseMoved
-                location:NSMakePoint(-1, -1)
-                modifierFlags:[[NSApp currentEvent] modifierFlags]
-                timestamp:[NSDate timeIntervalSinceReferenceDate]
-                windowNumber:[[oldView window] windowNumber]
-                context:[[NSApp currentEvent] context]
-                eventNumber:0 clickCount:0 pressure:0];
-            oldCoreFrame->eventHandler()->mouseMoved(oldViewEvent);
-        }
-    }
-
-    if (!lastMouseoverView)
-        return;
-
-    if (Frame* coreFrame = core([lastMouseoverView mainFrame]))
-        coreFrame->eventHandler()->mouseMoved(event);
-}
-
-- (void)_updateMouseoverWithFakeEvent
-{
-    [self _cancelUpdateMouseoverTimer];
-    
-    NSEvent *fakeEvent = [NSEvent mouseEventWithType:NSMouseMoved
-        location:[[self window] convertScreenToBase:[NSEvent mouseLocation]]
-        modifierFlags:[[NSApp currentEvent] modifierFlags]
-        timestamp:[NSDate timeIntervalSinceReferenceDate]
-        windowNumber:[[self window] windowNumber]
-        context:[[NSApp currentEvent] context]
-        eventNumber:0 clickCount:0 pressure:0];
-    
-    [[self class] _updateMouseoverWithEvent:fakeEvent];
-}
-
-- (void)_setToolTip:(NSString *)toolTip
-{
-    if (_private->usesDocumentViews) {
-        id documentView = [[[self _selectedOrMainFrame] frameView] documentView];
-        if ([documentView isKindOfClass:[WebHTMLView class]])
-            [documentView _setToolTip:toolTip];
-        return;
-    }
-
-    // FIXME (Viewless): Code to handle tooltips needs to move into WebView.
-}
-
 - (void)_selectionChanged
 {
     if (_private->usesDocumentViews) {
@@ -5514,6 +5397,14 @@ static WebFrameView *containingFrameView(NSView *view)
     return (_private && _private->page) ? _private->page->mainFrame() : 0;
 }
 
+- (WebFrame *)_selectedOrMainFrame
+{
+    WebFrame *result = [self selectedFrame];
+    if (result == nil)
+        result = [self mainFrame];
+    return result;
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 
 - (BOOL)_needsOneShotDrawingSynchronization
@@ -5653,6 +5544,8 @@ static void layerSyncRunLoopObserverCallBack(CFRunLoopObserverRef, CFRunLoopActi
 
 - (void)_exitFullscreen
 {
+    if (!_private->fullscreenController)
+        return;
     [_private->fullscreenController exitFullscreen];
     [_private->fullscreenController release];
     _private->fullscreenController = nil;
diff --git a/WebKit/mac/WebView/WebViewEventHandling.mm b/WebKit/mac/WebView/WebViewEventHandling.mm
new file mode 100644
index 0000000..a185667
--- /dev/null
+++ b/WebKit/mac/WebView/WebViewEventHandling.mm
@@ -0,0 +1,240 @@
+/*
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 David Smith (catfish.man@gmail.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebViewInternal.h"
+
+#import "WebFrameInternal.h"
+#import "WebHTMLView.h"
+#import "WebTextCompletionController.h"
+#import "WebViewData.h"
+#import <WebCore/Frame.h>
+
+using namespace WebCore;
+
+@class NSTextInputContext;
+
+@interface NSResponder (WebNSResponderDetails)
+- (NSTextInputContext *)inputContext;
+@end
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+@interface NSObject (NSTextInputContextDetails)
+- (BOOL)wantsToHandleMouseEvents;
+- (BOOL)handleMouseEvent:(NSEvent *)event;
+@end
+#endif
+
+@implementation WebView (WebViewEventHandling)
+
+static WebView *lastMouseoverView;
+
+- (void)_closingEventHandling
+{
+    if (lastMouseoverView == self)
+        lastMouseoverView = nil;
+}
+
+- (void)_setMouseDownEvent:(NSEvent *)event
+{
+    ASSERT(!event || [event type] == NSLeftMouseDown || [event type] == NSRightMouseDown || [event type] == NSOtherMouseDown);
+
+    if (event == _private->mouseDownEvent)
+        return;
+
+    [event retain];
+    [_private->mouseDownEvent release];
+    _private->mouseDownEvent = event;
+}
+
+- (void)mouseDown:(NSEvent *)event
+{
+    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
+    // do the same work in the usesDocumentViews case. We don't want to maintain two
+    // duplicate copies of this method.
+
+    if (_private->usesDocumentViews) {
+        [super mouseDown:event];
+        return;
+    }
+    
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[event retain] autorelease];
+
+    RetainPtr<WebView> protector = self;
+    if ([[self inputContext] wantsToHandleMouseEvents] && [[self inputContext] handleMouseEvent:event])
+        return;
+
+    _private->handlingMouseDownEvent = YES;
+
+    // Record the mouse down position so we can determine drag hysteresis.
+    [self _setMouseDownEvent:event];
+
+    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
+    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
+        goto done;
+
+    [_private->completionController endRevertingChange:NO moveLeft:NO];
+
+    // If the web page handles the context menu event and menuForEvent: returns nil, we'll get control click events here.
+    // We don't want to pass them along to KHTML a second time.
+    if (!([event modifierFlags] & NSControlKeyMask)) {
+        _private->ignoringMouseDraggedEvents = NO;
+
+        // Don't do any mouseover while the mouse is down.
+        [self _cancelUpdateMouseoverTimer];
+
+        // Let WebCore get a chance to deal with the event. This will call back to us
+        // to start the autoscroll timer if appropriate.
+        if (Frame* frame = [self _mainCoreFrame])
+            frame->eventHandler()->mouseDown(event);
+    }
+
+done:
+    _private->handlingMouseDownEvent = NO;
+}
+
+- (void)mouseUp:(NSEvent *)event
+{
+    // FIXME (Viewless): This method should be shared with WebHTMLView, which needs to
+    // do the same work in the usesDocumentViews case. We don't want to maintain two
+    // duplicate copies of this method.
+
+    if (_private->usesDocumentViews) {
+        [super mouseUp:event];
+        return;
+    }
+
+    // There's a chance that responding to this event will run a nested event loop, and
+    // fetching a new event might release the old one. Retaining and then autoreleasing
+    // the current event prevents that from causing a problem inside WebKit or AppKit code.
+    [[event retain] autorelease];
+
+    [self _setMouseDownEvent:nil];
+
+    NSInputManager *currentInputManager = [NSInputManager currentInputManager];
+    if ([currentInputManager wantsToHandleMouseEvents] && [currentInputManager handleMouseEvent:event])
+        return;
+
+    [self retain];
+
+    [self _stopAutoscrollTimer];
+    if (Frame* frame = [self _mainCoreFrame])
+        frame->eventHandler()->mouseUp(event);
+    [self _updateMouseoverWithFakeEvent];
+
+    [self release];
+}
+
++ (void)_updateMouseoverWithEvent:(NSEvent *)event
+{
+    WebView *oldView = lastMouseoverView;
+
+    lastMouseoverView = nil;
+
+    NSView *contentView = [[event window] contentView];
+    NSPoint locationForHitTest = [[contentView superview] convertPoint:[event locationInWindow] fromView:nil];
+    for (NSView *hitView = [contentView hitTest:locationForHitTest]; hitView; hitView = [hitView superview]) {
+        if ([hitView isKindOfClass:[WebView class]]) {
+            lastMouseoverView = static_cast<WebView *>(hitView);
+            break;
+        }
+    }
+
+    if (lastMouseoverView && lastMouseoverView->_private->hoverFeedbackSuspended)
+        lastMouseoverView = nil;
+
+    if (lastMouseoverView != oldView) {
+        if (Frame* oldCoreFrame = [oldView _mainCoreFrame]) {
+            NSEvent *oldViewEvent = [NSEvent mouseEventWithType:NSMouseMoved
+                location:NSMakePoint(-1, -1)
+                modifierFlags:[[NSApp currentEvent] modifierFlags]
+                timestamp:[NSDate timeIntervalSinceReferenceDate]
+                windowNumber:[[oldView window] windowNumber]
+                context:[[NSApp currentEvent] context]
+                eventNumber:0 clickCount:0 pressure:0];
+            oldCoreFrame->eventHandler()->mouseMoved(oldViewEvent);
+        }
+    }
+
+    if (!lastMouseoverView)
+        return;
+
+    if (Frame* coreFrame = core([lastMouseoverView mainFrame]))
+        coreFrame->eventHandler()->mouseMoved(event);
+}
+
+- (void)_updateMouseoverWithFakeEvent
+{
+    [self _cancelUpdateMouseoverTimer];
+    
+    NSEvent *fakeEvent = [NSEvent mouseEventWithType:NSMouseMoved
+        location:[[self window] convertScreenToBase:[NSEvent mouseLocation]]
+        modifierFlags:[[NSApp currentEvent] modifierFlags]
+        timestamp:[NSDate timeIntervalSinceReferenceDate]
+        windowNumber:[[self window] windowNumber]
+        context:[[NSApp currentEvent] context]
+        eventNumber:0 clickCount:0 pressure:0];
+    
+    [[self class] _updateMouseoverWithEvent:fakeEvent];
+}
+
+- (void)_cancelUpdateMouseoverTimer
+{
+    if (_private->updateMouseoverTimer) {
+        CFRunLoopTimerInvalidate(_private->updateMouseoverTimer);
+        CFRelease(_private->updateMouseoverTimer);
+        _private->updateMouseoverTimer = NULL;
+    }
+}
+
+- (void)_stopAutoscrollTimer
+{
+    NSTimer *timer = _private->autoscrollTimer;
+    _private->autoscrollTimer = nil;
+    [_private->autoscrollTriggerEvent release];
+    _private->autoscrollTriggerEvent = nil;
+    [timer invalidate];
+    [timer release];
+}
+
+- (void)_setToolTip:(NSString *)toolTip
+{
+    if (_private->usesDocumentViews) {
+        id documentView = [[[self _selectedOrMainFrame] frameView] documentView];
+        if ([documentView isKindOfClass:[WebHTMLView class]])
+            [documentView _setToolTip:toolTip];
+        return;
+    }
+
+    // FIXME (Viewless): Code to handle tooltips needs to move into WebView.
+}
+
+@end
diff --git a/WebKit/mac/WebView/WebViewInternal.h b/WebKit/mac/WebView/WebViewInternal.h
index 521aeee..15596db 100644
--- a/WebKit/mac/WebView/WebViewInternal.h
+++ b/WebKit/mac/WebView/WebViewInternal.h
@@ -65,6 +65,7 @@ namespace WebCore {
 @interface WebView (WebViewInternal)
 
 - (WebCore::Frame*)_mainCoreFrame;
+- (WebFrame *)_selectedOrMainFrame;
 
 - (WebCore::String)_userAgentForURL:(const WebCore::KURL&)url;
 - (WebCore::KeyboardUIMode)_keyboardUIMode;
@@ -76,12 +77,7 @@ namespace WebCore {
 - (void)_dispatchDidReceiveIconFromWebFrame:(WebFrame *)webFrame;
 #endif
 
-- (void)_setMouseDownEvent:(NSEvent *)event;
-- (void)_cancelUpdateMouseoverTimer;
-- (void)_stopAutoscrollTimer;
-- (void)_updateMouseoverWithFakeEvent;
 - (void)_selectionChanged;
-- (void)_setToolTip:(NSString *)toolTip;
 
 #if USE(ACCELERATED_COMPOSITING)
 - (BOOL)_needsOneShotDrawingSynchronization;
@@ -95,6 +91,14 @@ namespace WebCore {
 
 #endif
 
+@interface WebView (WebViewEventHandling)
+- (void)_closingEventHandling;
+- (void)_updateMouseoverWithFakeEvent;
+- (void)_cancelUpdateMouseoverTimer;
+- (void)_stopAutoscrollTimer;
+- (void)_setToolTip:(NSString *)toolTip;
+@end
+
 // FIXME: Temporary way to expose methods that are in the wrong category inside WebView.
 @interface WebView (WebViewOtherInternal)
 
diff --git a/WebKit/mac/WebView/WebViewPrivate.h b/WebKit/mac/WebView/WebViewPrivate.h
index fa5d28c..99bd5fa 100644
--- a/WebKit/mac/WebView/WebViewPrivate.h
+++ b/WebKit/mac/WebView/WebViewPrivate.h
@@ -200,6 +200,9 @@ typedef enum {
 - (void)setMediaVolume:(float)volume;
 - (float)mediaVolume;
 
+// Add visited links
+- (void)addVisitedLinks:(NSArray *)visitedLinks;
+
 @end
 
 @interface WebView (WebPrivate)
@@ -459,6 +462,11 @@ Could be worth adding to the API.
 // SPI for DumpRenderTree
 - (BOOL)_isUsingAcceleratedCompositing;
 
+// SPI for PluginHalter
++ (BOOL)_isNodeHaltedPlugin:(DOMNode *)node;
++ (BOOL)_hasPluginForNodeBeenHalted:(DOMNode *)node;
++ (void)_restartHaltedPluginForNode:(DOMNode *)node;
+
 // Which pasteboard text is coming from in editing delegate methods such as shouldInsertNode.
 - (NSPasteboard *)_insertionPasteboard;
 
@@ -471,10 +479,12 @@ Could be worth adding to the API.
 // Removes all white list entries created with _whiteListAccessFromOrigin.
 + (void)_resetOriginAccessWhiteLists;
 
-+ (void)_addUserScriptToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
-+ (void)_addUserStyleSheetToGroup:(NSString *)groupName source:(NSString *)source url:(NSURL *)url worldID:(unsigned)worldID whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
-+ (void)_removeUserContentFromGroup:(NSString *)groupName url:(NSURL *)url worldID:(unsigned)worldID;
-+ (void)_removeUserContentFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
++ (void)_addUserScriptToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist injectionTime:(WebUserScriptInjectionTime)injectionTime;
++ (void)_addUserStyleSheetToGroup:(NSString *)groupName worldID:(unsigned)worldID source:(NSString *)source url:(NSURL *)url whitelist:(NSArray *)whitelist blacklist:(NSArray *)blacklist;
++ (void)_removeUserScriptFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url;
++ (void)_removeUserStyleSheetFromGroup:(NSString *)groupName worldID:(unsigned)worldID url:(NSURL *)url;
++ (void)_removeUserScriptsFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
++ (void)_removeUserStyleSheetsFromGroup:(NSString *)groupName worldID:(unsigned)worldID;
 + (void)_removeAllUserContentFromGroup:(NSString *)groupName;
 
 /*!
diff --git a/WebKit/mac/WebView/WebWindowAnimation.h b/WebKit/mac/WebView/WebWindowAnimation.h
index c73dcce..ecf975b 100644
--- a/WebKit/mac/WebView/WebWindowAnimation.h
+++ b/WebKit/mac/WebView/WebWindowAnimation.h
@@ -46,7 +46,7 @@
 @interface WebWindowFadeAnimation : NSAnimation {
 @private
     CGFloat _initialAlpha, _finalAlpha;
-    NSWindow *_window; // (retain)
+    NSWindow *_window; // (assign)
     BOOL _isStopped;
     
 }
diff --git a/WebKit/mac/WebView/WebWindowAnimation.m b/WebKit/mac/WebView/WebWindowAnimation.m
index 3ab64bf..6eadb21 100644
--- a/WebKit/mac/WebView/WebWindowAnimation.m
+++ b/WebKit/mac/WebView/WebWindowAnimation.m
@@ -80,7 +80,6 @@ static CGFloat squaredDistance(NSPoint point1, NSPoint point2)
 
 - (void) dealloc
 {
-    [_window release];
     [_subAnimation release];
     [super dealloc];
 }
diff --git a/WebKit/qt/Api/qgraphicswebview.cpp b/WebKit/qt/Api/qgraphicswebview.cpp
index c267745..50a0986 100644
--- a/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/WebKit/qt/Api/qgraphicswebview.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -44,14 +45,19 @@ public:
 
     virtual void scroll(int dx, int dy, const QRect&);
     virtual void update(const QRect& dirtyRect);
+    virtual void setInputMethodEnabled(bool enable);
+#if QT_VERSION >= 0x040600
+    virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
+#endif
 
 #ifndef QT_NO_CURSOR
     virtual QCursor cursor() const;
     virtual void updateCursor(const QCursor& cursor);
 #endif
 
+    virtual QPalette palette() const;
     virtual int screenNumber() const;
-    virtual WId winId() const;
+    virtual QWidget* ownerWidget() const;
 
     virtual QObject* pluginParent() const;
 
@@ -96,6 +102,20 @@ void QGraphicsWebViewPrivate::update(const QRect & dirtyRect)
     q->update(QRectF(dirtyRect));
 }
 
+
+void QGraphicsWebViewPrivate::setInputMethodEnabled(bool enable)
+{
+    q->setAttribute(Qt::WA_InputMethodEnabled, enable);
+}
+#if QT_VERSION >= 0x040600
+void QGraphicsWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
+{
+    if (enable)
+        q->setInputMethodHints(q->inputMethodHints() | hint);
+    else
+        q->setInputMethodHints(q->inputMethodHints() & ~hint);
+}
+#endif
 #ifndef QT_NO_CURSOR
 QCursor QGraphicsWebViewPrivate::cursor() const
 {
@@ -108,6 +128,11 @@ void QGraphicsWebViewPrivate::updateCursor(const QCursor& cursor)
 }
 #endif
 
+QPalette QGraphicsWebViewPrivate::palette() const
+{
+    return q->palette();
+}
+
 int QGraphicsWebViewPrivate::screenNumber() const
 {
 #if defined(Q_WS_X11)
@@ -120,14 +145,10 @@ int QGraphicsWebViewPrivate::screenNumber() const
     return 0;
 }
 
-WId QGraphicsWebViewPrivate::winId() const
+QWidget* QGraphicsWebViewPrivate::ownerWidget() const
 {
     const QList<QGraphicsView*> views = q->scene()->views();
-
-    if (!views.isEmpty())
-        return views.at(0)->winId();
-
-    return 0;
+    return views.value(0);
 }
 
 QObject* QGraphicsWebViewPrivate::pluginParent() const
@@ -174,8 +195,14 @@ QGraphicsWebView::QGraphicsWebView(QGraphicsItem* parent)
 */
 QGraphicsWebView::~QGraphicsWebView()
 {
-    if (d->page)
+    if (d->page) {
+#if QT_VERSION >= 0x040600
+        d->page->d->view.clear();
+#else
         d->page->d->view = 0;
+#endif
+        d->page->d->client = 0; // unset the page client
+    }
 
     if (d->page && d->page->parent() == this)
         delete d->page;
@@ -223,26 +250,65 @@ bool QGraphicsWebView::sceneEvent(QEvent* event)
 
 /*! \reimp
 */
+QVariant QGraphicsWebView::itemChange(GraphicsItemChange change, const QVariant& value)
+{
+    switch (change) {
+    // Differently from QWebView, it is interesting to QGraphicsWebView to handle
+    // post mouse cursor change notifications. Reason: 'ItemCursorChange' is sent
+    // as the first action in QGraphicsItem::setCursor implementation, and at that
+    // item widget's cursor has not been effectively changed yet.
+    // After cursor is properly set (at 'ItemCursorHasChanged' emission time), we
+    // fire 'CursorChange'.
+    case ItemCursorChange:
+        return value;
+    case ItemCursorHasChanged:
+        QEvent event(QEvent::CursorChange);
+        QApplication::sendEvent(this, &event);
+        return value;
+    }
+
+    return QGraphicsWidget::itemChange(change, value);
+}
+
+/*! \reimp
+*/
 bool QGraphicsWebView::event(QEvent* event)
 {
     // Re-implemented in order to allows fixing event-related bugs in patch releases.
 
     if (d->page) {
+#ifndef QT_NO_CONTEXTMENU
+        if (event->type() == QEvent::GraphicsSceneContextMenu) {
+            if (!isEnabled())
+                return false;
+
+            QGraphicsSceneContextMenuEvent* ev = static_cast<QGraphicsSceneContextMenuEvent*>(event);
+            QContextMenuEvent fakeEvent(QContextMenuEvent::Reason(ev->reason()), ev->pos().toPoint());
+            if (d->page->swallowContextMenuEvent(&fakeEvent)) {
+                event->accept();
+                return true;
+            }
+            d->page->updatePositionDependentActions(fakeEvent.pos());
+        } else
+#endif // QT_NO_CONTEXTMENU
+        {
 #ifndef QT_NO_CURSOR
 #if QT_VERSION >= 0x040400
-        } else if (event->type() == QEvent::CursorChange) {
-            // An unsetCursor will set the cursor to Qt::ArrowCursor.
-            // Thus this cursor change might be a QWidget::unsetCursor()
-            // If this is not the case and it came from WebCore, the
-            // QWebPageClient already has set its cursor internally
-            // to Qt::ArrowCursor, so updating the cursor is always
-            // right, as it falls back to the last cursor set by
-            // WebCore.
-            // FIXME: Add a QEvent::CursorUnset or similar to Qt.
-            if (cursor().shape() == Qt::ArrowCursor)
-                d->resetCursor();
+            if (event->type() == QEvent::CursorChange) {
+                // An unsetCursor will set the cursor to Qt::ArrowCursor.
+                // Thus this cursor change might be a QWidget::unsetCursor()
+                // If this is not the case and it came from WebCore, the
+                // QWebPageClient already has set its cursor internally
+                // to Qt::ArrowCursor, so updating the cursor is always
+                // right, as it falls back to the last cursor set by
+                // WebCore.
+                // FIXME: Add a QEvent::CursorUnset or similar to Qt.
+                if (cursor().shape() == Qt::ArrowCursor)
+                    d->resetCursor();
+            }
 #endif
 #endif
+        }
     }
     return QGraphicsWidget::event(event);
 }
@@ -597,7 +663,6 @@ void QGraphicsWebView::hoverMoveEvent(QGraphicsSceneHoverEvent* ev)
         QMouseEvent me = QMouseEvent(QEvent::MouseMove,
                 ev->pos().toPoint(), Qt::NoButton,
                 Qt::NoButton, Qt::NoModifier);
-        d->page->setView(ev->widget());
         d->page->event(&me);
         ev->setAccepted(accepted);
     }
diff --git a/WebKit/qt/Api/qgraphicswebview.h b/WebKit/qt/Api/qgraphicswebview.h
index 26f7374..43cf59a 100644
--- a/WebKit/qt/Api/qgraphicswebview.h
+++ b/WebKit/qt/Api/qgraphicswebview.h
@@ -85,6 +85,7 @@ public:
     virtual void setGeometry(const QRectF& rect);
     virtual void updateGeometry();
     virtual void paint(QPainter*, const QStyleOptionGraphicsItem* options, QWidget* widget = 0);
+    virtual QVariant itemChange(GraphicsItemChange change, const QVariant& value);
     virtual bool event(QEvent*);
 
 public Q_SLOTS:
diff --git a/WebKit/qt/Api/qwebelement.cpp b/WebKit/qt/Api/qwebelement.cpp
index 939d881..6305d10 100644
--- a/WebKit/qt/Api/qwebelement.cpp
+++ b/WebKit/qt/Api/qwebelement.cpp
@@ -30,12 +30,14 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "FrameView.h"
+#include "GraphicsContext.h"
 #include "HTMLElement.h"
 #include "JSGlobalObject.h"
 #include "JSHTMLElement.h"
 #include "JSObject.h"
 #include "NodeList.h"
 #include "PropertyNameArray.h"
+#include "RenderImage.h"
 #include "ScriptFunctionCall.h"
 #include "StaticNodeList.h"
 #include "qt_runtime.h"
@@ -45,6 +47,8 @@
 #include <parser/SourceCode.h>
 #include <wtf/Vector.h>
 
+#include <QPainter>
+
 using namespace WebCore;
 
 class QWebElementPrivate {
@@ -198,23 +202,9 @@ bool QWebElement::isNull() const
 
     \sa findFirst()
 */
-QList<QWebElement> QWebElement::findAll(const QString &selectorQuery) const
+QWebElementCollection QWebElement::findAll(const QString &selectorQuery) const
 {
-    QList<QWebElement> elements;
-    if (!m_element)
-        return elements;
-
-    ExceptionCode exception = 0; // ###
-    RefPtr<NodeList> nodes = m_element->querySelectorAll(selectorQuery, exception);
-    if (!nodes)
-        return elements;
-
-    for (unsigned i = 0; i < nodes->length(); ++i) {
-        WebCore::Node* n = nodes->item(i);
-        elements.append(QWebElement(static_cast<Element*>(n)));
-    }
-
-    return elements;
+    return QWebElementCollection(*this, selectorQuery);
 }
 
 /*!
@@ -678,7 +668,7 @@ static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValu
     if (!scriptController)
         return false;
 
-    state = scriptController->globalObject()->globalExec();
+    state = scriptController->globalObject(mainThreadNormalWorld())->globalExec();
     if (!state)
         return false;
 
@@ -1133,7 +1123,7 @@ QWebElement QWebElement::clone() const
     The element is still valid after removal, and can be inserted into other
     parts of the document.
 
-    \sa removeChildren(), removeFromDocument()
+    \sa removeAllChildren(), removeFromDocument()
 */
 QWebElement &QWebElement::takeFromDocument()
 {
@@ -1149,7 +1139,7 @@ QWebElement &QWebElement::takeFromDocument()
 /*!
     Removes this element from the document and makes it a null element.
 
-    \sa removeChildren(), takeFromDocument()
+    \sa removeAllChildren(), takeFromDocument()
 */
 void QWebElement::removeFromDocument()
 {
@@ -1167,7 +1157,7 @@ void QWebElement::removeFromDocument()
 
     \sa removeFromDocument(), takeFromDocument()
 */
-void QWebElement::removeChildren()
+void QWebElement::removeAllChildren()
 {
     if (!m_element)
         return;
@@ -1411,3 +1401,426 @@ QWebElement QWebElement::enclosingElement(WebCore::Node* node)
     Returns true if this element points to a different underlying DOM object
     than \a o; otherwise returns false.
 */
+
+
+/*! 
+  Render the element into \a painter .
+*/
+void QWebElement::render(QPainter* painter)
+{
+    WebCore::Element* e = m_element;
+    Document* doc = e ? e->document() : 0;
+    if (!doc)
+        return;
+
+    Frame* frame = doc->frame();
+    if (!frame || !frame->view() || !frame->contentRenderer())
+        return;
+
+    FrameView* view = frame->view();
+
+    view->layoutIfNeededRecursive();
+
+    IntRect rect = e->getRect();
+
+    if (rect.size().isEmpty())
+        return;
+
+    GraphicsContext context(painter);
+
+    context.save();
+    context.translate(-rect.x(), -rect.y());
+    view->setNodeToDraw(e);
+    view->paintContents(&context, rect);
+    view->setNodeToDraw(0);
+    context.restore();
+}
+
+class QWebElementCollectionPrivate : public QSharedData
+{
+public:
+    static QWebElementCollectionPrivate* create(const PassRefPtr<Node> &context, const QString &query);
+
+    RefPtr<NodeList> m_result;
+
+private:
+    inline QWebElementCollectionPrivate() {}
+};
+
+QWebElementCollectionPrivate* QWebElementCollectionPrivate::create(const PassRefPtr<Node> &context, const QString &query)
+{
+    if (!context)
+        return 0;
+
+    // Let WebKit do the hard work hehehe
+    ExceptionCode exception = 0; // ###
+    RefPtr<NodeList> nodes = context->querySelectorAll(query, exception);
+    if (!nodes)
+        return 0;
+
+    QWebElementCollectionPrivate* priv = new QWebElementCollectionPrivate;
+    priv->m_result = nodes;
+    return priv;
+}
+
+/*!
+    \class QWebElementCollection
+    \since 4.6
+    \brief The QWebElementCollection class represents a collection of web elements.
+    \preliminary
+
+    Elements in a document can be selected using QWebElement::findAll() or using the
+    QWebElement constructor. The collection is composed by choosing all elements in the
+    document that match a specified CSS selector expression.
+
+    The number of selected elements is provided through the count() property. Individual
+    elements can be retrieved by index using at().
+
+    It is also possible to iterate through all elements in the collection using Qt's foreach
+    macro:
+
+    \code
+        QWebElementCollection collection = document.findAll("p");
+        foreach (QWebElement paraElement, collection) {
+            ...
+        }
+    \endcode
+*/
+
+/*!
+    Constructs an empty collection.
+*/
+QWebElementCollection::QWebElementCollection()
+{
+}
+
+/*!
+    Constructs a copy of \a other.
+*/
+QWebElementCollection::QWebElementCollection(const QWebElementCollection &other)
+    : d(other.d)
+{
+}
+
+/*!
+    Constructs a collection of elements from the list of child elements of \a contextElement that
+    match the specified CSS selector \a query.
+*/
+QWebElementCollection::QWebElementCollection(const QWebElement &contextElement, const QString &query)
+{
+    d = QExplicitlySharedDataPointer<QWebElementCollectionPrivate>(QWebElementCollectionPrivate::create(contextElement.m_element, query));
+}
+
+/*!
+    Assigns \a other to this collection and returns a reference to this collection.
+*/
+QWebElementCollection &QWebElementCollection::operator=(const QWebElementCollection &other)
+{
+    d = other.d;
+    return *this;
+}
+
+/*!
+    Destroys the collection.
+*/
+QWebElementCollection::~QWebElementCollection()
+{
+}
+
+/*! \fn QWebElementCollection &QWebElementCollection::operator+=(const QWebElementCollection &other)
+
+    Appends the items of the \a other list to this list and returns a
+    reference to this list.
+
+    \sa operator+(), append()
+*/
+
+/*!
+    Returns a collection that contains all the elements of this collection followed
+    by all the elements in the \a other collection. Duplicates may occur in the result.
+
+    \sa operator+=()
+*/
+QWebElementCollection QWebElementCollection::operator+(const QWebElementCollection &other) const
+{
+    QWebElementCollection n = *this; n.d.detach(); n += other; return n;
+}
+
+/*!
+    Extends the collection by appending all items of \a other.
+
+    The resulting collection may include duplicate elements.
+
+    \sa operator+=()
+*/
+void QWebElementCollection::append(const QWebElementCollection &other)
+{
+    if (!d) {
+        *this = other;
+        return;
+    }
+    if (!other.d)
+        return;
+    Vector<RefPtr<Node> > nodes;
+    RefPtr<NodeList> results[] = { d->m_result, other.d->m_result };
+    nodes.reserveInitialCapacity(results[0]->length() + results[1]->length());
+
+    for (int i = 0; i < 2; ++i) {
+        int j = 0;
+        Node* n = results[i]->item(j);
+        while (n) {
+            nodes.append(n);
+            n = results[i]->item(++j);
+        }
+    }
+
+    d->m_result = StaticNodeList::adopt(nodes);
+}
+
+/*!
+    Returns the number of elements in the collection.
+*/
+int QWebElementCollection::count() const
+{
+    if (!d)
+        return 0;
+    return d->m_result->length();
+}
+
+/*!
+    Returns the element at index position \a i in the collection.
+*/
+QWebElement QWebElementCollection::at(int i) const
+{
+    if (!d)
+        return QWebElement();
+    Node* n = d->m_result->item(i);
+    return QWebElement(static_cast<Element*>(n));
+}
+
+/*!
+    \fn const QWebElement QWebElementCollection::operator[](int position) const
+
+    Returns the element at the specified \a position in the collection.
+*/
+
+/*! \fn QWebElement QWebElementCollection::first() const
+
+    Returns the first element in the collection.
+
+    \sa last(), operator[](), at(), count()
+*/
+
+/*! \fn QWebElement QWebElementCollection::last() const
+
+    Returns the last element in the collection.
+
+    \sa first(), operator[](), at(), count()
+*/
+
+/*!
+    Returns a QList object with the elements contained in this collection.
+*/
+QList<QWebElement> QWebElementCollection::toList() const
+{
+    if (!d)
+        return QList<QWebElement>();
+    QList<QWebElement> elements;
+    int i = 0;
+    Node* n = d->m_result->item(i);
+    while (n) {
+        if (n->isElementNode())
+            elements.append(QWebElement(static_cast<Element*>(n)));
+        n = d->m_result->item(++i);
+    }
+    return elements;
+}
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::begin() const
+
+    Returns an STL-style iterator pointing to the first element in the collection.
+
+    \sa end()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::end() const
+
+    Returns an STL-style iterator pointing to the imaginary element after the
+    last element in the list.
+
+    \sa begin()
+*/
+
+/*!
+    \class QWebElementCollection::const_iterator
+    \since 4.6
+    \brief The QWebElementCollection::const_iterator class provides an STL-style const iterator for QWebElementCollection.
+
+    QWebElementCollection provides STL style const iterators for fast low-level access to the elements.
+
+    QWebElementCollection::const_iterator allows you to iterate over a QWebElementCollection.
+
+    The default QWebElementCollection::const_iterator constructors creates an uninitialized iterator. You must initialize
+    it using a QWebElementCollection function like QWebElementCollection::begin() or QWebElementCollection::end() before you
+    can start iterating.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator::const_iterator()
+
+    Constructs an uninitialized iterator.
+
+    Functions like operator*() and operator++() should not be called on
+    an uninitialized iterator. Use operator=() to assign a value
+    to it before using it.
+
+    \sa QWebElementCollection::begin()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator::const_iterator(const const_iterator &other)
+
+    Constructs a copy of \a other.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator::const_iterator(const QWebElementCollection *collection, int index)
+    \internal
+*/
+
+/*!
+    \fn const QWebElement QWebElementCollection::const_iterator::operator*() const
+
+    Returns the current element.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator==(const const_iterator &other) const
+
+    Returns true if \a other points to the same item as this iterator;
+    otherwise returns false.
+
+    \sa operator!=()
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator!=(const const_iterator &other) const
+
+    Returns true if \a other points to a different element than this;
+    iterator; otherwise returns false.
+
+    \sa operator==()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator++()
+
+    The prefix ++ operator (\c{++it}) advances the iterator to the next element in the collection
+    and returns an iterator to the new current element.
+
+    Calling this function on QWebElementCollection::end() leads to undefined results.
+
+    \sa operator--()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator++(int)
+
+    \overload
+
+    The postfix ++ operator (\c{it++}) advances the iterator to the next element in the collection
+    and returns an iterator to the previously current element.
+
+    Calling this function on QWebElementCollection::end() leads to undefined results.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator--()
+
+    The prefix -- operator (\c{--it}) makes the preceding element current and returns an
+    iterator to the new current element.
+
+    Calling this function on QWebElementCollection::begin() leads to undefined results.
+
+    \sa operator++()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator--(int)
+
+    \overload
+
+    The postfix -- operator (\c{it--}) makes the preceding element current and returns
+    an iterator to the previously current element.
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator+=(int j)
+
+    Advances the iterator by \a j elements. If \a j is negative, the iterator goes backward.
+
+    \sa operator-=(), operator+()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator &QWebElementCollection::const_iterator::operator-=(int j)
+
+    Makes the iterator go back by \a j elements. If \a j is negative, the iterator goes forward.
+
+    \sa operator+=(), operator-()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator+(int j) const
+
+    Returns an iterator to the element at \a j positions forward from this iterator. If \a j
+    is negative, the iterator goes backward.
+
+    \sa operator-(), operator+=()
+*/
+
+/*!
+    \fn QWebElementCollection::const_iterator QWebElementCollection::const_iterator::operator-(int j) const
+
+    Returns an iterator to the element at \a j positiosn backward from this iterator.
+    If \a j is negative, the iterator goes forward.
+
+    \sa operator+(), operator-=()
+*/
+
+/*!
+    \fn int QWebElementCollection::const_iterator::operator-(const_iterator other) const
+
+    Returns the number of elements between the item point to by \a other
+    and the element pointed to by this iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator<(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is less than the element pointed to
+    by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator<=(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is less than or equal to the
+    element pointed to by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator>(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is greater than the element pointed to
+    by the \a other iterator.
+*/
+
+/*!
+    \fn bool QWebElementCollection::const_iterator::operator>=(const const_iterator &other) const
+
+    Returns true if the element pointed to by this iterator is greater than or equal to the
+    element pointed to by the \a other iterator.
+*/
diff --git a/WebKit/qt/Api/qwebelement.h b/WebKit/qt/Api/qwebelement.h
index 3db4637..a18d262 100644
--- a/WebKit/qt/Api/qwebelement.h
+++ b/WebKit/qt/Api/qwebelement.h
@@ -31,7 +31,12 @@ namespace WebCore {
     class Node;
 }
 
+QT_BEGIN_NAMESPACE
+class QPainter;
+QT_END_NAMESPACE
+
 class QWebFrame;
+class QWebElementCollection;
 class QWebElementPrivate;
 
 class QWEBKIT_EXPORT QWebElement {
@@ -46,8 +51,8 @@ public:
 
     bool isNull() const;
 
-    QList<QWebElement> findAll(const QString& selectorQuery) const;
-    QWebElement findFirst(const QString& selectorQuery) const;
+    QWebElementCollection findAll(const QString &selectorQuery) const;
+    QWebElement findFirst(const QString &selectorQuery) const;
 
     void setPlainText(const QString& text);
     QString toPlainText() const;
@@ -92,7 +97,7 @@ public:
     QWebElement document() const;
     QWebFrame *webFrame() const;
 
-    // TODO: Add QList<QWebElement> overloads
+    // TODO: Add QWebElementCollection overloads
     // docs need example snippet
     void appendInside(const QString& markup);
     void appendInside(const QWebElement& element);
@@ -121,7 +126,7 @@ public:
     QWebElement clone() const;
     QWebElement& takeFromDocument();
     void removeFromDocument();
-    void removeChildren();
+    void removeAllChildren();
 
     QVariant evaluateJavaScript(const QString& scriptSource);
 
@@ -133,6 +138,8 @@ public:
     QString styleProperty(const QString& name, StyleResolveStrategy strategy) const;
     void setStyleProperty(const QString& name, const QString& value);
 
+    void render(QPainter* painter);
+
 private:
     explicit QWebElement(WebCore::Element*);
     explicit QWebElement(WebCore::Node*);
@@ -140,6 +147,7 @@ private:
     static QWebElement enclosingElement(WebCore::Node*);
 
     friend class QWebFrame;
+    friend class QWebElementCollection;
     friend class QWebHitTestResult;
     friend class QWebHitTestResultPrivate;
     friend class QWebPage;
@@ -148,4 +156,70 @@ private:
     WebCore::Element* m_element;
 };
 
+class QWebElementCollectionPrivate;
+
+class QWEBKIT_EXPORT QWebElementCollection
+{
+public:
+    QWebElementCollection();
+    QWebElementCollection(const QWebElement &contextElement, const QString &query);
+    QWebElementCollection(const QWebElementCollection &);
+    QWebElementCollection &operator=(const QWebElementCollection &);
+    ~QWebElementCollection();
+
+    QWebElementCollection operator+(const QWebElementCollection &other) const;
+    inline QWebElementCollection &operator+=(const QWebElementCollection &other)
+    {
+        append(other); return *this;
+    }
+
+    void append(const QWebElementCollection &collection);
+
+    int count() const;
+    QWebElement at(int i) const;
+
+    inline QWebElement first() const { return at(0); }
+    inline QWebElement last() const { return at(count() - 1); }
+
+    QList<QWebElement> toList() const;
+
+    class const_iterator {
+       public:
+           int i;
+           const QWebElementCollection *s;
+
+           inline const_iterator(const QWebElementCollection *collection, int index) : i(index), s(collection) {}
+           inline const_iterator(const const_iterator &o) : i(o.i), s(o.s) {}
+
+           inline const QWebElement operator*() const { return s->at(i); }
+
+           inline bool operator==(const const_iterator& o) const { return i == o.i && s == o.s; }
+           inline bool operator!=(const const_iterator& o) const { return i != o.i || s != o.s; }
+           inline bool operator<(const const_iterator& o) const { return i < o.i; }
+           inline bool operator<=(const const_iterator& o) const { return i <= o.i; }
+           inline bool operator>(const const_iterator& o) const { return i > o.i; }
+           inline bool operator>=(const const_iterator& o) const { return i >= o.i; }
+
+           inline const_iterator &operator++() { ++i; return *this; }
+           inline const_iterator operator++(int) { const_iterator n(s, i); ++i; return n; }
+           inline const_iterator &operator--() { i--; return *this; }
+           inline const_iterator operator--(int) { const_iterator n(s, i); i--; return n; }
+           inline const_iterator &operator+=(int j) { i += j; return *this; }
+           inline const_iterator &operator-=(int j) { i -= j; return *this; }
+           inline const_iterator operator+(int j) const { return const_iterator(s, i + j); }
+           inline const_iterator operator-(int j) const { return const_iterator(s, i - j); }
+           inline int operator-(const_iterator j) const { return i - j.i; }
+       private:
+            inline const_iterator() : i(0), s(0) {}
+    };
+    friend class const_iterator;
+
+    inline const_iterator begin() const { return const_iterator(this, 0); }
+    inline const_iterator end() const { return const_iterator(this, count()); }
+    inline QWebElement operator[](int i) const { return at(i); }
+
+private:
+    QExplicitlySharedDataPointer<QWebElementCollectionPrivate> d;
+};
+
 #endif // QWEBELEMENT_H
diff --git a/WebKit/qt/Api/qwebframe.cpp b/WebKit/qt/Api/qwebframe.cpp
index 1777cc8..606dae4 100644
--- a/WebKit/qt/Api/qwebframe.cpp
+++ b/WebKit/qt/Api/qwebframe.cpp
@@ -185,6 +185,17 @@ void QWEBKIT_EXPORT qt_drt_garbageCollector_collectOnAlternateThread(bool waitUn
     gcController().garbageCollectOnAlternateThreadForDebugging(waitUntilDone);
 }
 
+// Returns the value of counter in the element specified by \a id.
+QString QWEBKIT_EXPORT qt_drt_counterValueForElementById(QWebFrame* qFrame, const QString& id)
+{
+    Frame* frame = QWebFramePrivate::core(qFrame);
+    if (Document* document = frame->document()) {
+        Element* element = document->getElementById(id);
+        return WebCore::counterValueForElement(element);
+    }
+    return QString();
+}
+
 QWebFrameData::QWebFrameData(WebCore::Page* parentPage, WebCore::Frame* parentFrame,
                              WebCore::HTMLFrameOwnerElement* ownerFrameElement,
                              const WebCore::String& frameName)
@@ -232,7 +243,7 @@ WebCore::Scrollbar* QWebFramePrivate::verticalScrollBar() const
     return frame->view()->verticalScrollbar();
 }
 
-void QWebFramePrivate::renderPrivate(QPainter *painter, const QRegion &clip)
+void QWebFramePrivate::renderPrivate(QPainter *painter, QWebFrame::RenderLayer layer, const QRegion &clip)
 {
     if (!frame->view() || !frame->contentRenderer())
         return;
@@ -241,24 +252,58 @@ void QWebFramePrivate::renderPrivate(QPainter *painter, const QRegion &clip)
     if (vector.isEmpty())
         return;
 
-    WebCore::FrameView* view = frame->view();
-    view->layoutIfNeededRecursive();
-
     GraphicsContext context(painter);
+    if (context.paintingDisabled() && !context.updatingControlTints())
+        return;
 
-    if (clipRenderToViewport)
-        view->paint(&context, vector.first());
-    else
-        view->paintContents(&context, vector.first());
+    WebCore::FrameView* view = frame->view();
+    view->layoutIfNeededRecursive();
 
-    for (int i = 1; i < vector.size(); ++i) {
+    for (int i = 0; i < vector.size(); ++i) {
         const QRect& clipRect = vector.at(i);
+        QRect intersectedRect = clipRect.intersected(view->frameRect());
+
         painter->save();
         painter->setClipRect(clipRect, Qt::IntersectClip);
-        if (clipRenderToViewport)
-            view->paint(&context, clipRect);
-        else
-            view->paintContents(&context, clipRect);
+
+        int x = view->x();
+        int y = view->y();
+
+        if (layer & QWebFrame::ContentsLayer) {
+            context.save();
+
+            int scrollX = view->scrollX();
+            int scrollY = view->scrollY();
+
+            QRect rect = intersectedRect;
+            context.translate(x, y);
+            rect.translate(-x, -y);
+            context.translate(-scrollX, -scrollY);
+            rect.translate(scrollX, scrollY);
+            context.clip(view->visibleContentRect());
+
+            view->paintContents(&context, rect);
+
+            context.restore();
+        }
+
+        if (layer & QWebFrame::ScrollBarLayer
+            && !view->scrollbarsSuppressed()
+            && (view->horizontalScrollbar() || view->verticalScrollbar())) {
+            context.save();
+
+            QRect rect = intersectedRect;
+            context.translate(x, y);
+            rect.translate(-x, -y);
+
+            view->paintScrollbars(&context, rect);
+
+            context.restore();
+        }
+
+        if (layer & QWebFrame::PanIconLayer)
+            view->paintPanScrollIcon(&context);
+
         painter->restore();
     }
 }
@@ -386,7 +431,7 @@ void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object
         return;
 
     JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-    JSDOMWindow* window = toJSDOMWindow(d->frame);
+    JSDOMWindow* window = toJSDOMWindow(d->frame, mainThreadNormalWorld());
     JSC::Bindings::RootObject* root = d->frame->script()->bindingRootObject();
     if (!window) {
         qDebug() << "Warning: couldn't get window object";
@@ -540,15 +585,26 @@ QUrl QWebFrame::url() const
 */
 QUrl QWebFrame::requestedUrl() const
 {
-    // In the following edge cases (where the failing document
-    // loader does not get commited by the frame loader) it is
-    // safer to rely on outgoingReferrer than originalRequest.
-    if (!d->frame->loader()->activeDocumentLoader()
-        || (!d->frameLoaderClient->m_loadError.isNull()
-        &&  !d->frame->loader()->outgoingReferrer().isEmpty()))
-        return QUrl(d->frame->loader()->outgoingReferrer());
+    // There are some possible edge cases to be handled here,
+    // apart from checking if activeDocumentLoader is valid:
+    //
+    // * Method can be called while processing an unsucessful load.
+    //   In this case, frameLoaderClient will hold the current error
+    //   (m_loadError), and we will make use of it to recover the 'failingURL'.
+    // * If the 'failingURL' holds a null'ed string though, we fallback
+    //   to 'outgoingReferrer' (it yet is safer than originalRequest).
+    FrameLoader* loader = d->frame->loader();
+    FrameLoaderClientQt* loaderClient = d->frameLoaderClient;
+
+    if (!loader->activeDocumentLoader()
+        || !loaderClient->m_loadError.isNull()) {
+        if (!loaderClient->m_loadError.failingURL().isNull())
+            return QUrl(loaderClient->m_loadError.failingURL());
+        else if (!loader->outgoingReferrer().isEmpty())
+            return QUrl(loader->outgoingReferrer());
+    }
 
-    return d->frame->loader()->originalRequest().url();
+    return loader->originalRequest().url();
 }
 /*!
     \since 4.6
@@ -935,44 +991,37 @@ void QWebFrame::setScrollPosition(const QPoint &pos)
 }
 
 /*!
-  Render the frame into \a painter clipping to \a clip.
+  \since 4.6
+  Render the \a layer of the frame using \a painter clipping to \a clip.
 
   \sa print()
 */
-void QWebFrame::render(QPainter *painter, const QRegion &clip)
-{
-    d->renderPrivate(painter, clip);
-}
 
-/*!
-  Render the frame into \a painter.
-*/
-void QWebFrame::render(QPainter *painter)
+void QWebFrame::render(QPainter* painter, RenderLayer layer, const QRegion& clip)
 {
-    if (!d->frame->view())
-        return;
-
-    d->renderPrivate(painter, QRegion(d->frame->view()->frameRect()));
+    if (!clip.isEmpty())
+        d->renderPrivate(painter, layer, clip);
+    else if (d->frame->view())
+        d->renderPrivate(painter, layer, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
-    \since 4.6
-    \property QWebFrame::clipRenderToViewport
-
-    Returns true if render will clip content to viewport; otherwise returns false.
+  Render the frame into \a painter clipping to \a clip.
 */
-bool QWebFrame::clipRenderToViewport() const
+void QWebFrame::render(QPainter *painter, const QRegion &clip)
 {
-    return d->clipRenderToViewport;
+    d->renderPrivate(painter, AllLayers, clip);
 }
 
 /*!
-    \since 4.6
-    Sets whether the content of a frame will be clipped to viewport when rendered.
+  Render the frame into \a painter.
 */
-void QWebFrame::setClipRenderToViewport(bool clipRenderToViewport)
+void QWebFrame::render(QPainter *painter)
 {
-    d->clipRenderToViewport = clipRenderToViewport;
+    if (!d->frame->view())
+        return;
+
+    d->renderPrivate(painter, AllLayers, QRegion(d->frame->view()->frameRect()));
 }
 
 /*!
@@ -1103,7 +1152,7 @@ QWebElement QWebFrame::documentElement() const
 
     \sa QWebElement::findAll()
 */
-QList<QWebElement> QWebFrame::findAllElements(const QString &selectorQuery) const
+QWebElementCollection QWebFrame::findAllElements(const QString &selectorQuery) const
 {
     return documentElement().findAll(selectorQuery);
 }
@@ -1251,9 +1300,9 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     ScriptController *proxy = d->frame->script();
     QVariant rc;
     if (proxy) {
-        JSC::JSValue v = d->frame->loader()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
+        JSC::JSValue v = d->frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
         int distance = 0;
-        rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject()->globalExec(), v, QMetaType::Void, &distance);
+        rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject(mainThreadNormalWorld())->globalExec(), v, QMetaType::Void, &distance);
     }
     return rc;
 }
@@ -1391,7 +1440,6 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     if (!hitTest.innerNode())
         return;
     pos = hitTest.point();
-    boundingRect = hitTest.boundingBox();
     WebCore::TextDirection dir;
     title = hitTest.title(dir);
     linkText = hitTest.textContent();
@@ -1401,6 +1449,7 @@ QWebHitTestResultPrivate::QWebHitTestResultPrivate(const WebCore::HitTestResult
     imageUrl = hitTest.absoluteImageURL();
     innerNode = hitTest.innerNode();
     innerNonSharedNode = hitTest.innerNonSharedNode();
+    boundingRect = innerNonSharedNode ? innerNonSharedNode->renderer()->absoluteBoundingBoxRect(true) : IntRect();
     WebCore::Image *img = hitTest.image();
     if (img) {
         QPixmap *pix = img->nativeImageForCurrentFrame();
@@ -1648,4 +1697,3 @@ QWebFrame *QWebHitTestResult::frame() const
         return 0;
     return d->frame;
 }
-
diff --git a/WebKit/qt/Api/qwebframe.h b/WebKit/qt/Api/qwebframe.h
index 55c73b4..08285f8 100644
--- a/WebKit/qt/Api/qwebframe.h
+++ b/WebKit/qt/Api/qwebframe.h
@@ -50,6 +50,7 @@ class QWebHitTestResult;
 class QWebHistoryItem;
 class QWebSecurityOrigin;
 class QWebElement;
+class QWebElementCollection;
 
 namespace WebCore {
     class WidgetPrivate;
@@ -112,7 +113,6 @@ class QWEBKIT_EXPORT QWebFrame : public QObject {
     Q_PROPERTY(QIcon icon READ icon)
     Q_PROPERTY(QSize contentsSize READ contentsSize)
     Q_PROPERTY(QPoint scrollPosition READ scrollPosition WRITE setScrollPosition)
-    Q_PROPERTY(bool clipRenderToViewport READ clipRenderToViewport WRITE setClipRenderToViewport)
     Q_PROPERTY(bool focus READ hasFocus)
 private:
     QWebFrame(QWebPage *parent, QWebFrameData *frameData);
@@ -165,10 +165,17 @@ public:
     QPoint scrollPosition() const;
     void setScrollPosition(const QPoint &pos);
 
-    void render(QPainter *painter, const QRegion &clip);
-    void render(QPainter *painter);
-    bool clipRenderToViewport() const;
-    void setClipRenderToViewport(bool clipRenderToViewport);
+    enum RenderLayer {
+        ContentsLayer = 0x10,
+        ScrollBarLayer = 0x20,
+        PanIconLayer = 0x40,
+
+        AllLayers = 0xff
+    };
+
+    void render(QPainter*);
+    void render(QPainter*, const QRegion& clip);
+    void render(QPainter*, RenderLayer layer, const QRegion& clip = QRegion());
 
     void setTextSizeMultiplier(qreal factor);
     qreal textSizeMultiplier() const;
@@ -184,7 +191,7 @@ public:
     QSize contentsSize() const;
 
     QWebElement documentElement() const;
-    QList<QWebElement> findAllElements(const QString &selectorQuery) const;
+    QWebElementCollection findAllElements(const QString &selectorQuery) const;
     QWebElement findFirstElement(const QString &selectorQuery) const;
 
     QWebHitTestResult hitTestContent(const QPoint &pos) const;
diff --git a/WebKit/qt/Api/qwebframe_p.h b/WebKit/qt/Api/qwebframe_p.h
index 632f83a..081e65d 100644
--- a/WebKit/qt/Api/qwebframe_p.h
+++ b/WebKit/qt/Api/qwebframe_p.h
@@ -70,7 +70,6 @@ public:
         , allowsScrolling(true)
         , marginWidth(-1)
         , marginHeight(-1)
-        , clipRenderToViewport(true)
         {}
     void init(QWebFrame* qframe, QWebFrameData* frameData);
 
@@ -82,7 +81,7 @@ public:
     static WebCore::Frame* core(QWebFrame*);
     static QWebFrame* kit(WebCore::Frame*);
 
-    void renderPrivate(QPainter *painter, const QRegion &clip);
+    void renderPrivate(QPainter*, QWebFrame::RenderLayer, const QRegion& clip);
 
     QWebFrame *q;
     Qt::ScrollBarPolicy horizontalScrollBarPolicy;
@@ -94,7 +93,6 @@ public:
     bool allowsScrolling;
     int marginWidth;
     int marginHeight;
-    bool clipRenderToViewport;
 };
 
 class QWebHitTestResultPrivate {
diff --git a/WebKit/qt/Api/qwebhistory.cpp b/WebKit/qt/Api/qwebhistory.cpp
index 5752d66..f765daa 100644
--- a/WebKit/qt/Api/qwebhistory.cpp
+++ b/WebKit/qt/Api/qwebhistory.cpp
@@ -31,6 +31,11 @@
 #include <QSharedData>
 #include <QDebug>
 
+enum {
+    InitialHistoryVersion = 1,
+    DefaultHistoryVersion = InitialHistoryVersion
+};
+
 /*!
   \class QWebHistoryItem
   \since 4.4
@@ -226,7 +231,8 @@ bool QWebHistoryItem::isValid() const
   number of items is given by count(), and the history can be cleared with the
   clear() function.
 
-  QWebHistory's state can be saved with saveState() and loaded with restoreState().
+  QWebHistory's state can be saved to a QDataStream using the >> operator and loaded
+  by using the << operator.
 
   \sa QWebHistoryItem, QWebHistoryInterface, QWebPage
 */
@@ -475,135 +481,82 @@ void QWebHistory::setMaximumItemCount(int count)
 }
 
 /*!
-   \enum QWebHistory::HistoryStateVersion
+  \since 4.6
+  \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
+  \relates QWebHistory
 
-   This enum describes the versions available for QWebHistory's saveState() function:
+  \brief The operator<< function streams a history into a data stream.
 
-   \value HistoryVersion_1 Version 1 (Qt 4.6)
-   \value DefaultHistoryVersion The current default version in 1.
+  It saves the \a history into the specified \a stream.
 */
 
+QDataStream& operator<<(QDataStream& target, const QWebHistory& history)
+{
+    QWebHistoryPrivate* d = history.d;
+
+    QByteArray buffer;
+    QDataStream stream(&buffer, QIODevice::WriteOnly);
+
+    int version = DefaultHistoryVersion;
+
+    stream << version;
+    stream << history.count() << history.currentItemIndex();
+
+    const WebCore::HistoryItemVector &items = d->lst->entries();
+    for (unsigned i = 0; i < items.size(); i++)
+        items[i].get()->saveState(stream, version);
+
+    if (stream.status() != QDataStream::Ok)
+        buffer = QByteArray();  // make buffer isNull()==true and isEmpty()==true
+
+    return target << buffer;
+}
+
 /*!
+  \fn QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
+  \relates QWebHistory
   \since 4.6
 
-  Restores the state of QWebHistory from the given \a buffer. Returns true
-  if the history was successfully restored; otherwise returns false.
+  \brief The operator>> function loads a history from a data stream.
 
-  \sa saveState()
+  Loads a QWebHistory from the specified \a stream into the given \a history.
 */
-bool QWebHistory::restoreState(const QByteArray& buffer)
+
+QDataStream& operator>>(QDataStream& source, QWebHistory& history)
 {
+    QWebHistoryPrivate* d = history.d;
+
+    QByteArray buffer;
+    source >> buffer;
+
     QDataStream stream(buffer);
     int version;
-    bool result = false;
+
     stream >> version;
 
-    switch (version) {
-    case HistoryVersion_1: {
+    if (version == 1) {
         int count;
         int currentIndex;
         stream >> count >> currentIndex;
 
-        clear();
+        history.clear();
         // only if there are elements
         if (count) {
             // after clear() is new clear HistoryItem (at the end we had to remove it)
-            WebCore::HistoryItem *nullItem = d->lst->currentItem();
-            for (int i = 0;i < count;i++) {
+            WebCore::HistoryItem* nullItem = d->lst->currentItem();
+            for (int i = 0; i < count; i++) {
                 WTF::PassRefPtr<WebCore::HistoryItem> item = WebCore::HistoryItem::create();
                 item->restoreState(stream, version);
                 d->lst->addItem(item);
             }
             d->lst->removeItem(nullItem);
-            goToItem(itemAt(currentIndex));
-            result = stream.status() == QDataStream::Ok;
+            history.goToItem(history.itemAt(currentIndex));
         }
-        break;
-    }
-    default: {} // result is false;
     }
 
     d->page()->updateNavigationActions();
 
-    return result;
-};
-
-/*!
-  \since 4.6
-  Saves the state of this QWebHistory into a QByteArray.
-
-  Saves the current state of this QWebHistory. The version number, \a version, is
-  stored as part of the data.
-
-  To restore the saved state, pass the return value to restoreState().
-
-  \sa restoreState()
-*/
-QByteArray QWebHistory::saveState(HistoryStateVersion version) const
-{
-    QByteArray buffer;
-    QDataStream stream(&buffer, QIODevice::WriteOnly);
-    stream << version;
-
-    switch (version) {
-    case HistoryVersion_1: {
-        stream << count() << currentItemIndex();
-
-        const WebCore::HistoryItemVector &items = d->lst->entries();
-        for (unsigned i = 0; i < items.size(); i++)
-            items[i].get()->saveState(stream, version);
-
-        if (stream.status() != QDataStream::Ok)
-            buffer = QByteArray();  // make buffer isNull()==true and isEmpty()==true
-        break;
-    }
-    default:
-        buffer.clear();
-
-    }
-
-    return buffer;
-}
-
-/*!
-  \since 4.6
-  \fn QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
-  \relates QWebHistory
-
-  \brief The operator<< function streams a history into a data stream.
-
-  It saves the \a history into the specified \a stream. This is a
-  convenience function and is equivalent to calling the saveState()
-  method.
-
-  \sa QWebHistory::saveState()
-*/
-
-QDataStream& operator<<(QDataStream& stream, const QWebHistory& history)
-{
-    return stream << history.saveState();
-}
-
-/*!
-  \fn QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
-  \relates QWebHistory
-  \since 4.6
-
-  \brief The operator>> function loads a history from a data stream.
-
-  Loads a QWebHistory from the specified \a stream into the given \a history.
-  This is a convenience function and it is equivalent to calling the restoreState()
-  method.
-
-  \sa QWebHistory::restoreState()
-*/
-
-QDataStream& operator>>(QDataStream& stream, QWebHistory& history)
-{
-    QByteArray buffer;
-    stream >> buffer;
-    history.restoreState(buffer);
-    return stream;
+    return source;
 }
 
 QWebPagePrivate* QWebHistoryPrivate::page()
diff --git a/WebKit/qt/Api/qwebhistory.h b/WebKit/qt/Api/qwebhistory.h
index e46f124..cce4553 100644
--- a/WebKit/qt/Api/qwebhistory.h
+++ b/WebKit/qt/Api/qwebhistory.h
@@ -42,9 +42,6 @@ public:
     QWebHistoryItem &operator=(const QWebHistoryItem &other);
     ~QWebHistoryItem();
 
-    //bool restoreState(QByteArray& buffer);
-    //QByteArray saveState(QWebHistory::HistoryStateVersion version = DefaultHistoryVersion) const;
-
     QUrl originalUrl() const;
     QUrl url() const;
 
@@ -69,22 +66,10 @@ private:
     QExplicitlySharedDataPointer<QWebHistoryItemPrivate> d;
 };
 
-//QWEBKIT_EXPORT QDataStream & operator<<(QDataStream& out,const QWebHistoryItem& hist);
-//QWEBKIT_EXPORT QDataStream & operator>>(QDataStream& in,QWebHistoryItem& hist);
-
 
 class QWebHistoryPrivate;
 class QWEBKIT_EXPORT QWebHistory {
 public:
-    enum HistoryStateVersion {
-        HistoryVersion_1,
-        /*, HistoryVersion_2, */
-        DefaultHistoryVersion = HistoryVersion_1
-    };
-
-    bool restoreState(const QByteArray& buffer);
-    QByteArray saveState(HistoryStateVersion version = DefaultHistoryVersion) const;
-
     void clear();
 
     QList<QWebHistoryItem> items() const;
diff --git a/WebKit/qt/Api/qwebpage.cpp b/WebKit/qt/Api/qwebpage.cpp
index 0acec48..0b122b4 100644
--- a/WebKit/qt/Api/qwebpage.cpp
+++ b/WebKit/qt/Api/qwebpage.cpp
@@ -77,6 +77,7 @@
 #include "LocalizedStrings.h"
 #include "Cache.h"
 #include "runtime/InitializeThreading.h"
+#include "PageGroup.h"
 
 #include <QApplication>
 #include <QBasicTimer>
@@ -262,7 +263,9 @@ static inline Qt::DropAction dragOpToDropAction(unsigned actions)
 QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     : q(qq)
     , client(0)
+#if QT_VERSION < 0x040600
     , view(0)
+#endif
     , inspectorFrontend(0)
     , inspector(0)
     , inspectorIsInternalOnly(false)
@@ -279,9 +282,6 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     page = new Page(chromeClient, contextMenuClient, editorClient,
                     new DragClientQt(q), new InspectorClientQt(q), 0);
 
-    // ### should be configurable
-    page->settings()->setDefaultTextEncodingName("iso-8859-1");
-
     settings = new QWebSettings(page->settings());
 
 #ifndef QT_NO_UNDOSTACK
@@ -305,6 +305,8 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 
     history.d = new QWebHistoryPrivate(page->backForwardList());
     memset(actions, 0, sizeof(actions));
+
+    PageGroup::setShouldTrackVisitedLinks(true);
 }
 
 QWebPagePrivate::~QWebPagePrivate()
@@ -381,7 +383,7 @@ static QWebPage::WebAction webActionForContextMenuAction(WebCore::ContextMenuAct
 QMenu *QWebPagePrivate::createContextMenu(const WebCore::ContextMenu *webcoreMenu,
         const QList<WebCore::ContextMenuItem> *items, QBitArray *visitedWebActions)
 {
-    QMenu* menu = new QMenu(view);
+    QMenu* menu = new QMenu(q->view());
     for (int i = 0; i < items->count(); ++i) {
         const ContextMenuItem &item = items->at(i);
         switch (item.type()) {
@@ -584,8 +586,6 @@ void QWebPagePrivate::timerEvent(QTimerEvent *ev)
 
 void QWebPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -606,8 +606,6 @@ void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
 
 void QWebPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -663,8 +661,6 @@ void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
 
 void QWebPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent *ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -750,8 +746,6 @@ void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
 
 void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -770,13 +764,13 @@ void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
 void QWebPagePrivate::handleSoftwareInputPanel(Qt::MouseButton button)
 {
 #if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
-    if (view && view->testAttribute(Qt::WA_InputMethodEnabled)
+    if (q->view() && q->view()->testAttribute(Qt::WA_InputMethodEnabled)
         && button == Qt::LeftButton && qApp->autoSipEnabled()) {
         QStyle::RequestSoftwareInputPanel behavior = QStyle::RequestSoftwareInputPanel(
-            view->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
+            q->view()->style()->styleHint(QStyle::SH_RequestSoftwareInputPanel));
         if (!clickCausedFocus || behavior == QStyle::RSIP_OnMouseClick) {
             QEvent event(QEvent::RequestSoftwareInputPanel);
-            QApplication::sendEvent(view, &event);
+            QApplication::sendEvent(q->view(), &event);
         }
     }
 
@@ -833,8 +827,6 @@ QMenu *QWebPage::createStandardContextMenu()
 #ifndef QT_NO_WHEELEVENT
 void QWebPagePrivate::wheelEvent(QGraphicsSceneWheelEvent* ev)
 {
-    q->setView(ev->widget());
-
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
         return;
@@ -922,8 +914,8 @@ void QWebPagePrivate::keyPressEvent(QKeyEvent *ev)
     if (!handled) {
         handled = true;
         QFont defaultFont;
-        if (view)
-            defaultFont = view->font();
+        if (q->view())
+            defaultFont = q->view()->font();
         QFontMetrics fm(defaultFont);
         if (!handleScrolling(ev, frame)) {
             switch (ev->key()) {
@@ -990,8 +982,6 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent*)
 
 void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
@@ -1016,8 +1006,6 @@ void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
 
 void QWebPagePrivate::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
     page->dragController()->dragExited(&dragData);
@@ -1036,8 +1024,6 @@ void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
 
 void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
 {
-    q->setView(ev->widget());
-
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(ev->mimeData(), ev->pos().toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
@@ -1684,7 +1670,7 @@ QWebHistory *QWebPage::history() const
 */
 void QWebPage::setView(QWidget *view)
 {
-    if (d->view != view) {
+    if (this->view() != view) {
         d->view = view;
         setViewportSize(view ? view->size() : QSize(0, 0));
     }
@@ -1697,7 +1683,11 @@ void QWebPage::setView(QWidget *view)
 */
 QWidget *QWebPage::view() const
 {
+#if QT_VERSION < 0x040600
     return d->view;
+#else
+    return d->view.data();
+#endif
 }
 
 /*!
@@ -1724,7 +1714,7 @@ void QWebPage::javaScriptAlert(QWebFrame *frame, const QString& msg)
 {
     Q_UNUSED(frame)
 #ifndef QT_NO_MESSAGEBOX
-    QMessageBox::information(d->view, tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Ok);
+    QMessageBox::information(view(), tr("JavaScript Alert - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Ok);
 #endif
 }
 
@@ -1740,7 +1730,7 @@ bool QWebPage::javaScriptConfirm(QWebFrame *frame, const QString& msg)
 #ifdef QT_NO_MESSAGEBOX
     return true;
 #else
-    return QMessageBox::Yes == QMessageBox::information(d->view, tr("JavaScript Confirm - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Yes, QMessageBox::No);
+    return QMessageBox::Yes == QMessageBox::information(view(), tr("JavaScript Confirm - %1").arg(mainFrame()->url().host()), msg, QMessageBox::Yes, QMessageBox::No);
 #endif
 }
 
@@ -1758,7 +1748,7 @@ bool QWebPage::javaScriptPrompt(QWebFrame *frame, const QString& msg, const QStr
     Q_UNUSED(frame)
     bool ok = false;
 #ifndef QT_NO_INPUTDIALOG
-    QString x = QInputDialog::getText(d->view, tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), msg, QLineEdit::Normal, defaultValue, &ok);
+    QString x = QInputDialog::getText(view(), tr("JavaScript Prompt - %1").arg(mainFrame()->url().host()), msg, QLineEdit::Normal, defaultValue, &ok);
     if (ok && result)
         *result = x;
 #endif
@@ -1783,7 +1773,7 @@ bool QWebPage::shouldInterruptJavaScript()
 #ifdef QT_NO_MESSAGEBOX
     return false;
 #else
-    return QMessageBox::Yes == QMessageBox::information(d->view, tr("JavaScript Problem - %1").arg(mainFrame()->url().host()), tr("The script on this page appears to have a problem. Do you want to stop the script?"), QMessageBox::Yes, QMessageBox::No);
+    return QMessageBox::Yes == QMessageBox::information(view(), tr("JavaScript Problem - %1").arg(mainFrame()->url().host()), tr("The script on this page appears to have a problem. Do you want to stop the script?"), QMessageBox::Yes, QMessageBox::No);
 #endif
 }
 
@@ -1800,7 +1790,7 @@ bool QWebPage::shouldInterruptJavaScript()
 */
 QWebPage *QWebPage::createWindow(WebWindowType type)
 {
-    QWebView *webView = qobject_cast<QWebView *>(d->view);
+    QWebView *webView = qobject_cast<QWebView *>(view());
     if (webView) {
         QWebView *newView = webView->createWindow(type);
         if (newView)
@@ -1863,7 +1853,7 @@ void QWebPage::triggerAction(WebAction action, bool)
                 WTF::RefPtr<WebCore::Frame> wcFrame = targetFrame->d->frame;
                 targetFrame->d->frame->loader()->loadFrameRequest(frameLoadRequest(d->hitTestResult.linkUrl(), wcFrame.get()),
                                                                   /*lockHistory*/ false, /*lockBackForwardList*/ false, /*event*/ 0,
-                                                                  /*FormState*/ 0);
+                                                                  /*FormState*/ 0, SendReferrer);
                 break;
             }
             // fall through
@@ -1975,7 +1965,7 @@ void QWebPage::setViewportSize(const QSize &size) const
     }
 }
 
-QSize QWebPage::fixedContentsSize() const
+QSize QWebPage::preferredContentsSize() const
 {
     QWebFrame* frame = d->mainFrame;
     if (frame) {
@@ -1988,7 +1978,7 @@ QSize QWebPage::fixedContentsSize() const
 }
 
 /*!
-    \property QWebPage::fixedContentsSize
+    \property QWebPage::preferredContentsSize
     \since 4.6
     \brief the size of the fixed layout
 
@@ -1996,7 +1986,7 @@ QSize QWebPage::fixedContentsSize() const
     1024x768 for example then webkit will layout the page as if the viewport were that size
     rather than something different.
 */
-void QWebPage::setFixedContentsSize(const QSize &size) const
+void QWebPage::setPreferredContentsSize(const QSize &size) const
 {
     d->fixedLayoutSize = size;
 
@@ -2766,7 +2756,7 @@ bool QWebPage::extension(Extension extension, const ExtensionOption *option, Ext
     if (extension == ChooseMultipleFilesExtension) {
         // FIXME: do not ignore suggestedFiles
         QStringList suggestedFiles = static_cast<const ChooseMultipleFilesExtensionOption*>(option)->suggestedFileNames;
-        QStringList names = QFileDialog::getOpenFileNames(d->view, QString::null);
+        QStringList names = QFileDialog::getOpenFileNames(view(), QString::null);
         static_cast<ChooseMultipleFilesExtensionReturn*>(output)->fileNames = names;
         return true;
     }
@@ -2848,7 +2838,7 @@ QString QWebPage::chooseFile(QWebFrame *parentFrame, const QString& suggestedFil
 {
     Q_UNUSED(parentFrame)
 #ifndef QT_NO_FILEDIALOG
-    return QFileDialog::getOpenFileName(d->view, QString::null, suggestedFile);
+    return QFileDialog::getOpenFileName(view(), QString::null, suggestedFile);
 #else
     return QString::null;
 #endif
@@ -2887,6 +2877,9 @@ QNetworkProxy QWebPage::networkProxy() const
     Sets the QNetworkAccessManager \a manager responsible for serving network requests for this
     QWebPage.
 
+    \note It is currently not supported to change the network access manager after the
+    QWebPage has used it. The results of doing this are undefined.
+
     \sa networkAccessManager()
 */
 void QWebPage::setNetworkAccessManager(QNetworkAccessManager *manager)
@@ -3108,8 +3101,8 @@ QString QWebPage::userAgentForUrl(const QUrl& url) const
 
     // Language
     QLocale locale;
-    if (d->view)
-        locale = d->view->locale();
+    if (view())
+        locale = view()->locale();
     QString name = locale.name();
     name[2] = QLatin1Char('-');
     ua.append(name);
diff --git a/WebKit/qt/Api/qwebpage.h b/WebKit/qt/Api/qwebpage.h
index d77656c..f2bbde0 100644
--- a/WebKit/qt/Api/qwebpage.h
+++ b/WebKit/qt/Api/qwebpage.h
@@ -67,7 +67,7 @@ class QWEBKIT_EXPORT QWebPage : public QObject {
     Q_PROPERTY(bool modified READ isModified)
     Q_PROPERTY(QString selectedText READ selectedText)
     Q_PROPERTY(QSize viewportSize READ viewportSize WRITE setViewportSize)
-    Q_PROPERTY(QSize fixedContentsSize READ fixedContentsSize WRITE setFixedContentsSize)
+    Q_PROPERTY(QSize preferredContentsSize READ preferredContentsSize WRITE setPreferredContentsSize)
     Q_PROPERTY(bool forwardUnsupportedContent READ forwardUnsupportedContent WRITE setForwardUnsupportedContent)
     Q_PROPERTY(LinkDelegationPolicy linkDelegationPolicy READ linkDelegationPolicy WRITE setLinkDelegationPolicy)
     Q_PROPERTY(QPalette palette READ palette WRITE setPalette)
@@ -237,8 +237,8 @@ public:
     QSize viewportSize() const;
     void setViewportSize(const QSize &size) const;
 
-    QSize fixedContentsSize() const;
-    void setFixedContentsSize(const QSize &size) const;
+    QSize preferredContentsSize() const;
+    void setPreferredContentsSize(const QSize &size) const;
 
     virtual bool event(QEvent*);
     bool focusNextPrevChild(bool next);
diff --git a/WebKit/qt/Api/qwebpage_p.h b/WebKit/qt/Api/qwebpage_p.h
index b9571fa..f0f842d 100644
--- a/WebKit/qt/Api/qwebpage_p.h
+++ b/WebKit/qt/Api/qwebpage_p.h
@@ -135,7 +135,12 @@ public:
 #ifndef QT_NO_UNDOSTACK
     QUndoStack *undoStack;
 #endif
+
+#if QT_VERSION >= 0x040600
+    QWeakPointer<QWidget> view;
+#else
     QWidget* view;
+#endif
 
     bool insideOpenCall;
     quint64 m_totalBytes;
diff --git a/WebKit/qt/Api/qwebsecurityorigin.cpp b/WebKit/qt/Api/qwebsecurityorigin.cpp
index 7c44e37..2a225c5 100644
--- a/WebKit/qt/Api/qwebsecurityorigin.cpp
+++ b/WebKit/qt/Api/qwebsecurityorigin.cpp
@@ -30,6 +30,16 @@
 
 using namespace WebCore;
 
+void QWEBKIT_EXPORT qt_drt_whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
+{
+    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+void QWEBKIT_EXPORT qt_drt_resetOriginAccessWhiteLists()
+{
+    SecurityOrigin::resetOriginAccessWhiteLists();
+}
+
 /*!
     \class QWebSecurityOrigin
     \since 4.5
@@ -239,21 +249,3 @@ QStringList QWebSecurityOrigin::localSchemes()
     }
     return list;
 }
-
-/*!
-    \since 4.6
-    \internal
-*/
-void QWebSecurityOrigin::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
-{
-    SecurityOrigin::whiteListAccessFromOrigin(*SecurityOrigin::createFromString(sourceOrigin), destinationProtocol, destinationHost, allowDestinationSubdomains);
-}
-
-/*!
-    \since 4.6
-    \internal
-*/
-void QWebSecurityOrigin::resetOriginAccessWhiteLists()
-{
-    SecurityOrigin::resetOriginAccessWhiteLists();
-}
diff --git a/WebKit/qt/Api/qwebsecurityorigin.h b/WebKit/qt/Api/qwebsecurityorigin.h
index 94b96f0..16f8bc1 100644
--- a/WebKit/qt/Api/qwebsecurityorigin.h
+++ b/WebKit/qt/Api/qwebsecurityorigin.h
@@ -40,8 +40,6 @@ public:
     static void addLocalScheme(const QString& scheme);
     static void removeLocalScheme(const QString& scheme);
     static QStringList localSchemes();
-    static void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
-    static void resetOriginAccessWhiteLists();
 
     ~QWebSecurityOrigin();
 
diff --git a/WebKit/qt/Api/qwebsettings.cpp b/WebKit/qt/Api/qwebsettings.cpp
index abd7036..ffa21e4 100644
--- a/WebKit/qt/Api/qwebsettings.cpp
+++ b/WebKit/qt/Api/qwebsettings.cpp
@@ -62,6 +62,8 @@ public:
     QString localStoragePath;
     QString offlineWebApplicationCachePath;
     qint64 offlineStorageDefaultQuota;
+    float printingMinimumShrinkFactor;
+    float printingMaximumShrinkFactor;
 
     void apply();
     WebCore::Settings* settings;
@@ -174,6 +176,12 @@ void QWebSettingsPrivate::apply()
         QString storagePath = !localStoragePath.isEmpty() ? localStoragePath : global->localStoragePath;
         settings->setLocalStorageDatabasePath(storagePath);
 
+        float minimumShrinkFactor = printingMinimumShrinkFactor > 0.0f ? printingMinimumShrinkFactor : global->printingMinimumShrinkFactor;
+        settings->setPrintingMinimumShrinkFactor(minimumShrinkFactor);
+
+        float maximumShrinkFactor = printingMaximumShrinkFactor > 0.0f ? printingMaximumShrinkFactor : global->printingMaximumShrinkFactor;
+        settings->setPrintingMaximumShrinkFactor(maximumShrinkFactor);
+
         value = attributes.value(QWebSettings::ZoomTextOnly,
                                  global->attributes.value(QWebSettings::ZoomTextOnly));
         settings->setZoomsTextOnly(value);
@@ -377,6 +385,9 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::LocalContentCanAccessRemoteUrls, false);
     d->attributes.insert(QWebSettings::SessionStorageEnabled, true);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
+    d->defaultTextEncoding = QLatin1String("iso-8859-1");
+    d->printingMinimumShrinkFactor = 0.0f;
+    d->printingMaximumShrinkFactor = 0.0f;
 }
 
 /*!
@@ -491,6 +502,60 @@ QString QWebSettings::defaultTextEncoding() const
 }
 
 /*!
+    \since 4.7 
+    Specifies minimum shrink fator allowed for printing. If set to 0 a
+    default value is used.
+
+    When printing, content will be shrunk to reduce page usage, it
+    will reduced by a factor between printingMinimumShrinkFactor and
+    printingMaximumShrinkFactor. 
+
+    \sa printingMinimumShrinkFactor()
+    \sa setPrintingMaximumShrinkFactor()
+    \sa printingMaximumShrinkFactor()
+*/
+void QWebSettings::setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor)
+{
+    d->printingMinimumShrinkFactor = printingMinimumShrinkFactor;
+    d->apply();
+}
+
+/*!
+    \since 4.7 
+    returns the minimum shrink factor used for printing.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+float QWebSettings::printingMinimumShrinkFactor() const
+{
+    return d->printingMinimumShrinkFactor;
+}
+
+/*!
+    \since 4.7 
+    Specifies maximum shrink fator allowed for printing. If set to 0 a
+    default value is used.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+void QWebSettings::setPrintingMaximumShrinkFactor(float printingMaximumShrinkFactor)
+{
+    d->printingMaximumShrinkFactor = printingMaximumShrinkFactor;
+    d->apply();
+}
+
+/*!
+    \since 4.7 
+    returns the maximum shrink factor used for printing.
+
+    \sa setPrintingMinimumShrinkFactor()
+*/
+float QWebSettings::printingMaximumShrinkFactor() const
+{
+    return d->printingMaximumShrinkFactor;
+}
+
+/*!
     Sets the path of the icon database to \a path. The icon database is used
     to store "favicons" associated with web sites.
 
diff --git a/WebKit/qt/Api/qwebsettings.h b/WebKit/qt/Api/qwebsettings.h
index 4790823..e68ea53 100644
--- a/WebKit/qt/Api/qwebsettings.h
+++ b/WebKit/qt/Api/qwebsettings.h
@@ -103,6 +103,12 @@ public:
     void setDefaultTextEncoding(const QString &encoding);
     QString defaultTextEncoding() const;
 
+    void setPrintingMinimumShrinkFactor(float printingMinimumShrinkFactor);
+    float printingMinimumShrinkFactor() const;
+
+    void setPrintingMaximumShrinkFactor(float printingMaximimShrinkFactor);
+    float printingMaximumShrinkFactor() const;
+
     static void setIconDatabasePath(const QString &location);
     static QString iconDatabasePath();
     static void clearIconDatabase();
diff --git a/WebKit/qt/Api/qwebview.cpp b/WebKit/qt/Api/qwebview.cpp
index ce8b923..4fa073d 100644
--- a/WebKit/qt/Api/qwebview.cpp
+++ b/WebKit/qt/Api/qwebview.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2008 Holger Hans Peter Freyther
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -47,14 +48,19 @@ public:
 
     virtual void scroll(int dx, int dy, const QRect&);
     virtual void update(const QRect& dirtyRect);
+    virtual void setInputMethodEnabled(bool enable);
+#if QT_VERSION >= 0x040600
+    virtual void setInputMethodHint(Qt::InputMethodHint hint, bool enable);
+#endif
 
 #ifndef QT_NO_CURSOR
     virtual QCursor cursor() const;
     virtual void updateCursor(const QCursor& cursor);
 #endif
 
+    virtual QPalette palette() const;
     virtual int screenNumber() const;
-    virtual WId winId() const;
+    virtual QWidget* ownerWidget() const;
 
     virtual QObject* pluginParent() const;
 
@@ -76,6 +82,19 @@ void QWebViewPrivate::update(const QRect & dirtyRect)
     view->update(dirtyRect);
 }
 
+void QWebViewPrivate::setInputMethodEnabled(bool enable)
+{
+    view->setAttribute(Qt::WA_InputMethodEnabled, enable);
+}
+#if QT_VERSION >= 0x040600
+void QWebViewPrivate::setInputMethodHint(Qt::InputMethodHint hint, bool enable)
+{
+    if (enable)
+        view->setInputMethodHints(view->inputMethodHints() | hint);
+    else
+        view->setInputMethodHints(view->inputMethodHints() & ~hint);
+}
+#endif
 #ifndef QT_NO_CURSOR
 QCursor QWebViewPrivate::cursor() const
 {
@@ -88,6 +107,11 @@ void QWebViewPrivate::updateCursor(const QCursor& cursor)
 }
 #endif
 
+QPalette QWebViewPrivate::palette() const
+{
+    return view->palette();
+}
+
 int QWebViewPrivate::screenNumber() const
 {
 #if defined(Q_WS_X11)
@@ -98,12 +122,9 @@ int QWebViewPrivate::screenNumber() const
     return 0;
 }
 
-WId QWebViewPrivate::winId() const
+QWidget* QWebViewPrivate::ownerWidget() const
 {
-    if (view)
-        return view->winId();
-
-    return 0;
+    return view;
 }
 
 QObject* QWebViewPrivate::pluginParent() const
@@ -224,8 +245,14 @@ QWebView::QWebView(QWidget *parent)
 */
 QWebView::~QWebView()
 {
-    if (d->page)
+    if (d->page) {
+#if QT_VERSION >= 0x040600
+        d->page->d->view.clear();
+#else
         d->page->d->view = 0;
+#endif
+        d->page->d->client = 0;
+    }
 
     if (d->page && d->page->parent() == this)
         delete d->page;
@@ -661,24 +688,38 @@ qreal QWebView::textSizeMultiplier() const
     return page()->mainFrame()->textSizeMultiplier();
 }
 
-#if !defined(Q_OS_SYMBIAN)
 /*!
     \property QWebView::renderHints
     \since 4.6
     \brief the default render hints for the view
 
-    These hints are used to initialize QPainter before painting the web page.
+    These hints are used to initialize QPainter before painting the Web page.
 
     QPainter::TextAntialiasing is enabled by default.
 
+    \note This property is not available on Symbian. However, the getter and
+    setter functions can still be used directly.
+
+    \sa QPainter::renderHints()
+*/
+
+/*!
+    \since 4.6
+    Returns the render hints used by the view to render content.
+
     \sa QPainter::renderHints()
 */
-#endif
 QPainter::RenderHints QWebView::renderHints() const
 {
     return d->renderHints;
 }
 
+/*!
+    \since 4.6
+    Sets the render hints used by the view to the specified \a hints.
+
+    \sa QPainter::setRenderHints()
+*/
 void QWebView::setRenderHints(QPainter::RenderHints hints)
 {
     if (hints == d->renderHints)
@@ -688,11 +729,11 @@ void QWebView::setRenderHints(QPainter::RenderHints hints)
 }
 
 /*!
-    If \a enabled is true, the render hint \a hint is enabled; otherwise it
-    is disabled.
-
     \since 4.6
-    \sa renderHints
+    If \a enabled is true, enables the specified render \a hint; otherwise
+    disables it.
+
+    \sa renderHints, QPainter::renderHints()
 */
 void QWebView::setRenderHint(QPainter::RenderHint hint, bool enabled)
 {
diff --git a/WebKit/qt/Api/qwebview.h b/WebKit/qt/Api/qwebview.h
index 15b5836..b63a593 100644
--- a/WebKit/qt/Api/qwebview.h
+++ b/WebKit/qt/Api/qwebview.h
@@ -53,9 +53,8 @@ class QWEBKIT_EXPORT QWebView : public QWidget {
 
 // FIXME: temporary work around for elftran issue that it couldn't find the QPainter::staticMetaObject
 // symbol from Qt lib; it should be reverted after the right symbol is exported.  
-// remember to revert the qdoc \property comment as well.
 // See bug: http://qt.nokia.com/developer/task-tracker/index_html?method=entry&id=258893
-#if !defined(Q_OS_SYMBIAN)
+#if defined(Q_QDOC) || !defined(Q_OS_SYMBIAN)
     Q_PROPERTY(QPainter::RenderHints renderHints READ renderHints WRITE setRenderHints)
 #endif
     Q_FLAGS(QPainter::RenderHints)
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 5aff018..67cf7f3 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,823 @@
+2009-10-28  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] WebFrame::counterValueForElementById must not be exposed
+        https://bugs.webkit.org/show_bug.cgi?id=30882
+
+        * Api/qwebframe.cpp:
+        (qt_drt_counterValueForElementById):
+        * Api/qwebframe.h:
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::counterValueForElementById):
+        (QWebHitTestResult::frame):
+        * Api/qwebframe.h:
+
+2009-10-28  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Pushing missing WebKit/qt/tests/qwebframe/resources/ dir from bug 29248.
+
+        [Qt] [API] Make it possible to have 'invisible' loads
+        https://bugs.webkit.org/show_bug.cgi?id=29248
+
+        * tests/qwebframe/resources/image2.png: Copied from WebKit/qt/tests/qwebelement/image.png.
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Make the versioning internal and enforce it in the WebCore
+        part. Adjust the comments, as well as remove now dead code.
+
+        * Api/qwebhistory.cpp:
+        (operator<<):
+        (operator>>):
+        * Api/qwebhistory.h:
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] QWebHistory::saveState() is inconsistent with the Qt API
+        https://bugs.webkit.org/show_bug.cgi?id=30710
+
+        Remove the QWebHistory::saveState() and ::restoreState() as
+        they are inconsistent with the Qt API.
+
+        Update unittests to reflect the change.
+
+        * Api/qwebhistory.cpp:
+        (operator<<):
+        (operator>>):
+        * Api/qwebhistory.h:
+        * tests/qwebhistory/tst_qwebhistory.cpp:
+        (saveHistory):
+        (restoreHistory):
+        (tst_QWebHistory::saveAndRestore_crash_1):
+        (tst_QWebHistory::saveAndRestore_crash_2):
+        (tst_QWebHistory::saveAndRestore_crash_3):
+        (tst_QWebHistory::clear):
+
+2009-10-27  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Complementary fix to bug 30779.
+
+        By mistake I used QWeakPointer's toStrongRef() method which docs
+        explicitly say to not be used in this situation (when the tracked
+        pointer is devired from QObject). Instead QWeakPointer's data()
+        is recommended.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::view):
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The HitTestResult::boundingBox method was removed. The
+        RenderObject must be used directly. In contrast to the
+        old HitTestResult::boundingBox method this code must use
+        a (3d) transformation aware method to not run into an
+        assert in SVGRenderBase::mapLocalToContainer.
+
+        * Api/qwebframe.cpp:
+        (QWebHitTestResultPrivate::QWebHitTestResultPrivate):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Oliver Hunt.
+
+        Change two methods to be internal for DRT use only.
+
+        Part of [Qt] Review all new API in Qt 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=29843#c11
+
+        * Api/qwebsecurityorigin.cpp:
+        (qt_drt_whiteListAccessFromOrigin):
+        (qt_drt_resetOriginAccessWhiteLists):
+        (QWebSecurityOrigin::localSchemes):
+        * Api/qwebsecurityorigin.h:
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make sure that initiating a rotation while rotating won't make
+        it end up at rotation positions that are not a multiply of
+        180 degrees.
+
+        * QGVLauncher/main.cpp:
+        (MainView::animatedFlip):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed Qt build fix.
+
+        Update the tests as well to the new API change.
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::clear):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Tor Arne Vestbø.
+
+        [Qt] QWebElement::removeChildren() should be
+        QWebElement::removeAllChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=30630
+
+        * Api/qwebelement.cpp:
+        (QWebElement::removeAllChildren):
+        * Api/qwebelement.h:
+
+2009-10-27  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Antti Koivisto and Holger Freyther.
+
+        Make QWebPagePrivate's (QWidget) view to be a QWeakPointer.
+        https://bugs.webkit.org/show_bug.cgi?id=30779
+
+        The fact that it was been set from external objects of qwebpage
+        and not being deleted internally can lead to dangling references.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::~QGraphicsWebView):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        (QWebPagePrivate::createContextMenu):
+        (QWebPagePrivate::handleSoftwareInputPanel):
+        (QWebPagePrivate::keyPressEvent):
+        (QWebPage::setView):
+        (QWebPage::view):
+        (QWebPage::javaScriptAlert):
+        (QWebPage::javaScriptConfirm):
+        (QWebPage::javaScriptPrompt):
+        (QWebPage::shouldInterruptJavaScript):
+        (QWebPage::createWindow):
+        (QWebPage::extension):
+        (QWebPage::chooseFile):
+        (QWebPage::userAgentForUrl):
+        * Api/qwebpage_p.h:
+        * Api/qwebview.cpp:
+        (QWebView::~QWebView):
+
+2009-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed documentation fix from David Boddie (Qt Doc Team)
+
+        Removes the check around the RenderHints property documentation
+        that was clearly added to synchronize the source and header files
+        when the #if !defined(Q_OS_SYMBIAN) guards was added to the
+        property.
+
+        The documentation has also been updated to ensure that Symbian
+        users know that there is no actual RenderHints property on their
+        platform.
+
+        * Api/qwebview.cpp:
+
+2009-10-26  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed documentation fix from David Boddie (Qt Doc Team)
+
+        Ensure that qdoc will always see the RenderHints property.
+
+        The property was only defined in the header file if the Q_OS_SYMBIAN
+        symbol was not defined, resulting in the property not showing up
+        in the Qt documentation just because one platform doesn't support it.
+
+        A follow up commit will improve the documentation for the property
+        and note that it is not supported on the Symbiam platform.
+
+        * Api/qwebview.h:
+
+2009-10-26  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Reintroduce QWebElementCollection
+
+        Revert the patch that has replaced QWebElementCollection 
+        with QList<QWebElement>. Update the tests accordingly.
+
+        Remove the constness of the return type of QWebElement operator[]. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=30767
+
+        * Api/qwebelement.cpp:
+        (QWebElement::findAll):
+        (QWebElementCollectionPrivate::QWebElementCollectionPrivate):
+        (QWebElementCollectionPrivate::create):
+        (QWebElementCollection::QWebElementCollection):
+        (QWebElementCollection::operator=):
+        (QWebElementCollection::~QWebElementCollection):
+        (QWebElementCollection::operator+):
+        (QWebElementCollection::append):
+        (QWebElementCollection::count):
+        (QWebElementCollection::at):
+        (QWebElementCollection::toList):
+        * Api/qwebelement.h:
+        (const_iterator::begin):
+        (const_iterator::end):
+        (const_iterator::operator[]):
+        * Api/qwebframe.cpp:
+        (QWebFrame::findAllElements):
+        * Api/qwebframe.h:
+        * QtLauncher/main.cpp:
+        (MainWindow::selectElements):
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::simpleCollection):
+        (tst_QWebElement::iteration):
+        (tst_QWebElement::emptyCollection):
+        (tst_QWebElement::appendCollection):
+        (tst_QWebElement::nullSelect):
+        (tst_QWebElement::hasSetFocus):
+        (tst_QWebElement::render):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2009-10-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] [Symbian] Set the capability and memory required to run QtWebKit for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=30476
+
+        Assign ReadUserData WriteUserData NetworkServices Symbian capabilities
+        to all QtWebkit executables.
+
+        * QGVLauncher/QGVLauncher.pro:
+        * QtLauncher/QtLauncher.pro:
+        * tests/benchmarks/loading/tst_loading.pro:
+        * tests/benchmarks/painting/tst_painting.pro:
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+        * tests/qwebelement/qwebelement.pro:
+        * tests/qwebframe/qwebframe.pro:
+        * tests/qwebhistory/qwebhistory.pro:
+        * tests/qwebhistoryinterface/qwebhistoryinterface.pro:
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebplugindatabase/qwebplugindatabase.pro:
+        * tests/qwebview/qwebview.pro:
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (speculative build fix - qt is currently already broken!)
+        Build fix following bug #30696.
+
+        * Api/qwebelement.cpp:
+        (setupScriptContext):
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+
+2009-10-22  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Enable track visited links in QWebPage
+        https://bugs.webkit.org/show_bug.cgi?id=30574
+
+        Test: fast/history/clicked-link-is-visited.html
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+
+2009-10-22  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Add Print Shortcut to QtLauncher
+
+        https://bugs.webkit.org/show_bug.cgi?id=30682
+
+        * QtLauncher/main.cpp:
+        (MainWindow::setupUI):
+
+2009-10-22  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Rubberstamped by Tor Arne Vestbø.
+
+        Code standarlization for QGVLauncher.
+
+        1) Made member initilization lists in constructors
+           to be per line.
+        2) Made applyProxy method inline as all other methods in
+           WebPage class.
+
+        * QGVLauncher/main.cpp:
+        (WebPage::WebPage):
+        (WebPage::applyProxy):
+        (MainView::MainView):
+        (MainWindow::MainWindow):
+        (MainWindow::init):
+
+2009-10-22  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add a Y-Axis rotation to QGVLauncher.
+
+        It uses the QStateMachine API from Qt 4.6.
+
+        * QGVLauncher/main.cpp:
+        (WebView::WebView):
+        (WebView::setYRotation):
+        (WebView::yRotation):
+        (MainView::flip):
+        (MainView::animatedYFlip):
+        (SharedScene::SharedScene):
+        (SharedScene::webView):
+        (MainWindow::init):
+        (MainWindow::animatedYFlip):
+        (MainWindow::buildUI):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed By Adam Barth.
+
+        Add some actions to the menu for cursor debugging.
+
+        GraphicsView based launcher only.
+
+        * QGVLauncher/main.cpp:
+        (MainView::setWaitCursor):
+        (MainView::resetCursor):
+        (MainView::flip):
+        (MainWindow::setWaitCursor):
+        (MainWindow::resetCursor):
+        (MainWindow::buildUI):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Adam Barth.
+
+        Remove clipRenderToViewport as agreed upon in
+        https://bugs.webkit.org/show_bug.cgi?id=29843
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::QWebFramePrivate):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Update the tests to test the new render functionality, and take
+        into consideration that render() clips to the frame itself as well
+        as the viewport.
+
+        QWebFrame::render() now always clips, so the old tests were bogus.
+
+        Rendering pure contents (no scrollbars etc) without clipping can now
+        be accomplished using QWebFrame::documentElement()->render(...)
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::QWebFramePrivate):
+        * tests/qwebframe/tst_qwebframe.cpp:
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Adam Barth.
+
+        As we do not support rendering a QWebFrame without it being clipped
+        the the frame as well as the viewport, we now set the viewport size
+        to the size of the contents.
+
+        Rendering pure contents (no scrollbars etc) without clipping can be
+        acomplished using QWebFrame::documentElement()->render(...)
+
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::render):
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add menu item to dump the plugin list to the console,
+        which can be handy for debugging.
+
+        * QtLauncher/main.cpp:
+        (MainWindow::dumpPlugins):
+        (MainWindow::setupUI):
+
+2009-10-19  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Introduce new render method on QWebFrame, which supports specifying
+        which layers to render (scrollbars, contents, pan-icon).
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderPrivate):
+        (QWebFrame::render):
+        * Api/qwebframe.h:
+        * Api/qwebframe_p.h:
+
+2009-10-19  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Infinite loop (leading to crash) when setting cursor in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30549
+
+        Patch reimplements QGraphicsItem's itemChange method, and make
+        CursorChange event to be emitted after cursor has already been
+        set.
+
+        QWidget::setCursor send the event just after it sets the cursor,
+        then patch makes both behaviors compatible.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::itemChange):
+        * Api/qgraphicswebview.h:
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Update call to FrameLoader::loadFrameRequest().
+
+        * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
+
+2009-10-19  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Add QWebElement::render API which allows rendering of single
+        element.
+
+        * Api/qwebelement.cpp:
+        (QWebElement::render):
+        * Api/qwebelement.h:
+        * tests/qwebelement/tst_qwebelement.cpp:
+        (tst_QWebElement::render):
+        * tests/qwebelement/qwebelement.qrc:
+        * tests/qwebelement/image.png: Added.
+
+2009-10-19  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        QWebPage: Doc: setNetworkAccessManager should only be called once.
+
+        * Api/qwebpage.cpp:
+
+2009-10-19  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne.
+
+        Wrong ifdef combination in QGraphicsWebView's event method.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Don't crash when client is 0.
+        
+        Client is 0 when we use QWebPage without a QWebView or QGraphicsWebView.
+        In addition, setFrameRect()/updatePluginWidget() is called even if the
+        plugin was not succesfully loaded. updatePluginWidget() updates the
+        window rect which is, in theory, useful to draw something that indicates
+        that we didn't load successfully.
+        
+        So, a status check is added to setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30380
+
+        * tests/qwebpage/qwebpage.pro:
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (takeScreenshot):
+        (tst_QWebPage::screenshot_data):
+        (tst_QWebPage::screenshot):
+        * tests/resources/test.swf: Copied from LayoutTests/fast/replaced/resources/test.swf.
+
+2009-10-19  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Windowed Plugins: Fix crash when QWebPage is deleted after QWebView.
+        
+        Fixes various sources of crashes:
+        1. The PluginContainer is a child of QWebView. When the view gets deleted,
+        the PluginView is not notified about the deletion of PluginContainer.
+        2. QWebView destructor does not set client to 0.
+        3. Sometimes pending paint events are sent after the plugin has died, so add
+        a check in PluginView::setNPWindowIfNeeded.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30354
+
+        * Api/qwebview.cpp:
+        (QWebView::~QWebView):
+        * tests/qwebview/qwebview.pro:
+        * tests/qwebview/tst_qwebview.cpp:
+        (tst_QWebView::reusePage_data):
+        (tst_QWebView::reusePage):
+
+2009-10-19  Jakob Truelsen  <antialize@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29042
+
+        Allow one to costumize the minimal and maximal shrink factors,
+        Added methods setPrintingMinimumShrinkFactor, printingMinimumShrinkFactor,
+        setPrintingMaximumShrinkFactor, printingMaximumShrinkFactor to QWebSettings.
+
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        (QWebSettings::setPrintingMinimumShrinkFactor):
+        (QWebSettings::printingMinimumShrinkFactor):
+        (QWebSettings::setPrintingMaximumShrinkFactor):
+        (QWebSettings::printingMaximumShrinkFactor):
+        * Api/qwebsettings.h:
+
+2009-10-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Rename fixedContentsSize property to preferredContentsSize as
+        agreed upon with Simon Hausmann and Matthias Ettrich.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::preferredContentsSize):
+        (QWebPage::setPreferredContentsSize):
+        * Api/qwebpage.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::transitionToCommittedForNewPage):
+
+2009-10-16  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QGLauncher leaks WebPage object
+        https://bugs.webkit.org/show_bug.cgi?id=30465
+
+        Make 'SharedScene' to own 'WebPage' reference and delete it at its destructor.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::view):
+        * Api/qwebpage_p.h:
+        * QGVLauncher/main.cpp:
+        (SharedScene::SharedScene):
+        (SharedScene::~SharedScene):
+
+2009-10-16  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] "dangling" pointer to qwebpage's view object can leads QGLauncher to crash
+        https://bugs.webkit.org/show_bug.cgi?id=30459
+
+        Remove all setView(ev->widget()) calls in QWebPage and QGWV event handling methods,
+        since QWebPageClient would do the trick.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::hoverMoveEvent):
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragLeaveEvent):
+        (QWebPagePrivate::dragMoveEvent):
+
+2009-10-16  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Pull out r49676 as it caused build breakges on Symbian
+
+        * Api/qwebpage.cpp:
+
+2009-10-16  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Need a way to inform the application when a Netscape plugin is created or deleted
+        https://bugs.webkit.org/show_bug.cgi?id=30179
+
+        Added "c" style static methods for the application to hook up for
+        receiving notifications when a plugin is created or destroyed.
+
+        * Api/qwebpage.cpp:
+
+2009-10-15  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Rubberstamped by Tor Arne.
+
+        Make QGLauncher's WebPage class constructor to get a QObject* as parent (not QWidget*).
+
+        * QGVLauncher/main.cpp:
+        (WebPage::WebPage):
+
+2009-10-15  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Tor Arne.
+
+        [Qt] QGLauncher crashes while closing a window
+        https://bugs.webkit.org/show_bug.cgi?id=30385
+
+        Set page's pageClient reference to '0' at QGWV deletion.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::~QGraphicsWebView):
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (WebPage::WebPage):
+        (WebPage::aborting):
+        (tst_QGraphicsWebView::crashOnViewlessWebPages):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make context menu to work in QGraphicsWebView
+        https://bugs.webkit.org/show_bug.cgi?id=30336
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::event):
+
+2009-10-13  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Plugins : Remove all traces of winId. Use ownerWidget() instead.
+        
+        This is a bug for two reasons:
+        1. Everytime we use winId(), we end up creating a native widget. This causes an
+        unnecessary copy of contents from the backing store to the native widget.
+        2. Neither windowed nor windowless plugins require the winId of the QWebView or
+        QGraphicsView.
+        
+        Introduce ownerWidget() which returns a QWidget * without creating a native widget
+        (as opposed to QWidget::find(winId)).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30170
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::ownerWidget):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::ownerWidget):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add some initial autotests for QWebPage's ErrorPageExtention
+        https://bugs.webkit.org/show_bug.cgi?id=30296
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (ErrorPage::ErrorPage):
+        (ErrorPage::supportsExtension):
+        (ErrorPage::extension):
+        (tst_QWebPage::errorPageExtension):
+
+2009-10-13  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] better handle possible edge cases on qwebframe::requestedUrl use
+        https://bugs.webkit.org/show_bug.cgi?id=30216
+
+        QWebFrame::requestedUrl can be called at any time during the load
+        process, including:
+
+        * An error handling (whereas an alternate error page for unsuccessful
+          load is being set);
+        * A ssl error exception call;
+        * During navigation notifications/callbacks (titleChanged, urlChanged,
+          progresses, addHistoryEntry, etc);
+        * Among others.
+
+        This patch makes requestedUrl calls to fallback to FrameLoaderClient
+        m_loadError's failingURL when an error has occurred, unless it is
+        null/empty.
+
+        Also, m_loadError is now being reset at each the main frame starts a
+        load, in order to avoid previous load errors footprints.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::requestedUrl):
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::postProgressStartedNotification):
+
+2009-10-12  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Missing default value for the default text encoding.
+        https://bugs.webkit.org/show_bug.cgi?id=30311
+
+        QtWebKit has provided a default, hardcoded value for default charset but since
+        the addition of the defaultTextEncoding setting in QWebSettings, that hardcoded
+        value has had no effect.
+
+        Added a regression test and unskipped fast/dom/Document/document-charset.html,
+        which is passing now.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettings::QWebSettings):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::defaultTextEncoding):
+
+2009-10-12  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement the new palette() methods on the page clients
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::palette):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::palette):
+
+2009-10-12  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QWebPage's createViewlessPlugin autotest crash fix.
+        
+        It is possible that plugins that are QWidgets or QGraphicsWidgets
+        are created before a view has been assigned to a QWebPage. The
+        plug-ins won't be fully functional, as by design, they should
+        visualise something, but they won't crash and will stay in memory.
+
+        An autotest that covers this use-case, is included.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30118
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (PluginTrackedPageWidget::PluginTrackedPageWidget):
+        (PluginTrackedPageGraphicsWidget::PluginTrackedPageGraphicsWidget):
+        (PluginTrackedPageGraphicsWidget::createPlugin):
+        (tst_QWebPage::destroyPlugin):
+        (tst_QWebPage::createViewlessPlugin):
+
+2009-10-09  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Sets Qt::WA_InputMethodEnabled and Qt::ImhHiddenText for password fields in EditorClientQt
+        setInputMethodState. This change is needed so widgets such as the s60 software 
+        input panel can receive input method events for password fields.
+        It's up to the Qt platform to determine which widget will receive input method 
+        events when these flags are set.
+        Also added implementation for setInputMethodEnabled and setInputMethodHint 
+        to QGraphicsWebViewPrivate and QWebViewPrivate. This change removes the direct
+        dependency on QWebView and uses QWebPageClient.
+        Added autotest to tst_qwebpage.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=30023
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::setInputMethodEnabled):
+        (QGraphicsWebViewPrivate::setInputMethodHint):
+        * Api/qwebview.cpp:
+        (QWebViewPrivate::setInputMethodEnabled):
+        (QWebViewPrivate::setInputMethodHint):
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::setInputMethodState):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::inputMethods):
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * Api/qwebframe.cpp:
+        (QWebFrame::evaluateJavaScript):
+
 2009-10-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/WebKit/qt/QGVLauncher/QGVLauncher.pro b/WebKit/qt/QGVLauncher/QGVLauncher.pro
index dec1c9b..059ec1a 100644
--- a/WebKit/qt/QGVLauncher/QGVLauncher.pro
+++ b/WebKit/qt/QGVLauncher/QGVLauncher.pro
@@ -10,4 +10,7 @@ QT += network
 macx:QT+=xml
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E544
+symbian {
+    TARGET.UID3 = 0xA000E544
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/QGVLauncher/main.cpp b/WebKit/qt/QGVLauncher/main.cpp
index 1d67c35..3632a33 100644
--- a/WebKit/qt/QGVLauncher/main.cpp
+++ b/WebKit/qt/QGVLauncher/main.cpp
@@ -50,28 +50,71 @@
 #include <qwebsettings.h>
 #include <qwebview.h>
 
+class WebView : public QGraphicsWebView {
+    Q_OBJECT
+    Q_PROPERTY(qreal yRotation READ yRotation WRITE setYRotation)
+
+public:
+    WebView(QGraphicsItem* parent = 0)
+        : QGraphicsWebView(parent)
+    {
+    }
+    void setYRotation(qreal angle)
+    {
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        QRectF r = boundingRect();
+        setTransform(QTransform()
+            .translate(r.width() / 2, r.height() / 2)
+            .rotate(angle, Qt::YAxis)
+            .translate(-r.width() / 2, -r.height() / 2));
+#endif
+        m_yRotation = angle;
+    }
+    qreal yRotation() const
+    {
+        return m_yRotation;
+    }
+
+private:
+    qreal m_yRotation;
+};
+
 class WebPage : public QWebPage {
     Q_OBJECT
 
 public:
-    WebPage(QWidget* parent = 0) : QWebPage(parent)
+    WebPage(QObject* parent = 0)
+        : QWebPage(parent)
     {
         applyProxy();
     }
     virtual QWebPage* createWindow(QWebPage::WebWindowType);
 
 private:
-    void applyProxy();
+    void applyProxy()
+    {
+        QUrl proxyUrl = QWebView::guessUrlFromString(qgetenv("http_proxy"));
+
+        if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
+            int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
+            networkAccessManager()->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort));
+        }
+    }
 };
 
 class MainView : public QGraphicsView {
     Q_OBJECT
 
 public:
-    MainView(QWidget* parent) : QGraphicsView(parent), m_mainWidget(0)
+    MainView(QWidget* parent)
+        : QGraphicsView(parent)
+        , m_mainWidget(0)
     {
         setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
         setVerticalScrollBarPolicy(Qt::ScrollBarAlwaysOff);
+
+        setFrameShape(QFrame::NoFrame);
+        setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
     }
 
     void setMainWidget(QGraphicsWidget* widget)
@@ -90,6 +133,16 @@ public:
         m_mainWidget->setGeometry(rect);
     }
 
+    void setWaitCursor()
+    {
+        m_mainWidget->setCursor(Qt::WaitCursor);
+    }
+
+    void resetCursor()
+    {
+        m_mainWidget->unsetCursor();
+    }
+
 public slots:
     void flip()
     {
@@ -111,11 +164,24 @@ public slots:
 
         QPropertyAnimation* animation = new QPropertyAnimation(m_mainWidget, "rotation", this);
         animation->setDuration(1000);
-        animation->setStartValue(m_mainWidget->rotation());
-        animation->setEndValue(m_mainWidget->rotation() + 180);
+
+        int rotation = int(m_mainWidget->rotation());
+
+        animation->setStartValue(rotation);
+        animation->setEndValue(rotation + 180 - (rotation % 180));
+
         animation->start(QAbstractAnimation::DeleteWhenStopped);
 #endif
     }
+
+    void animatedYFlip()
+    {
+        emit flipRequest();
+    }
+
+signals:
+    void flipRequest();
+
 private:
     QGraphicsWidget* m_mainWidget;
 };
@@ -125,9 +191,8 @@ public:
     SharedScene()
     {
         m_scene = new QGraphicsScene;
-
-        m_item = new QGraphicsWebView;
-        m_item->setPage(new WebPage());
+        m_item = new WebView;
+        m_item->setPage((m_page = new WebPage));
 
         m_scene->addItem(m_item);
         m_scene->setActiveWindow(m_item);
@@ -137,29 +202,34 @@ public:
     {
         delete m_item;
         delete m_scene;
+        delete m_page;
     }
 
     QGraphicsScene* scene() const { return m_scene; }
-    QGraphicsWebView* webView() const { return m_item; }
+    WebView* webView() const { return m_item; }
 
 private:
     QGraphicsScene* m_scene;
-    QGraphicsWebView* m_item;
+    WebView* m_item;
+    WebPage* m_page;
 };
 
-
 class MainWindow : public QMainWindow {
     Q_OBJECT
 
 public:
     MainWindow(QExplicitlySharedDataPointer<SharedScene> other)
-        : QMainWindow(), view(new MainView(this)), scene(other)
+        : QMainWindow()
+        , view(new MainView(this))
+        , scene(other)
     {
         init();
     }
 
     MainWindow()
-        : QMainWindow(), view(new MainView(this)), scene(new SharedScene())
+        : QMainWindow()
+        , view(new MainView(this))
+        , scene(new SharedScene())
     {
         init();
     }
@@ -169,8 +239,7 @@ public:
         setAttribute(Qt::WA_DeleteOnClose);
 
         view->setScene(scene->scene());
-        view->setFrameShape(QFrame::NoFrame);
-        view->setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
+
         setCentralWidget(view);
 
         view->setMainWidget(scene->webView());
@@ -179,6 +248,30 @@ public:
         connect(scene->webView(), SIGNAL(titleChanged(const QString&)), this, SLOT(setWindowTitle(const QString&)));
         connect(scene->webView()->page(), SIGNAL(windowCloseRequested()), this, SLOT(close()));
 
+#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 0)
+        QStateMachine *machine = new QStateMachine(this);
+        QState *s0 = new QState(machine);
+        s0->assignProperty(scene->webView(), "yRotation", 0);
+
+        QState *s1 = new QState(machine);
+        s1->assignProperty(scene->webView(), "yRotation", 90);
+
+        QAbstractTransition *t1 = s0->addTransition(view, SIGNAL(flipRequest()), s1);
+        QPropertyAnimation *yRotationAnim = new QPropertyAnimation(scene->webView(), "yRotation", this);
+        yRotationAnim->setDuration(1000);
+        t1->addAnimation(yRotationAnim);
+
+        QState *s2 = new QState(machine);
+        s2->assignProperty(scene->webView(), "yRotation", -90);
+        s1->addTransition(s1, SIGNAL(polished()), s2);
+
+        QAbstractTransition *t2 = s2->addTransition(s0);
+        t2->addAnimation(yRotationAnim);
+
+        machine->setInitialState(s0);
+        machine->start();
+#endif
+
         resize(640, 480);
         buildUI();
     }
@@ -245,6 +338,16 @@ public slots:
         mw->show();
     }
 
+    void setWaitCursor()
+    {
+        view->setWaitCursor();
+    }
+
+    void resetCursor()
+    {
+        view->resetCursor();
+    }
+
     void flip()
     {
         view->flip();
@@ -254,6 +357,12 @@ public slots:
     {
         view->animatedFlip();
     }
+
+    void animatedYFlip()
+    {
+        view->animatedYFlip();
+    }
+
 private:
     void buildUI()
     {
@@ -278,9 +387,14 @@ private:
         viewMenu->addAction(page->action(QWebPage::Stop));
         viewMenu->addAction(page->action(QWebPage::Reload));
 
+        QMenu* testMenu = menuBar()->addMenu("&Tests");
+        testMenu->addAction("Set Wait Cursor", this, SLOT(setWaitCursor()), QKeySequence("Ctrl+W"));
+        testMenu->addAction("Reset Cursor", this, SLOT(resetCursor()), QKeySequence("Ctrl+Shift+W"));
+
         QMenu* fxMenu = menuBar()->addMenu("&Effects");
         fxMenu->addAction("Flip", this, SLOT(flip()));
-        fxMenu->addAction("Animated Flip", this, SLOT(animatedFlip()));
+        fxMenu->addAction("Animated Flip", this, SLOT(animatedFlip()), QKeySequence("Ctrl+R"));
+        fxMenu->addAction("Animated Y-Flip", this, SLOT(animatedYFlip()), QKeySequence("Ctrl+Y"));
     }
 
 private:
@@ -297,16 +411,6 @@ QWebPage* WebPage::createWindow(QWebPage::WebWindowType)
     return mw->page();
 }
 
-void WebPage::applyProxy()
-{
-    QUrl proxyUrl = QWebView::guessUrlFromString(qgetenv("http_proxy"));
-
-    if (proxyUrl.isValid() && !proxyUrl.host().isEmpty()) {
-        int proxyPort = (proxyUrl.port() > 0) ? proxyUrl.port() : 8080;
-        networkAccessManager()->setProxy(QNetworkProxy(QNetworkProxy::HttpProxy, proxyUrl.host(), proxyPort));
-    }
-}
-
 int main(int argc, char** argv)
 {
     QApplication app(argc, argv);
diff --git a/WebKit/qt/QtLauncher/QtLauncher.pro b/WebKit/qt/QtLauncher/QtLauncher.pro
index 5b10dea..133869c 100644
--- a/WebKit/qt/QtLauncher/QtLauncher.pro
+++ b/WebKit/qt/QtLauncher/QtLauncher.pro
@@ -10,4 +10,7 @@ QT += network
 macx:QT+=xml
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E543
+symbian {
+    TARGET.UID3 = 0xA000E543
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/QtLauncher/main.cpp b/WebKit/qt/QtLauncher/main.cpp
index 8cc8a09..e3c6116 100644
--- a/WebKit/qt/QtLauncher/main.cpp
+++ b/WebKit/qt/QtLauncher/main.cpp
@@ -34,6 +34,7 @@
 #include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebsettings.h>
+#include <qwebplugindatabase.h>
 #include <qwebelement.h>
 #include <qwebinspector.h>
 
@@ -232,6 +233,16 @@ protected slots:
         formatMenuAction->setVisible(on);
     }
 
+    void dumpPlugins() {
+        QList<QWebPluginInfo> plugins = QWebSettings::pluginDatabase()->plugins();
+        foreach (const QWebPluginInfo plugin, plugins) {
+            qDebug() << "Plugin:" << plugin.name();
+            foreach (const QWebPluginInfo::MimeType mime, plugin.mimeTypes()) {
+                qDebug() << "   " << mime.name;
+            }
+        }
+    }
+
     void dumpHtml() {
         qDebug() << "HTML: " << view->page()->mainFrame()->toHtml();
     }
@@ -242,7 +253,7 @@ protected slots:
                                             QLineEdit::Normal, "a", &ok);
 
         if (ok && !str.isEmpty()) {
-            QList<QWebElement> result =  view->page()->mainFrame()->findAllElements(str);
+            QWebElementCollection result =  view->page()->mainFrame()->findAllElements(str);
             foreach (QWebElement e, result)
                 e.setStyleProperty("background-color", "yellow");
             statusBar()->showMessage(QString("%1 element(s) selected").arg(result.count()), 5000);
@@ -292,7 +303,7 @@ private:
         QMenu *fileMenu = menuBar()->addMenu("&File");
         QAction *newWindow = fileMenu->addAction("New Window", this, SLOT(newWindow()));
 #if QT_VERSION >= 0x040400
-        fileMenu->addAction(tr("Print"), this, SLOT(print()));
+        fileMenu->addAction(tr("Print"), this, SLOT(print()), QKeySequence::Print);
 #endif
         QAction* screenshot = fileMenu->addAction("Screenshot", this, SLOT(screenshot()));
         fileMenu->addAction("Close", this, SLOT(close()));
@@ -320,6 +331,7 @@ private:
         zoomTextOnly->setChecked(false);
         viewMenu->addSeparator();
         viewMenu->addAction("Dump HTML", this, SLOT(dumpHtml()));
+        viewMenu->addAction("Dump plugins", this, SLOT(dumpPlugins()));
 
         QMenu *formatMenu = new QMenu("F&ormat", this);
         formatMenuAction = menuBar()->addMenu(formatMenu);
diff --git a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 5d5df97..34241f0 100644
--- a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -41,6 +41,7 @@
 #include "FocusController.h"
 #include "Frame.h"
 #include "HTMLElement.h"
+#include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
@@ -48,6 +49,7 @@
 #include "Page.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
+#include "QWebPageClient.h"
 #include "Range.h"
 
 #include <stdio.h>
@@ -596,10 +598,26 @@ bool EditorClientQt::isEditing() const
 
 void EditorClientQt::setInputMethodState(bool active)
 {
-    QWidget *view = m_page->view();
-    if (view)
-        view->setAttribute(Qt::WA_InputMethodEnabled, active);
-
+    QWebPageClient* webPageClient = m_page->d->client;
+    if (webPageClient) {
+#if QT_VERSION >= 0x040600
+        bool isPasswordField = false;
+        if (!active) {
+            // Setting the Qt::WA_InputMethodEnabled attribute true and Qt::ImhHiddenText flag
+            // for password fields. The Qt platform is responsible for determining which widget 
+            // will receive input method events for password fields.
+            Frame* frame = m_page->d->page->focusController()->focusedOrMainFrame();
+            if (frame && frame->document() && frame->document()->focusedNode()) {
+                if (frame->document()->focusedNode()->hasTagName(HTMLNames::inputTag)) {
+                    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(frame->document()->focusedNode());
+                    active = isPasswordField = inputElement->isPasswordField();
+              }
+            }
+        }
+        webPageClient->setInputMethodHint(Qt::ImhHiddenText, isPasswordField);
+#endif
+        webPageClient->setInputMethodEnabled(active);
+    }
     emit m_page->microFocusChanged();
 }
 
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 665f16a..81ccbe8 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -214,12 +214,12 @@ void FrameLoaderClientQt::transitionToCommittedForNewPage()
     QColor backgroundColor = brush.style() == Qt::SolidPattern ? brush.color() : QColor();
 
     QWebPage* page = m_webFrame->page();
-    const QSize fixedLayoutSize = page->fixedContentsSize();
+    const QSize preferredLayoutSize = page->preferredContentsSize();
 
     m_frame->createView(m_webFrame->page()->viewportSize(),
                         backgroundColor, !backgroundColor.alpha(),
-                        fixedLayoutSize.isValid() ? IntSize(fixedLayoutSize) : IntSize(),
-                        fixedLayoutSize.isValid(),
+                        preferredLayoutSize.isValid() ? IntSize(preferredLayoutSize) : IntSize(),
+                        preferredLayoutSize.isValid(),
                         (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Horizontal),
                         (ScrollbarMode)m_webFrame->scrollBarPolicy(Qt::Vertical));
 }
@@ -378,7 +378,8 @@ void FrameLoaderClientQt::dispatchDidFinishLoad()
     if (dumpFrameLoaderCallbacks)
         printf("%s - didFinishLoadForFrame\n", qPrintable(drtDescriptionSuitableForTestResult(m_frame)));
 
-    m_loadError = ResourceError(); // clears the previous error
+    // Clears the previous error.
+    m_loadError = ResourceError();
 
     if (!m_webFrame)
         return;
@@ -432,6 +433,8 @@ void FrameLoaderClientQt::revertToProvisionalState(DocumentLoader*)
 void FrameLoaderClientQt::postProgressStartedNotification()
 {
     if (m_webFrame && m_frame->page()) {
+        // A new load starts, so lets clear the previous error.
+        m_loadError = ResourceError();
         emit loadStarted();
         postProgressEstimateChangedNotification();
     }
@@ -1230,9 +1233,12 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
         if (object) {
             QWidget* widget = qobject_cast<QWidget*>(object);
             if (widget) {
-                QWidget* parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
-                if (parentWidget)
-                    widget->setParent(parentWidget);
+                QWidget* parentWidget;
+                if (m_webFrame->page()->d->client)
+                    parentWidget = qobject_cast<QWidget*>(m_webFrame->page()->d->client->pluginParent());
+                else
+                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
+                widget->setParent(parentWidget);
                 RefPtr<QtPluginWidget> w = adoptRef(new QtPluginWidget());
                 w->setPlatformWidget(widget);
                 // Make sure it's invisible until properly placed into the layout
@@ -1242,8 +1248,13 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
 #if QT_VERSION >= 0x040600
             QGraphicsWidget* graphicsWidget = qobject_cast<QGraphicsWidget*>(object);
             if (graphicsWidget) {
+                QGraphicsObject* parentWidget;
+                if (m_webFrame->page()->d->client)
+                    parentWidget = qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent());
+                else
+                    parentWidget = 0;  // The plug-in won't be fully functional because the QWebView doesn't exist.
                 graphicsWidget->hide();
-                graphicsWidget->setParentItem(qobject_cast<QGraphicsObject*>(m_webFrame->page()->d->client->pluginParent()));
+                graphicsWidget->setParentItem(parentWidget);
                 RefPtr<QtPluginGraphicsWidget> w = QtPluginGraphicsWidget::create(graphicsWidget);
                 // Make sure it's invisible until properly placed into the layout
                 w->setFrameRect(IntRect(0, 0, 0, 0));
diff --git a/WebKit/qt/tests/benchmarks/loading/tst_loading.pro b/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
index 80717c2..bc5e75f 100644
--- a/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
+++ b/WebKit/qt/tests/benchmarks/loading/tst_loading.pro
@@ -5,4 +5,7 @@ SOURCES += tst_loading.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E541
+symbian {
+    TARGET.UID3 = 0xA000E541
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/benchmarks/painting/tst_painting.pro b/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
index f45d804..48c7072 100644
--- a/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
+++ b/WebKit/qt/tests/benchmarks/painting/tst_painting.pro
@@ -5,4 +5,7 @@ SOURCES += tst_painting.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E542
+symbian {
+    TARGET.UID3 = 0xA000E542
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro b/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
index cba6f11..57b4437 100644
--- a/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
+++ b/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
@@ -4,3 +4,7 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qgraphicswebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+
+symbian {
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index 1a57286..4bdb7f5 100644
--- a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -19,7 +19,33 @@
 
 #include <QtTest/QtTest>
 
+#include <QGraphicsView>
 #include <qgraphicswebview.h>
+#include <qwebpage.h>
+#include <qwebframe.h>
+
+/**
+ * Starts an event loop that runs until the given signal is received.
+ * Optionally the event loop
+ * can return earlier on a timeout.
+ *
+ * \return \p true if the requested signal was received
+ *         \p false on timeout
+ */
+static bool waitForSignal(QObject* obj, const char* signal, int timeout = 10000)
+{
+    QEventLoop loop;
+    QObject::connect(obj, signal, &loop, SLOT(quit()));
+    QTimer timer;
+    QSignalSpy timeoutSpy(&timer, SIGNAL(timeout()));
+    if (timeout > 0) {
+        QObject::connect(&timer, SIGNAL(timeout()), &loop, SLOT(quit()));
+        timer.setSingleShot(true);
+        timer.start(timeout);
+    }
+    loop.exec();
+    return timeoutSpy.isEmpty();
+}
 
 class tst_QGraphicsWebView : public QObject
 {
@@ -27,6 +53,7 @@ class tst_QGraphicsWebView : public QObject
 
 private slots:
     void qgraphicswebview();
+    void crashOnViewlessWebPages();
 };
 
 void tst_QGraphicsWebView::qgraphicswebview()
@@ -53,6 +80,55 @@ void tst_QGraphicsWebView::qgraphicswebview()
     item.setContent(QByteArray());
 }
 
+class WebPage : public QWebPage
+{
+    Q_OBJECT
+
+public:
+    WebPage(QObject* parent = 0): QWebPage(parent)
+    {
+    }
+
+    QGraphicsWebView* webView;
+
+private slots:
+    // Force a webview deletion during the load.
+    // It should not cause WebPage to crash due to
+    // it accessing invalid pageClient pointer.
+    void aborting()
+    {
+        delete webView;
+    }
+};
+
+void tst_QGraphicsWebView::crashOnViewlessWebPages()
+{
+    QGraphicsScene scene;
+    QGraphicsView view(&scene);
+
+    QGraphicsWebView* webView = new QGraphicsWebView;
+    WebPage* page = new WebPage;
+    webView->setPage(page);
+    page->webView = webView;
+    connect(page->mainFrame(), SIGNAL(initialLayoutCompleted()), page, SLOT(aborting()));
+
+    scene.addItem(webView);
+
+    view.setSizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding);
+    view.resize(600, 480);
+    webView->resize(view.geometry().size());
+    QTest::qWait(200);
+    view.show();
+
+    page->mainFrame()->setHtml(QString("data:text/html,"
+                                            "<frameset cols=\"25%,75%\">"
+                                                "<frame src=\"data:text/html,foo \">"
+                                                "<frame src=\"data:text/html,bar\">"
+                                            "</frameset>"));
+
+    QVERIFY(::waitForSignal(page, SIGNAL(loadFinished(bool))));
+}
+
 QTEST_MAIN(tst_QGraphicsWebView)
 
 #include "tst_qgraphicswebview.moc"
diff --git a/WebKit/qt/tests/qwebelement/image.png b/WebKit/qt/tests/qwebelement/image.png
new file mode 100644
index 0000000..8d70364
--- /dev/null
+++ b/WebKit/qt/tests/qwebelement/image.png
diff --git a/WebKit/qt/tests/qwebelement/qwebelement.pro b/WebKit/qt/tests/qwebelement/qwebelement.pro
index 0a140ad..c45a9ac 100644
--- a/WebKit/qt/tests/qwebelement/qwebelement.pro
+++ b/WebKit/qt/tests/qwebelement/qwebelement.pro
@@ -6,4 +6,7 @@ RESOURCES += qwebelement.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E53A
+symbian {
+    TARGET.UID3 = 0xA000E53A
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebelement/qwebelement.qrc b/WebKit/qt/tests/qwebelement/qwebelement.qrc
index ed01440..28b9d7b 100644
--- a/WebKit/qt/tests/qwebelement/qwebelement.qrc
+++ b/WebKit/qt/tests/qwebelement/qwebelement.qrc
@@ -2,5 +2,6 @@
 <qresource prefix="/">
 <file>style.css</file>
 <file>style2.css</file>
+<file>image.png</file>
 </qresource>
 </RCC>
diff --git a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
index 00783d1..cf83fe8 100644
--- a/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
+++ b/WebKit/qt/tests/qwebelement/tst_qwebelement.cpp
@@ -70,7 +70,10 @@ private slots:
     void attributesNS();
     void classes();
     void namespaceURI();
+    void iteration();
     void foreachManipulation();
+    void emptyCollection();
+    void appendCollection();
     void evaluateJavaScript();
     void documentElement();
     void frame();
@@ -87,6 +90,7 @@ private slots:
     void firstChildNextSibling();
     void lastChildPreviousSibling();
     void hasSetFocus();
+    void render();
 
 private:
     QWebView* m_view;
@@ -133,7 +137,7 @@ void tst_QWebElement::simpleCollection()
     m_mainFrame->setHtml(html);
     QWebElement body = m_mainFrame->documentElement();
 
-    QList<QWebElement> list = body.findAll("p");
+    QWebElementCollection list = body.findAll("p");
     QCOMPARE(list.count(), 2);
     QCOMPARE(list.at(0).toPlainText(), QString("first para"));
     QCOMPARE(list.at(1).toPlainText(), QString("second para"));
@@ -266,6 +270,41 @@ void tst_QWebElement::namespaceURI()
 
 }
 
+void tst_QWebElement::iteration()
+{
+    QString html = "<body><p>first para</p><p>second para</p></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+
+   QWebElementCollection paras = body.findAll("p");
+    QList<QWebElement> referenceList = paras.toList();
+
+    QList<QWebElement> foreachList;
+    foreach(QWebElement p, paras) {
+       foreachList.append(p);
+    }
+    QVERIFY(foreachList.count() == 2);
+    QCOMPARE(foreachList.count(), referenceList.count());
+    QCOMPARE(foreachList.at(0), referenceList.at(0));
+    QCOMPARE(foreachList.at(1), referenceList.at(1));
+
+    QList<QWebElement> forLoopList;
+    for (int i = 0; i < paras.count(); ++i) {
+        forLoopList.append(paras.at(i));
+    }
+    QVERIFY(foreachList.count() == 2);
+    QCOMPARE(foreachList.count(), referenceList.count());
+    QCOMPARE(foreachList.at(0), referenceList.at(0));
+    QCOMPARE(foreachList.at(1), referenceList.at(1));
+
+    for (int i = 0; i < paras.count(); ++i) {
+        QCOMPARE(paras.at(i), paras[i]);
+    }
+
+    QCOMPARE(paras.at(0), paras.first());
+    QCOMPARE(paras.at(1), paras.last());
+}
+
 void tst_QWebElement::foreachManipulation()
 {
     QString html = "<body><p>first para</p><p>second para</p></body>";
@@ -279,6 +318,43 @@ void tst_QWebElement::foreachManipulation()
     QCOMPARE(body.findAll("div").count(), 4);
 }
 
+void tst_QWebElement::emptyCollection()
+{
+    QWebElementCollection emptyCollection;
+    QCOMPARE(emptyCollection.count(), 0);
+}
+
+void tst_QWebElement::appendCollection()
+{
+    QString html = "<body><span class='a'>aaa</span><p>first para</p><div>foo</div>"
+        "<span class='b'>bbb</span><p>second para</p><div>bar</div></body>";
+    m_mainFrame->setHtml(html);
+    QWebElement body = m_mainFrame->documentElement();
+
+    QWebElementCollection collection = body.findAll("p");
+    QCOMPARE(collection.count(), 2);
+
+    collection.append(body.findAll("div"));
+    QCOMPARE(collection.count(), 4);
+
+    collection += body.findAll("span.a");
+    QCOMPARE(collection.count(), 5);
+
+    QWebElementCollection all = collection + body.findAll("span.b");
+    QCOMPARE(all.count(), 6);
+    QCOMPARE(collection.count(), 5);
+
+     all += collection;
+    QCOMPARE(all.count(), 11);
+
+    QCOMPARE(collection.count(), 5);
+    QWebElementCollection test;
+    test.append(collection);
+    QCOMPARE(test.count(), 5);
+    test.append(QWebElementCollection());
+    QCOMPARE(test.count(), 5);
+}
+
 void tst_QWebElement::evaluateJavaScript()
 {
     QVariant result;
@@ -628,7 +704,7 @@ void tst_QWebElement::clear()
 
     QCOMPARE(body.findAll("div").count(), 1);
     QCOMPARE(body.findAll("p").count(), 3);
-    body.findFirst("div").removeChildren();
+    body.findFirst("div").removeAllChildren();
     QCOMPARE(body.findAll("div").count(), 1);
     QCOMPARE(body.findAll("p").count(), 2);
 }
@@ -772,7 +848,7 @@ void tst_QWebElement::nullSelect()
 {
     m_mainFrame->setHtml("<body><p>Test");
 
-    QList<QWebElement> collection = m_mainFrame->findAllElements("invalid{syn(tax;;%#$f223e>>");
+    QWebElementCollection collection = m_mainFrame->findAllElements("invalid{syn(tax;;%#$f223e>>");
     QVERIFY(collection.count() == 0);
 }
 
@@ -814,7 +890,7 @@ void tst_QWebElement::hasSetFocus()
                             "<input type='text' id='input2'/>" \
                             "</body></html>");
 
-    QList<QWebElement> inputs = m_mainFrame->documentElement().findAll("input");
+    QWebElementCollection inputs = m_mainFrame->documentElement().findAll("input");
     QWebElement input1 = inputs.at(0);
     input1.setFocus();
     QVERIFY(input1.hasFocus());
@@ -825,5 +901,81 @@ void tst_QWebElement::hasSetFocus()
     QVERIFY(input2.hasFocus());
 }
 
+void tst_QWebElement::render()
+{
+    QString html( "<html>"
+                    "<head><style>"
+                       "body, iframe { margin: 0px; border: none; }"
+                    "</style></head>"
+                    "<body><table width='300px' height='300px' border='1'>"
+                           "<tr>"
+                               "<td>test"
+                               "</td>"
+                               "<td><img src='qrc:///image.png'>"
+                               "</td>"
+                           "</tr>"
+                          "</table>"
+                    "</body>"
+                 "</html>"
+                );
+
+    QWebPage page;
+    QSignalSpy loadSpy(&page, SIGNAL(loadFinished(bool)));
+    page.mainFrame()->setHtml(html);
+
+    waitForSignal(&page, SIGNAL(loadFinished(bool)));
+    QCOMPARE(loadSpy.count(), 1);
+
+    QSize size = page.mainFrame()->contentsSize();
+    page.setViewportSize(size);
+
+    QWebElementCollection imgs = page.mainFrame()->findAllElements("img");
+    QCOMPARE(imgs.count(), 1);
+
+    QImage resource(":/image.png");
+    QRect imageRect(0, 0, resource.width(), resource.height());
+
+    QImage testImage(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter0(&testImage);
+    painter0.fillRect(imageRect, Qt::white);
+    painter0.drawImage(0, 0, resource);
+    painter0.end();
+
+    QImage image1(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter1(&image1);
+    painter1.fillRect(imageRect, Qt::white);
+    imgs[0].render(&painter1);
+    painter1.end();
+
+    QVERIFY(image1 == testImage);
+
+    // render image 2nd time to make sure that cached rendering works fine
+    QImage image2(resource.width(), resource.height(), QImage::Format_ARGB32);
+    QPainter painter2(&image2);
+    painter2.fillRect(imageRect, Qt::white);
+    imgs[0].render(&painter2);
+    painter2.end();
+
+    QVERIFY(image2 == testImage);
+
+    // compare table rendered through QWebElement::render to whole page table rendering
+    QRect tableRect(0, 0, 300, 300);
+    QWebElementCollection tables = page.mainFrame()->findAllElements("table");
+    QCOMPARE(tables.count(), 1);
+
+    QImage image3(300, 300, QImage::Format_ARGB32);
+    QPainter painter3(&image3);
+    painter3.fillRect(tableRect, Qt::white);
+    tables[0].render(&painter3);
+    painter3.end();
+
+    QImage image4(300, 300, QImage::Format_ARGB32);
+    QPainter painter4(&image4);
+    page.mainFrame()->render(&painter4, tableRect);
+    painter4.end();
+
+    QVERIFY(image3 == image4);
+}
+
 QTEST_MAIN(tst_QWebElement)
 #include "tst_qwebelement.moc"
diff --git a/WebKit/qt/tests/qwebframe/qwebframe.pro b/WebKit/qt/tests/qwebframe/qwebframe.pro
index 4c92e91..0e540e5 100644
--- a/WebKit/qt/tests/qwebframe/qwebframe.pro
+++ b/WebKit/qt/tests/qwebframe/qwebframe.pro
@@ -7,4 +7,7 @@ QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 DEFINES += SRCDIR=\\\"$$PWD/resources\\\"
 
-symbian:TARGET.UID3 = 0xA000E53D
+symbian {
+    TARGET.UID3 = 0xA000E53D
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebframe/resources/image2.png b/WebKit/qt/tests/qwebframe/resources/image2.png
new file mode 100644
index 0000000..8d70364
--- /dev/null
+++ b/WebKit/qt/tests/qwebframe/resources/image2.png
diff --git a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
index 80c9d72..7cc62b0 100644
--- a/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
+++ b/WebKit/qt/tests/qwebframe/tst_qwebframe.cpp
@@ -2691,26 +2691,24 @@ void tst_QWebFrame::render()
 
     QPicture picture;
 
-    // render clipping to Viewport
-    frame->setClipRenderToViewport(true);
+    QSize size = page.mainFrame()->contentsSize();
+    page.setViewportSize(size);
+
+    // render contents layer only (the iframe is smaller than the image, so it will have scrollbars)
     QPainter painter1(&picture);
-    frame->render(&painter1);
+    frame->render(&painter1, QWebFrame::ContentsLayer);
     painter1.end();
 
-    QSize size = page.mainFrame()->contentsSize();
-    page.setViewportSize(size);
-    QCOMPARE(size.width(), picture.boundingRect().width());   // 100px
-    QCOMPARE(size.height(), picture.boundingRect().height()); // 100px
+    QCOMPARE(size.width(), picture.boundingRect().width() + frame->scrollBarGeometry(Qt::Vertical).width());
+    QCOMPARE(size.height(), picture.boundingRect().height() + frame->scrollBarGeometry(Qt::Horizontal).height());
 
-    // render without clipping to Viewport
-    frame->setClipRenderToViewport(false);
+    // render everything, should be the size of the iframe
     QPainter painter2(&picture);
-    frame->render(&painter2);
+    frame->render(&painter2, QWebFrame::AllLayers);
     painter2.end();
 
-    QImage resource(":/image.png");
-    QCOMPARE(resource.width(), picture.boundingRect().width());   // resource width: 128px
-    QCOMPARE(resource.height(), picture.boundingRect().height()); // resource height: 128px
+    QCOMPARE(size.width(), picture.boundingRect().width());   // width: 100px
+    QCOMPARE(size.height(), picture.boundingRect().height()); // height: 100px
 }
 
 void tst_QWebFrame::scrollPosition()
diff --git a/WebKit/qt/tests/qwebhistory/qwebhistory.pro b/WebKit/qt/tests/qwebhistory/qwebhistory.pro
index 8ee63cc..7445e3b 100644
--- a/WebKit/qt/tests/qwebhistory/qwebhistory.pro
+++ b/WebKit/qt/tests/qwebhistory/qwebhistory.pro
@@ -6,4 +6,7 @@ RESOURCES  += tst_qwebhistory.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E53B
+symbian {
+    TARGET.UID3 = 0xA000E53B
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp b/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
index 4f4d3c4..ec2d497 100644
--- a/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
+++ b/WebKit/qt/tests/qwebhistory/tst_qwebhistory.cpp
@@ -56,9 +56,6 @@ private slots:
     void serialize_1(); //QWebHistory countity
     void serialize_2(); //QWebHistory index
     void serialize_3(); //QWebHistoryItem
-    void saveAndRestore_1();  //simple checks saveState and restoreState
-    void saveAndRestore_2();  //bad parameters saveState and restoreState
-    void saveAndRestore_3();  //try use different version
     void saveAndRestore_crash_1();
     void saveAndRestore_crash_2();
     void saveAndRestore_crash_3();
@@ -294,67 +291,40 @@ void tst_QWebHistory::serialize_3()
     QVERIFY(load.atEnd());
 }
 
-/** Simple checks should be a bit redundant to streaming operators */
-void tst_QWebHistory::saveAndRestore_1() 
+static void saveHistory(QWebHistory* history, QByteArray* in)
 {
-    QAction* actionBack = page->action(QWebPage::Back);
-    hist->back();
-    waitForLoadFinished.exec();
-    QVERIFY(actionBack->isEnabled());
-    QByteArray buffer(hist->saveState());
-    hist->clear();
-    QVERIFY(!actionBack->isEnabled());
-    QVERIFY(hist->count() == 1);
-    hist->restoreState(buffer);
-
-    //check only few values, do not make full test
-    //because most of the code is shared with streaming operators
-    //and these are checked before
-    QCOMPARE(hist->count(), histsize);
-    QCOMPARE(hist->currentItemIndex(), histsize - 2);
-    QCOMPARE(hist->itemAt(0).title(), QString("page1"));
-    QCOMPARE(hist->itemAt(histsize - 1).title(), QString("page") + QString::number(histsize));
-    QVERIFY(actionBack->isEnabled());
+    in->clear();
+    QDataStream save(in, QIODevice::WriteOnly);
+    save << *history;
 }
 
-/** Check returns value if there are bad parameters. Actually, result
-  * is no so importent. The test shouldn't crash :-) */
-void tst_QWebHistory::saveAndRestore_2() 
+static void restoreHistory(QWebHistory* history, QByteArray* out)
 {
-    QByteArray buffer;
-    hist->restoreState(buffer);
-    QVERIFY(hist->count() == 1);
-    QVERIFY(hist->itemAt(0).isValid());
-}
-
-/** Try to use bad version value */
-void tst_QWebHistory::saveAndRestore_3() 
-{
-    QByteArray tmp = hist->saveState((QWebHistory::HistoryStateVersion)29999);
-    QVERIFY(hist->saveState((QWebHistory::HistoryStateVersion)29999).isEmpty());
-    QVERIFY(hist->count() == histsize);
-    QVERIFY(hist->itemAt(3).isValid());
+    QDataStream load(out, QIODevice::ReadOnly);
+    load >> *history;
 }
 
 /** The test shouldn't crash */
 void tst_QWebHistory::saveAndRestore_crash_1()
 {
-    QByteArray tmp = hist->saveState();
-    for (unsigned i = 0; i < 5; i++){
-        hist->restoreState(tmp);
-        hist->saveState();
+    QByteArray buffer;
+    saveHistory(hist, &buffer);
+    for (unsigned i = 0; i < 5; i++) {
+        restoreHistory(hist, &buffer);
+        saveHistory(hist, &buffer);
     }
 }
 
 /** The test shouldn't crash */
 void tst_QWebHistory::saveAndRestore_crash_2()
 {
-    QByteArray tmp = hist->saveState();
+    QByteArray buffer;
+    saveHistory(hist, &buffer);
     QWebPage* page2 = new QWebPage(this);
     QWebHistory* hist2 = page2->history();
-    for (unsigned i = 0; i < 5; i++){
-        hist2->restoreState(tmp);
-        hist2->saveState();
+    for (unsigned i = 0; i < 5; i++) {
+        restoreHistory(hist2, &buffer);
+        saveHistory(hist2, &buffer);
     }
     delete page2;
 }
@@ -362,17 +332,18 @@ void tst_QWebHistory::saveAndRestore_crash_2()
 /** The test shouldn't crash */
 void tst_QWebHistory::saveAndRestore_crash_3()
 {
-    QByteArray tmp = hist->saveState();
+    QByteArray buffer;
+    saveHistory(hist, &buffer);
     QWebPage* page2 = new QWebPage(this);
     QWebHistory* hist1 = hist;
     QWebHistory* hist2 = page2->history();
-    for (unsigned i = 0; i < 5; i++){
-        hist1->restoreState(tmp);
-        hist2->restoreState(tmp);
+    for (unsigned i = 0; i < 5; i++) {
+        restoreHistory(hist1, &buffer);
+        restoreHistory(hist2, &buffer);
         QVERIFY(hist1->count() == hist2->count());
         QVERIFY(hist1->count() == histsize);
         hist2->back();
-        tmp = hist2->saveState();
+        saveHistory(hist2, &buffer);
         hist2->clear();
     }
     delete page2;
@@ -381,15 +352,16 @@ void tst_QWebHistory::saveAndRestore_crash_3()
 /** ::clear */
 void tst_QWebHistory::clear()
 {
+    QByteArray buffer;
+
     QAction* actionBack = page->action(QWebPage::Back);
     QVERIFY(actionBack->isEnabled());
-    hist->saveState();
+    saveHistory(hist, &buffer);
     QVERIFY(hist->count() > 1);
     hist->clear();
     QVERIFY(hist->count() == 1);  // Leave current item.
     QVERIFY(!actionBack->isEnabled());
 
-
     QWebPage* page2 = new QWebPage(this);
     QWebHistory* hist2 = page2->history();
     QVERIFY(hist2->count() == 0);
diff --git a/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro b/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
index 53e1afe..764f806 100644
--- a/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
+++ b/WebKit/qt/tests/qwebhistoryinterface/qwebhistoryinterface.pro
@@ -5,4 +5,7 @@ SOURCES  += tst_qwebhistoryinterface.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E53C
+symbian {
+    TARGET.UID3 = 0xA000E53C
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebpage/qwebpage.pro b/WebKit/qt/tests/qwebpage/qwebpage.pro
index 82ffac6..6b28efd 100644
--- a/WebKit/qt/tests/qwebpage/qwebpage.pro
+++ b/WebKit/qt/tests/qwebpage/qwebpage.pro
@@ -5,5 +5,9 @@ SOURCES  += tst_qwebpage.cpp
 RESOURCES  += tst_qwebpage.qrc
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
-symbian:TARGET.UID3 = 0xA000E53E
+symbian {
+    TARGET.UID3 = 0xA000E53E
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index a9f9f16..0cf85ee 100644
--- a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -1,5 +1,6 @@
 /*
     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,6 +24,7 @@
 #include <qwebelement.h>
 #include <qwebpage.h>
 #include <qwidget.h>
+#include <QGraphicsWidget>
 #include <qwebview.h>
 #include <qwebframe.h>
 #include <qwebhistory.h>
@@ -33,6 +35,7 @@
 #include <qwebsecurityorigin.h>
 #include <qwebdatabase.h>
 #include <QPushButton>
+#include <QDir>
 
 // Will try to wait for the condition while allowing event processing
 #define QTRY_COMPARE(__expr, __expected) \
@@ -101,7 +104,9 @@ private slots:
     void contextMenuCrash();
     void database();
     void createPlugin();
+    void destroyPlugin_data();
     void destroyPlugin();
+    void createViewlessPlugin_data();
     void createViewlessPlugin();
     void multiplePageGroupsAndLocalStorage();
     void cursorMovements();
@@ -116,9 +121,14 @@ private slots:
     void testEnablePersistentStorage();
     void consoleOutput();
     void inputMethods();
+    void defaultTextEncoding();
+    void errorPageExtension();
 
     void crashTests_LazyInitializationOfMainFrame();
 
+    void screenshot_data();
+    void screenshot();
+
 private:
     QWebView* m_view;
     QWebPage* m_page;
@@ -621,50 +631,93 @@ void tst_QWebPage::createPlugin()
     QCOMPARE(newPage->calls.count(), 0);
 }
 
-class PluginTrackedPage : public QWebPage
-{
+
+// Standard base class for template PluginTracerPage. In tests it is used as interface.
+class PluginCounterPage : public QWebPage {
 public:
+    int m_count;
+    QPointer<QObject> m_widget;
+    PluginCounterPage(QObject* parent = 0) : QWebPage(parent), m_count(0), m_widget(0)
+    {
+       settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    }
+};
 
-    int count;
-    QPointer<QWidget> widget;
+template<class T>
+class PluginTracerPage : public PluginCounterPage {
+public:
+    PluginTracerPage(QObject* parent = 0) : PluginCounterPage(parent) {}
+    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&)
+    {
+        m_count++;
+        return m_widget = new T();
+    }
+};
 
-    PluginTrackedPage(QWidget *parent = 0) : QWebPage(parent), count(0) {
-       settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+class PluginFactory {
+public:
+    enum FactoredType {QWidgetType, QGraphicsWidgetType};
+    static PluginCounterPage* create(FactoredType type, QObject* parent = 0)
+    {
+        PluginCounterPage* result = 0;
+        switch (type) {
+        case QWidgetType:
+            result = new PluginTracerPage<QWidget>(parent);
+            break;
+        case QGraphicsWidgetType:
+            result = new PluginTracerPage<QGraphicsWidget>(parent);
+            break;
+        default: {/*Oops*/};
+        }
+        return result;
     }
 
-    virtual QObject* createPlugin(const QString&, const QUrl&, const QStringList&, const QStringList&) {
-       count++;
-       QWidget *w = new QWidget;
-       widget = w;
-       return w;
+    static void prepareTestData()
+    {
+        QTest::addColumn<int>("type");
+        QTest::newRow("QWidget") << (int)PluginFactory::QWidgetType;
+        QTest::newRow("QGraphicsWidget") << (int)PluginFactory::QGraphicsWidgetType;
     }
 };
 
+void tst_QWebPage::destroyPlugin_data()
+{
+    PluginFactory::prepareTestData();
+}
+
 void tst_QWebPage::destroyPlugin()
 {
-    PluginTrackedPage* page = new PluginTrackedPage(m_view);
+    QFETCH(int, type);
+    PluginCounterPage* page = PluginFactory::create((PluginFactory::FactoredType)type, m_view);
     m_view->setPage(page);
 
     // we create the plugin, so the widget should be constructed
     QString content("<html><body><object type=\"application/x-qt-plugin\" classid=\"QProgressBar\"></object></body></html>");
     m_view->setHtml(content);
-    QVERIFY(page->widget != 0);
-    QCOMPARE(page->count, 1);
+    QVERIFY(page->m_widget);
+    QCOMPARE(page->m_count, 1);
 
     // navigate away, the plugin widget should be destructed
     m_view->setHtml("<html><body>Hi</body></html>");
     QTestEventLoop::instance().enterLoop(1);
-    QVERIFY(page->widget == 0);
+    QVERIFY(!page->m_widget);
+}
+
+void tst_QWebPage::createViewlessPlugin_data()
+{
+    PluginFactory::prepareTestData();
 }
 
 void tst_QWebPage::createViewlessPlugin()
 {
-    PluginTrackedPage* page = new PluginTrackedPage;
+    QFETCH(int, type);
+    PluginCounterPage* page = PluginFactory::create((PluginFactory::FactoredType)type);
     QString content("<html><body><object type=\"application/x-qt-plugin\" classid=\"QProgressBar\"></object></body></html>");
     page->mainFrame()->setHtml(content);
-    QCOMPARE(page->count, 1);
-    QVERIFY(page->widget != 0);
+    QCOMPARE(page->m_count, 1);
+    QVERIFY(page->m_widget);
     delete page;
+
 }
 
 // import private API
@@ -1212,11 +1265,12 @@ void tst_QWebPage::frameAt()
 void tst_QWebPage::inputMethods()
 {
     m_view->page()->mainFrame()->setHtml("<html><body>" \
-                                            "<input type='text' id='input1' style='font-family: serif' value='' maxlength='20'/>" \
+                                            "<input type='text' id='input1' style='font-family: serif' value='' maxlength='20'/><br>" \
+                                            "<input type='password'/>" \
                                             "</body></html>");
     m_view->page()->mainFrame()->setFocus();
 
-    QList<QWebElement> inputs = m_view->page()->mainFrame()->documentElement().findAll("input");
+    QWebElementCollection inputs = m_view->page()->mainFrame()->documentElement().findAll("input");
 
     QMouseEvent evpres(QEvent::MouseButtonPress, inputs.at(0).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
     m_view->page()->event(&evpres);
@@ -1295,6 +1349,21 @@ void tst_QWebPage::inputMethods()
     value = variant.value<QString>();
     QCOMPARE(value, QString("QtWebKit"));
 #endif
+
+    //ImhHiddenText
+    QMouseEvent evpresPassword(QEvent::MouseButtonPress, inputs.at(1).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
+    m_view->page()->event(&evpresPassword);
+    QMouseEvent evrelPassword(QEvent::MouseButtonRelease, inputs.at(1).geometry().center(), Qt::LeftButton, Qt::NoButton, Qt::NoModifier);
+    m_view->page()->event(&evrelPassword);
+
+    QVERIFY(m_view->testAttribute(Qt::WA_InputMethodEnabled));
+#if QT_VERSION >= 0x040600
+    QVERIFY(m_view->inputMethodHints() & Qt::ImhHiddenText);
+
+    m_view->page()->event(&evpres);
+    m_view->page()->event(&evrel);
+    QVERIFY(!(m_view->inputMethodHints() & Qt::ImhHiddenText));
+#endif
 }
 
 // import a little DRT helper function to trigger the garbage collector
@@ -1400,6 +1469,79 @@ void tst_QWebPage::testEnablePersistentStorage()
     QVERIFY(!webPage.settings()->iconDatabasePath().isEmpty());
 }
 
+void tst_QWebPage::defaultTextEncoding()
+{
+    QWebFrame* mainFrame = m_page->mainFrame();
+
+    QString defaultCharset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QVERIFY(!defaultCharset.isEmpty());
+    QCOMPARE(QWebSettings::globalSettings()->defaultTextEncoding(), defaultCharset);
+
+    m_page->settings()->setDefaultTextEncoding(QString("utf-8"));
+    QString charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QCOMPARE(charset, QString("utf-8"));
+    QCOMPARE(m_page->settings()->defaultTextEncoding(), charset);
+
+    m_page->settings()->setDefaultTextEncoding(QString());
+    charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QVERIFY(!charset.isEmpty());
+    QCOMPARE(charset, defaultCharset);
+
+    QWebSettings::globalSettings()->setDefaultTextEncoding(QString("utf-8"));
+    charset = mainFrame->evaluateJavaScript("document.defaultCharset").toString();
+    QCOMPARE(charset, QString("utf-8"));
+    QCOMPARE(QWebSettings::globalSettings()->defaultTextEncoding(), charset);
+}
+
+class ErrorPage : public QWebPage
+{
+public:
+
+    ErrorPage(QWidget* parent = 0): QWebPage(parent)
+    {
+    }
+
+    virtual bool supportsExtension(Extension extension) const
+    {
+        return extension == ErrorPageExtension;
+    }
+
+    virtual bool extension(Extension, const ExtensionOption* option, ExtensionReturn* output)
+    {
+        const ErrorPageExtensionOption* info = static_cast<const ErrorPageExtensionOption*>(option);
+        ErrorPageExtensionReturn* errorPage = static_cast<ErrorPageExtensionReturn*>(output);
+
+        if (info->frame == mainFrame()) {
+            errorPage->content = "data:text/html,error";
+            return true;
+        }
+
+        return false;
+    }
+};
+
+void tst_QWebPage::errorPageExtension()
+{
+    ErrorPage* page = new ErrorPage;
+    m_view->setPage(page);
+
+    QSignalSpy spyLoadFinished(m_view, SIGNAL(loadFinished(bool)));
+
+    page->mainFrame()->load(QUrl("qrc:///frametest/index.html"));
+    QTRY_COMPARE(spyLoadFinished.count(), 1);
+
+    page->mainFrame()->setUrl(QUrl("http://non.existent/url"));
+    QTest::qWait(2000);
+    QTRY_COMPARE(spyLoadFinished.count(), 2);
+    QCOMPARE(page->mainFrame()->toPlainText(), QString("data:text/html,error"));
+    QCOMPARE(page->history()->count(), 2);
+    QCOMPARE(page->history()->currentItem().url(), QUrl("http://non.existent/url"));
+    QCOMPARE(page->history()->canGoBack(), true);
+    QCOMPARE(page->history()->canGoForward(), false);
+
+    m_view->setPage(0);
+}
+
 void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
 {
     {
@@ -1420,6 +1562,52 @@ void tst_QWebPage::crashTests_LazyInitializationOfMainFrame()
     }
 }
 
+static void takeScreenshot(QWebPage* page)
+{
+    QWebFrame* mainFrame = page->mainFrame();
+    page->setViewportSize(mainFrame->contentsSize());
+    QImage image(page->viewportSize(), QImage::Format_ARGB32);
+    QPainter painter(&image);
+    mainFrame->render(&painter);
+    painter.end();
+}
+
+void tst_QWebPage::screenshot_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::newRow("WithoutPlugin") << "<html><body id='b'>text</body></html>";
+    QTest::newRow("WindowedPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf'></embed></body></html>");
+    QTest::newRow("WindowlessPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf' wmode='transparent'></embed></body></html>");
+}
+
+void tst_QWebPage::screenshot()
+{
+    QDir::setCurrent(SRCDIR);
+
+    QFETCH(QString, html);
+    QWebPage* page = new QWebPage;
+    page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* mainFrame = page->mainFrame();
+    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    if (html.contains("</embed>")) {
+        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
+        QTest::qWait(2000);
+    }
+
+    // take screenshot without a view
+    takeScreenshot(page);
+
+    QWebView* view = new QWebView;
+    view->setPage(page);
+
+    // take screenshot when attached to a view
+    takeScreenshot(page);
+
+    delete page;
+    delete view;
+
+    QDir::setCurrent(QApplication::applicationDirPath());
+}
 
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro b/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
index 1376ca5..569146a 100644
--- a/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
+++ b/WebKit/qt/tests/qwebplugindatabase/qwebplugindatabase.pro
@@ -5,4 +5,7 @@ SOURCES  += tst_qwebplugindatabase.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
 
-symbian:TARGET.UID3 = 0xA000E540
+symbian {
+    TARGET.UID3 = 0xA000E540
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebview/qwebview.pro b/WebKit/qt/tests/qwebview/qwebview.pro
index d9d122c..e67bb7a 100644
--- a/WebKit/qt/tests/qwebview/qwebview.pro
+++ b/WebKit/qt/tests/qwebview/qwebview.pro
@@ -4,5 +4,9 @@ include(../../../../WebKit.pri)
 SOURCES  += tst_qwebview.cpp
 QT += testlib network
 QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+DEFINES += SRCDIR=\\\"$$PWD/\\\"
 
-symbian:TARGET.UID3 = 0xA000E53F
+symbian {
+    TARGET.UID3 = 0xA000E53F
+    TARGET.CAPABILITY = ReadUserData WriteUserData NetworkServices
+}
diff --git a/WebKit/qt/tests/qwebview/tst_qwebview.cpp b/WebKit/qt/tests/qwebview/tst_qwebview.cpp
index 01d0e92..9204223 100644
--- a/WebKit/qt/tests/qwebview/tst_qwebview.cpp
+++ b/WebKit/qt/tests/qwebview/tst_qwebview.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
     Copyright (C) 2009 Torch Mobile Inc.
+    Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@
 #include <qnetworkrequest.h>
 #include <qdiriterator.h>
 #include <qwebkitversion.h>
+#include <qwebframe.h>
 
 class tst_QWebView : public QObject
 {
@@ -42,6 +44,9 @@ private slots:
     void guessUrlFromString_data();
     void guessUrlFromString();
     void getWebKitVersion();
+
+    void reusePage_data();
+    void reusePage();
 };
 
 // This will be called before the first test function is executed.
@@ -167,6 +172,46 @@ void tst_QWebView::getWebKitVersion()
     QVERIFY(qWebKitVersion().toDouble() > 0);
 }
 
+void tst_QWebView::reusePage_data()
+{
+    QTest::addColumn<QString>("html");
+    QTest::newRow("WithoutPlugin") << "<html><body id='b'>text</body></html>";
+    QTest::newRow("WindowedPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf'></embed></body></html>");
+    QTest::newRow("WindowlessPlugin") << QString("<html><body id='b'>text<embed src='resources/test.swf' wmode=\"transparent\"></embed></body></html>");
+}
+
+void tst_QWebView::reusePage()
+{
+    QDir::setCurrent(SRCDIR);
+
+    QFETCH(QString, html);
+    QWebView* view1 = new QWebView;
+    QPointer<QWebPage> page = new QWebPage;
+    view1->setPage(page);
+    page->settings()->setAttribute(QWebSettings::PluginsEnabled, true);
+    QWebFrame* mainFrame = page->mainFrame();
+    mainFrame->setHtml(html, QUrl::fromLocalFile(QDir::currentPath()));
+    if (html.contains("</embed>")) {
+        // some reasonable time for the PluginStream to feed test.swf to flash and start painting
+        QTest::qWait(2000);
+    }
+
+    view1->show();
+    QTest::qWait(2000);
+    delete view1;
+    QVERIFY(page != 0); // deleting view must not have deleted the page, since it's not a child of view
+
+    QWebView *view2 = new QWebView;
+    view2->setPage(page);
+    view2->show(); // in Windowless mode, you should still be able to see the plugin here
+    QTest::qWait(2000);
+    delete view2;
+
+    delete page; // must not crash
+
+    QDir::setCurrent(QApplication::applicationDirPath());
+}
+
 QTEST_MAIN(tst_QWebView)
 #include "tst_qwebview.moc"
 
diff --git a/WebKit/qt/tests/resources/test.swf b/WebKit/qt/tests/resources/test.swf
new file mode 100644
index 0000000..8952982
--- /dev/null
+++ b/WebKit/qt/tests/resources/test.swf
diff --git a/WebKit/win/AccessibleBase.cpp b/WebKit/win/AccessibleBase.cpp
index d02ec7e..55cbab3 100644
--- a/WebKit/win/AccessibleBase.cpp
+++ b/WebKit/win/AccessibleBase.cpp
@@ -27,7 +27,8 @@
 #include "WebKitDLL.h"
 #include "AccessibleBase.h"
 
-#include <oleacc.h>
+#include "AccessibleImage.h"
+#include "WebView.h"
 #include <WebCore/AccessibilityObject.h>
 #include <WebCore/AXObjectCache.h>
 #include <WebCore/BString.h>
@@ -43,7 +44,7 @@
 #include <WebCore/RenderFrame.h>
 #include <WebCore/RenderObject.h>
 #include <WebCore/RenderView.h>
-#include "WebView.h"
+#include <oleacc.h>
 #include <wtf/RefPtr.h>
 
 using namespace WebCore;
@@ -68,6 +69,9 @@ AccessibleBase* AccessibleBase::createInstance(AccessibilityObject* obj)
 {
     ASSERT_ARG(obj, obj);
 
+    if (obj->isImage())
+        return new AccessibleImage(obj);
+
     return new AccessibleBase(obj);
 }
 
diff --git a/WebKit/win/AccessibleImage.cpp b/WebKit/win/AccessibleImage.cpp
new file mode 100644
index 0000000..ee1d505
--- /dev/null
+++ b/WebKit/win/AccessibleImage.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "AccessibleImage.h"
+
+#include <WebCore/AccessibilityRenderObject.h>
+#include <WebCore/HTMLNames.h>
+
+using namespace WebCore;
+using namespace WebCore::HTMLNames;
+
+AccessibleImage::AccessibleImage(AccessibilityObject* obj)
+    : AccessibleBase(obj)
+{
+    ASSERT_ARG(obj, obj->isImage());
+    ASSERT_ARG(obj, obj->isAccessibilityRenderObject());
+}
+
+String AccessibleImage::name() const
+{
+    if (!m_object->isAccessibilityRenderObject())
+        return AccessibleBase::name();
+
+    AccessibilityRenderObject* obj = static_cast<AccessibilityRenderObject*>(m_object);
+
+    String ariaLabel = obj->ariaLabeledByAttribute();
+    if (!ariaLabel.isEmpty())
+        return ariaLabel;
+
+    const AtomicString& altText = obj->getAttribute(HTMLNames::altAttr);
+    if (!altText.isEmpty())
+        return altText;
+
+    return AccessibleBase::name();
+}
diff --git a/WebKit/win/AccessibleImage.h b/WebKit/win/AccessibleImage.h
new file mode 100644
index 0000000..0c111e2
--- /dev/null
+++ b/WebKit/win/AccessibleImage.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AccessibleImage_h
+#define AccessibleImage_h
+
+#include "AccessibleBase.h"
+
+class AccessibleImage : public AccessibleBase
+{
+public:
+    AccessibleImage(WebCore::AccessibilityObject*);
+    virtual ~AccessibleImage() { }
+
+private:
+    virtual WebCore::String name() const;
+};
+
+#endif // AccessibleImage_h
diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 354f82f..6253010 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,538 @@
+2009-10-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Sam "Horatio" Weinig.
+
+        Should not generate/build COM DOM bindings
+        https://bugs.webkit.org/show_bug.cgi?id=30880
+
+        * Interfaces/WebKit.idl: Remove generated interfaces.
+        * WebKit.vcproj/InterfacesGenerated.vcproj: Removed.
+        * WebKit.vcproj/WebKit.sln: Remove InterfacesGenerated.vcproj.
+        * WebKit.vcproj/WebKit.submit.sln: Remove InterfacesGenerated.vcproj.
+        * WebKit.vcproj/WebKit.vcproj: Remove generated interfaces.
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        (WebFrame::counterValueForElementById):
+        * WebFrame.h:
+
+2009-10-28  Joe Mason  <jmason@rim.com>
+
+        Reviewed by Adam Treat.
+
+        Call the shared FrameLoader::defaultObjectContentType instead of
+        copying code into FrameLoaderClient::objectContentType.  This causes no
+        behavioural change.
+
+        * WebFrame.cpp:
+        (WebFrame::objectContentType):
+
+2009-10-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Speculative build-fix for WebElementPropertyBag.cpp
+
+        * WebElementPropertyBag.cpp: Include RenderObject.h
+
+2009-10-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Fraser.
+
+        Change HitTestResult methods to use (3d) transformation aware methods
+        https://bugs.webkit.org/show_bug.cgi?id=27347
+
+        The HitTestResult::boundingBox method was removed. The
+        RenderObject must be used directly. In contrast to the
+        old HitTestResult::boundingBox method this code must use
+        a (3d) transformation aware method to not run into an
+        assert in SVGRenderBase::mapLocalToContainer.
+
+        * WebElementPropertyBag.cpp:
+        (WebElementPropertyBag::Read): Replace HitTestResult::boundingBox()
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * WebKit.vcproj/WebKit.rc: Use winresrc.h because it exists even 
+        when MFC is not installed, and is all that's needed here.
+
+2009-10-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Rollout r50041-50043.  The HTML5 spec changed to make HTMLOptionsCollection
+        inherit from HTMLCollection.
+
+        * DOMCreateInstance.cpp:
+
+2009-10-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Add contextForWorldID to the IWebFramePrivate interface.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.h:
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Another try at fixing windows.
+
+        * DOMCreateInstance.cpp:
+
+2009-10-25  Sam Weinig  <sam@webkit.org>
+
+        Touch WebKit.idl in an effort to try and regenerate the COM bindings.
+
+        * Interfaces/WebKit.idl:
+
+2009-10-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Include config.h before including other files.
+
+        * AccessibleImage.cpp:
+
+2009-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30729
+        Provide private API to request the global context for a specific world.
+        Used to initialize parameters on the global object.
+
+        * WebFrame.cpp:
+        (WebFrame::contextForWorldID):
+        * WebFrame.h:
+
+2009-10-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Pan-scrolling pointer shows up in other tabs or windows, can't "fix" it.
+        <http://webkit.org/b/30732> and <rdar://7332018>.
+        
+        Turns off pan-scrolling on a WebView when it is about to lose focus.
+
+        * WebView.cpp:
+        (WebViewWndProc):
+
+2009-10-23  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        MSAA: Name for image elements should use alt attribute text
+
+        https://bugs.webkit.org/show_bug.cgi?id=30727
+        <rdar://problem/7328291>
+
+        Reviewed by Alice Liu.
+
+        * AccessibleBase.cpp:
+        (AccessibleBase::createInstance):
+        If the AccessibilityObject is an image, return an AccessibleImage.
+
+        * AccessibleImage.cpp: Added.
+        (AccessibleImage::AccessibleImage):
+        Call the base constructor.
+        (AccessibleImage::name):
+        If the object is not an AccessibilityRenderObject, return the base's
+        name(). Look first for an ARIA "labeled-by" attribute, then look for an
+        alternate text attribute. Fall back to the base's name().
+
+        * AccessibleImage.h: Added.
+        (AccessibleImage::~AccessibleImage):
+
+        * WebKit.vcproj/WebKit.vcproj:
+        Add AccessibleImage to the project.
+
+2009-10-23  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the windows build.
+
+        * Interfaces/WebKit.idl:
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Update to incorporate support for IsolatedWorlds in JSC bindings.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * WebFrame.cpp:
+        (WebFrame::globalContext):
+        (WebFrame::windowObjectCleared):
+        (WebFrame::stringByEvaluatingJavaScriptInIsolatedWorld):
+        * WebFrame.h:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Removed WebSocket runtime settings.
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        WebSocket runtime configuration is supported by chromium/v8 only.
+
+        * Interfaces/IWebPreferencesPrivate.idl:
+        * WebPreferenceKeysPrivate.h:
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        (WebPreferences::experimentalNotificationsEnabled):
+        * WebPreferences.h:
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged):
+
+2009-10-19  Adam Roben  <aroben@apple.com>
+
+        Fix crashes/assertions when calling WebLocalizedString from multiple
+        threads concurrently
+
+        Fixes <http://webkit.org/b/30534> WebLocalizedString asserts if called
+        from multiple threads concurrently
+
+        Reviewed by John Sullivan.
+
+        * WebLocalizableStrings.cpp:
+        (mainBundleLocStringsMutex):
+        (frameworkLocStringsMutex):
+        Added these new getters.
+
+        (findCachedString):
+        (cacheString):
+        Lock the relevant mutex before accessing each string map. Otherwise
+        bad things could happen if two threads end up here at the same time.
+
+2009-10-19  Adam Roben  <aroben@apple.com>
+
+        Get rid of a few static initializers/exit-time destructors in
+        WebLocalizableStrings
+
+        Reviewed by Dan Bernstein.
+
+        * WebLocalizableStrings.cpp:
+        (mainBundleLocStrings):
+        (frameworkLocStrings):
+        Added these functions instead of file-scope variables.
+
+        (findCachedString):
+        (cacheString):
+        Updated to use the new functions.
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Unreviewed, build fix.
+
+        Update call to FrameLoader::urlSelected().
+
+        * WebCoreSupport/WebContextMenuClient.cpp:
+        (WebContextMenuClient::searchWithGoogle):
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * WebKitClassFactory.cpp: Use new DEBUG_ALL preprocessor define for library naming.
+
+2009-10-16  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a plug-in has ever been halted.
+
+        Part of <rdar://problem/7312158>.
+
+        Reviewed by Dan Bernstein.
+
+        * Interfaces/IWebViewPrivate.idl:
+        Add hasPluginForNodeBeenHalted().
+
+        * WebView.cpp:
+        (pluginViewForNode):
+        Code factored out of isNodeHaltedPlugin().
+        (WebView::isNodeHaltedPlugin):
+        Remove STDMETHODCALLTYPE, as it has no use at the definition. Use
+        pluginViewForNode().
+        (WebView::restartHaltedPluginForNode):
+        Ditto.
+        (WebView::hasPluginForNodeBeenHalted):
+        Get the PluginView for the given node. Return the result of
+        PluginView::hasBeenHalted().
+
+        * WebView.h:
+        Declare hasPluginForNodeBeenHalted().
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * WebKit.vcproj/InterfacesGenerated.vcproj: Renamed single configuration from "Release" to "all".
+        * WebKit.vcproj/WebKit.make: Debug build in makefile should build Debug_All.
+        * WebKit.vcproj/WebKit.sln: Add Debug_All configuration.
+        * WebKit.vcproj/WebKit.submit.sln: Add Debug_All configuration.
+        * WebKit.vcproj/WebKit.vcproj:
+        Remove extraneous OutputDirectory/IntermediateDirectory in Debug_Cairo.
+        Add Debug_All configuration.
+        * WebKit.vcproj/WebKitGUID.vcproj: Add Debug_All configuration.
+
+2009-10-15  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to restart a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Kevin Decker.
+
+        * Interfaces/IWebViewPrivate.idl:
+        Add restartHaltedPluginForNode().
+
+        * WebView.cpp:
+        (WebView::restartHaltedPluginForNode):
+        From the IDOMNode, query for the DOMNode. From the DOMNode, get the
+        WebCore::Node. Get the node's renderer, and check whether it is a
+        RenderWidget. If so, get its Widget, and check whether it's a
+        PluginView. If so, call PluginView::restart().
+
+        * WebView.h:
+        Declare restartHaltedPluginForNode().
+
+2009-10-14  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to determine whether a node is a halted plug-in.
+
+        Part of <rdar://problem/7273354> Halted plug-ins should restart on
+        mouseover
+
+        https://bugs.webkit.org/show_bug.cgi?id=30151
+
+        Reviewed by Darin Adler.
+
+        * Interfaces/IWebViewPrivate.idl:
+        Add isNodehaltedPlugin().
+
+        * WebView.cpp:
+        (WebView::isNodeHaltedPlugin):
+        From the IDOMNode, query for the DOMNode. From the DOMNode, get the
+        WebCore::Node. Get the node's renderer, and check whether it is a
+        RenderWidget. If so, get its Widget, and check whether it's a
+        PluginView. If so, return the result of PluginView::isHalted().
+
+        * WebView.h:
+        Declare isNodeHaltedPlugin().
+
+2009-10-15  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24731
+        And
+        rdar://problem/5015961
+        
+        Implements support for DHTML drag-and-drop operations (i.e. ondragstart, ondragend)
+        in the Windows build so that it conforms to the Mac OS X build. Hence, dropEffect is
+        correctly set.
+        
+        The WebView and WebDropSource drag-and-drop functions, as called by function
+        DoDragDrop in its event loop, neither used the drop effect as specified by
+        event.dataTransfer.dropEffect nor respected event.dataTransfer.effectsAllowed.
+        Instead, these functions defaulted to some hardcoded drop effect and set of
+        allowed drop effects, respectively.
+
+        Tests: fast/events/drag-and-drop.html
+
+        * WebCoreSupport/WebDragClient.cpp:
+        (WebDragClient::startDrag):
+        * WebDropSource.cpp:
+        (WebDropSource::QueryContinueDrag): Moved call to EventHandler::dragSourceEndedAt
+        into method WebDragClient::startDrag.
+        * WebDropSource.h:
+        * WebView.cpp:
+        (WebView::keyStateToDragOperation): Fixes <rdar://problem/5015961>. Determines
+        appropriate drop effect from state of keyboard and allowed effects
+        m_page->dragController()->sourceDragOperation().
+        (WebView::DragEnter):
+        (WebView::DragOver):
+        (WebView::Drop):
+        * WebView.h:
+
+2009-10-14  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebKit.vcproj/Interfaces.vcproj: Exclude IWebHistoryDelegate and
+        IWebNavigationData from the build (they get #imported via WebKit.idl).
+
+2009-10-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit Win API should provide a delegate interface for global history.
+        https://bugs.webkit.org/show_bug.cgi?id=29905
+
+        -Add IWebHistoryDelegate for clients to implement.
+        -Add (I)WebNavigationData for the history delegate's use.
+        -When it exists, call the history delegate instead of using WebHistory.
+        
+        * Interfaces/IWebHistoryDelegate.idl: Added.
+        * Interfaces/IWebHistoryPrivate.idl:
+        * Interfaces/IWebNavigationData.idl: Added.
+        * Interfaces/IWebViewPrivate.idl:
+        * Interfaces/WebKit.idl:
+        
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/WebKit.vcproj:
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::populateVisitedLinks):
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::updateGlobalHistory):
+        (WebFrameLoaderClient::updateGlobalHistoryRedirectLinks):
+        (WebFrameLoaderClient::setTitle):
+ 
+         * WebView.cpp:
+        (WebView::close):
+        (WebView::mainFrameURL):
+        (WebView::setHistoryDelegate):
+        (WebView::historyDelegate):
+        (WebView::addVisitedLinks):
+        * WebView.h:
+        
+        * WebHistory.cpp:
+        (WebHistory::setVisitedLinkTrackingEnabled):
+        (WebHistory::removeAllVisitedLinks):
+        * WebHistory.h:
+
+        * WebNavigationData.cpp: Added.
+        (WebNavigationData::QueryInterface):
+        (WebNavigationData::AddRef):
+        (WebNavigationData::Release):
+        (WebNavigationData::WebNavigationData):
+        (WebNavigationData::~WebNavigationData):
+        (WebNavigationData::createInstance):
+        (WebNavigationData::url):
+        (WebNavigationData::title):
+        (WebNavigationData::originalRequest):
+        (WebNavigationData::response):
+        (WebNavigationData::hasSubstituteData):
+        (WebNavigationData::clientRedirectSource):
+        * WebNavigationData.h: Added.
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Fix more WebView bustage.
+
+        * WebView.cpp:
+        (WebView::addUserScriptToGroup):
+        (WebView::addUserStyleSheetToGroup):
+        (WebView::removeUserScriptsFromGroup):
+        (WebView::removeUserStyleSheetsFromGroup):
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Fix build bustage on Windows.
+
+        * WebView.cpp:
+        (WebView::addUserScriptToGroup):
+        (WebView::addUserStyleSheetToGroup):
+        (WebView::removeUserScriptsFromGroup):
+        (WebView::removeUserStyleSheetsFromGroup):
+
+2009-10-13  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben..
+
+        Split removal functions for user scripts and stylehseets based on type.
+
+        * Interfaces/IWebViewPrivate.idl:
+        * WebView.cpp:
+        (WebView::removeUserScriptFromGroup):
+        (WebView::removeUserStyleSheetFromGroup):
+        * WebView.h:
+
+2009-10-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor HistoryController out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30246
+
+        Update API call.
+
+        * WebView.cpp:
+        (WebView::loadBackForwardListFromOtherView):
+
+2009-10-08  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the WebKitPluginHalterEnabledPreferenceKey in favor of checking
+        for the existence of a PluginHalterDelegate.
+
+        Reviewed by Dan Bernstein.
+
+        * Interfaces/IWebPreferencesPrivate.idl:
+        Remove the getter and setter.
+
+        * WebCoreSupport/WebPluginHalterClient.cpp:
+        (WebPluginHalterClient::enabled):
+        Return true if the delegate exists.
+
+        * WebCoreSupport/WebPluginHalterClient.h:
+        Declare implementation of enabled().
+
+        * WebPreferenceKeysPrivate.h:
+        Removed the pref key.
+
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        Removed initialization of the pref.
+
+        * WebPreferences.h:
+        Removed declaration of the getter/setter.
+
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged):
+        Don't propagate the pref.
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString):
+
+2009-10-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the shouldLoadMediaElementURL implementation.
+
+        * Interfaces/IWebPolicyDelegatePrivate.idl:
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::shouldUsePluginDocument):
+        * WebCoreSupport/WebFrameLoaderClient.h:
+
 2009-10-08  Adam Roben  <aroben@apple.com>
 
         Make IWebInspectorPrivate be accessed in a more standard way
diff --git a/WebKit/win/Interfaces/IWebFramePrivate.idl b/WebKit/win/Interfaces/IWebFramePrivate.idl
index a3366da..d56239b 100755
--- a/WebKit/win/Interfaces/IWebFramePrivate.idl
+++ b/WebKit/win/Interfaces/IWebFramePrivate.idl
@@ -57,6 +57,7 @@ typedef enum {
 interface IWebFramePrivate : IUnknown
 {
     HRESULT renderTreeAsExternalRepresentation([out, retval] BSTR* result);
+    HRESULT counterValueForElementById([in] BSTR id, [out, retval] BSTR* result);
     HRESULT scrollOffset([out, retval] SIZE* offset);
 
     // FIXME: This shouldn't be needed once IWebDocumentView is implemented.
@@ -93,4 +94,8 @@ interface IWebFramePrivate : IUnknown
     HRESULT isDisplayingStandaloneImage([out, retval] BOOL* result);
 
     HRESULT allowsFollowingLink([in] BSTR url, [out, retval] BOOL* result);
+
+    HRESULT stringByEvaluatingJavaScriptInIsolatedWorld([in] unsigned worldID, [in] OLE_HANDLE jsGlobalObject, [in] BSTR script, [out, retval] BSTR* result);
+
+    [local] JSGlobalContextRef contextForWorldID([in] unsigned worldID);
 }
diff --git a/WebKit/win/Interfaces/IWebHistoryDelegate.idl b/WebKit/win/Interfaces/IWebHistoryDelegate.idl
new file mode 100644
index 0000000..6233208
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebHistoryDelegate.idl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+import "IWebNavigationData.idl";
+#endif
+
+interface IWebFrame;
+interface IWebNavigationData;
+interface IWebView;
+
+[
+    object,
+    oleautomation,
+    uuid(16AF211F-7C00-4f7f-A8DB-B1219FEABF3B),
+    pointer_default(unique)
+]
+interface IWebHistoryDelegate : IUnknown
+{
+    HRESULT didNavigateWithNavigationData([in] IWebView* webView, [in] IWebNavigationData* navigationData, [in] IWebFrame* webFrame);
+    HRESULT didPerformClientRedirectFromURL([in] IWebView* webView, [in] BSTR sourceURL, [in] BSTR destinationURL, [in] IWebFrame* webFrame);
+    HRESULT didPerformServerRedirectFromURL([in] IWebView* webView, [in] BSTR sourceURL, [in] BSTR destinationURL, [in] IWebFrame* webFrame);
+    HRESULT updateHistoryTitle([in] IWebView* webView, [in] BSTR title, [in] BSTR url);
+    HRESULT populateVisitedLinksForWebView([in] IWebView* webView);
+}
diff --git a/WebKit/win/Interfaces/IWebHistoryPrivate.idl b/WebKit/win/Interfaces/IWebHistoryPrivate.idl
index 6ad08c9..af6c27a 100644
--- a/WebKit/win/Interfaces/IWebHistoryPrivate.idl
+++ b/WebKit/win/Interfaces/IWebHistoryPrivate.idl
@@ -36,4 +36,6 @@ interface IWebHistoryPrivate : IUnknown
 {
     HRESULT allItems([in, out] int* count, [out, retval] IWebHistoryItem** items);
     HRESULT data([out, retval] IStream**);
+    HRESULT setVisitedLinkTrackingEnabled([in] BOOL visitedLinkTrackingEnable);
+    HRESULT removeAllVisitedLinks();
 }
diff --git a/WebKit/win/Interfaces/IWebNavigationData.idl b/WebKit/win/Interfaces/IWebNavigationData.idl
new file mode 100644
index 0000000..cd39159
--- /dev/null
+++ b/WebKit/win/Interfaces/IWebNavigationData.idl
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DO_NO_IMPORTS
+import "oaidl.idl";
+import "ocidl.idl";
+import "IWebURLRequest.idl";
+import "IWebURLResponse.idl";
+#endif
+
+interface IWebURLRequest;
+interface IWebURLResponse;
+
+[
+    object,
+    oleautomation,
+    hidden,
+    uuid(1F162644-73D1-4de1-A20C-295FB68BF048),
+    pointer_default(unique)
+]
+interface IWebNavigationData : IUnknown
+{
+    HRESULT url([out, retval] BSTR*);
+    HRESULT title([out, retval] BSTR*);
+    HRESULT originalRequest([out, retval] IWebURLRequest**);
+    HRESULT response([out, retval] IWebURLResponse**);
+    HRESULT hasSubstituteData([out, retval] BOOL*);
+    HRESULT clientRedirectSource([out, retval] BSTR*);
+}
diff --git a/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl b/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl
index 4bb052c..f77fdb5 100644
--- a/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl
+++ b/WebKit/win/Interfaces/IWebPolicyDelegatePrivate.idl
@@ -41,5 +41,4 @@ interface IWebFrame;
 ]
 interface IWebPolicyDelegatePrivate : IUnknown
 {
-    HRESULT shouldLoadMediaURL([in] IWebView* webView, [in] BSTR url, [in] IWebFrame* frame, [out, retval] BOOL* retval);
 }
diff --git a/WebKit/win/Interfaces/IWebPreferencesPrivate.idl b/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
index d994211..bec70e2 100644
--- a/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
+++ b/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
@@ -82,9 +82,6 @@ interface IWebPreferencesPrivate : IUnknown
     HRESULT experimentalNotificationsEnabled([out, retval] BOOL *enabled);
     HRESULT setExperimentalNotificationsEnabled([in] BOOL enabled);
 
-    HRESULT experimentalWebSocketsEnabled([out, retval] BOOL *enabled);
-    HRESULT setExperimentalWebSocketsEnabled([in] BOOL enabled);
-
     HRESULT setShouldUseHighResolutionTimers([in] BOOL useHighResolutionTimers);
     HRESULT shouldUseHighResolutionTimers([out, retval] BOOL* useHighResolutionTimers);
 
@@ -92,9 +89,6 @@ interface IWebPreferencesPrivate : IUnknown
     // Used by DumpRenderTree.
     HRESULT setPreferenceForTest([in] BSTR key, [in] BSTR value);
 
-    HRESULT setPluginHalterEnabled([in] BOOL enabled);
-    HRESULT pluginHalterEnabled([out, retval] BOOL* enabled);
-
     HRESULT setPluginAllowedRunTime([in] UINT allowedRunTime);
     HRESULT pluginAllowedRunTime([out, retval] UINT* allowedRunTime);
 }
diff --git a/WebKit/win/Interfaces/IWebViewPrivate.idl b/WebKit/win/Interfaces/IWebViewPrivate.idl
index 465d804..d95f92b 100644
--- a/WebKit/win/Interfaces/IWebViewPrivate.idl
+++ b/WebKit/win/Interfaces/IWebViewPrivate.idl
@@ -28,6 +28,7 @@ import "oaidl.idl";
 import "ocidl.idl";
 import "IWebFormDelegate.idl";
 import "IWebFrameLoadDelegatePrivate.idl";
+import "IWebHistoryDelegate.idl";
 import "IWebInspector.idl";
 import "IWebInspectorPrivate.idl";
 #endif
@@ -38,6 +39,7 @@ cpp_quote("#define WebViewWillCloseNotification L\"WebViewWillCloseNotification\
 interface IEnumTextMatches;
 interface IWebFormDelegate;
 interface IWebFrameLoadDelegatePrivate;
+interface IWebHistoryDelegate;
 interface IWebInspector;
 interface IWebInspectorPrivate;
 interface IWebPluginHalterDelegate;
@@ -190,8 +192,10 @@ interface IWebViewPrivate : IUnknown
     HRESULT addUserStyleSheetToGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR source, [in] BSTR url,
                                      [in] unsigned whitelistCount, [in, size_is(whitelistCount)] BSTR* whitelist,
                                      [in] unsigned blacklistCount, [in, size_is(blacklistCount)] BSTR* blacklist);
-    HRESULT removeUserContentWithURLFromGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR url);
-    HRESULT removeUserContentFromGroup([in] BSTR groupName, [in] unsigned worldID);
+    HRESULT removeUserScriptFromGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR url);
+    HRESULT removeUserStyleSheetFromGroup([in] BSTR groupName, [in] unsigned worldID, [in] BSTR url);
+    HRESULT removeUserScriptsFromGroup([in] BSTR groupName, [in] unsigned worldID);
+    HRESULT removeUserStyleSheetsFromGroup([in] BSTR groupName, [in] unsigned worldID);
     HRESULT removeAllUserContentFromGroup([in] BSTR groupName);
 
     HRESULT setPluginHalterDelegate([in] IWebPluginHalterDelegate* d);
@@ -208,4 +212,12 @@ interface IWebViewPrivate : IUnknown
 
     // Removes all white list entries created with whiteListAccessFromOrigin.
     HRESULT resetOriginAccessWhiteLists();
+
+    HRESULT setHistoryDelegate([in] IWebHistoryDelegate* historyDelegate);
+    HRESULT historyDelegate([out,retval] IWebHistoryDelegate** historyDelegate);
+    HRESULT addVisitedLinks([in] BSTR* visitedURLs, [in] unsigned visitedURLCount);
+
+    HRESULT isNodeHaltedPlugin([in] IDOMNode*, [retval, out] BOOL*);
+    HRESULT restartHaltedPluginForNode([in] IDOMNode*);
+    HRESULT hasPluginForNodeBeenHalted([in] IDOMNode*, [retval, out] BOOL*);
 }
diff --git a/WebKit/win/Interfaces/WebKit.idl b/WebKit/win/Interfaces/WebKit.idl
index c9b33cc..cdd24b3 100644
--- a/WebKit/win/Interfaces/WebKit.idl
+++ b/WebKit/win/Interfaces/WebKit.idl
@@ -24,7 +24,7 @@
  */
 
 cpp_quote("/*")
-cpp_quote(" * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.")
+cpp_quote(" * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.")
 cpp_quote(" *")
 cpp_quote(" * Redistribution and use in source and binary forms, with or without")
 cpp_quote(" * modification, are permitted provided that the following conditions")
@@ -90,6 +90,7 @@ import "ocidl.idl";
 #include "IWebHTMLRepresentation.idl"
 #include "IWebHTTPURLResponse.idl"
 #include "IWebHistory.idl"
+#include "IWebHistoryDelegate.idl"
 #include "IWebHistoryItem.idl"
 #include "IWebHistoryItemPrivate.idl"
 #include "IWebHistoryPrivate.idl"
@@ -100,6 +101,7 @@ import "ocidl.idl";
 #include "IWebJavaScriptCollector.idl"
 #include "IWebKitStatistics.idl"
 #include "IWebMutableURLRequestPrivate.idl"
+#include "IWebNavigationData.idl"
 #include "IWebNotification.idl"
 #include "IWebNotificationCenter.idl"
 #include "IWebNotificationObserver.idl"
@@ -129,106 +131,6 @@ import "ocidl.idl";
 #include "IWebViewPrivate.idl"
 #include "IWebWorkersPrivate.idl"
 
-#include "IGEN_DOMObject.idl"
-#include "IGEN_DOMCharacterData.idl"
-#include "IGEN_DOMText.idl"
-#include "IGEN_DOMAttr.idl"
-#include "IGEN_DOMCDATASection.idl"
-#include "IGEN_DOMCSSCharsetRule.idl"
-#include "IGEN_DOMCSSFontFaceRule.idl"
-#include "IGEN_DOMCSSImportRule.idl"
-#include "IGEN_DOMCSSMediaRule.idl"
-#include "IGEN_DOMCSSPageRule.idl"
-#include "IGEN_DOMCSSPrimitiveValue.idl"
-#include "IGEN_DOMCSSRule.idl"
-#include "IGEN_DOMCSSRuleList.idl"
-#include "IGEN_DOMCSSStyleDeclaration.idl"
-#include "IGEN_DOMCSSStyleRule.idl"
-#include "IGEN_DOMCSSStyleSheet.idl"
-#include "IGEN_DOMCSSUnknownRule.idl"
-#include "IGEN_DOMCSSValue.idl"
-#include "IGEN_DOMCSSValueList.idl"
-#include "IGEN_DOMComment.idl"
-#include "IGEN_DOMCounter.idl"
-#include "IGEN_DOMDOMImplementation.idl"
-#include "IGEN_DOMDocument.idl"
-#include "IGEN_DOMDocumentFragment.idl"
-#include "IGEN_DOMDocumentType.idl"
-#include "IGEN_DOMElement.idl"
-#include "IGEN_DOMEntity.idl"
-#include "IGEN_DOMEntityReference.idl"
-#include "IGEN_DOMEvent.idl"
-#include "IGEN_DOMEventListener.idl"
-#include "IGEN_DOMEventTarget.idl"
-#include "IGEN_DOMHTMLAnchorElement.idl"
-#include "IGEN_DOMHTMLAppletElement.idl"
-#include "IGEN_DOMHTMLAreaElement.idl"
-#include "IGEN_DOMHTMLBRElement.idl"
-#include "IGEN_DOMHTMLBaseElement.idl"
-#include "IGEN_DOMHTMLBaseFontElement.idl"
-#include "IGEN_DOMHTMLBlockquoteElement.idl"
-#include "IGEN_DOMHTMLBodyElement.idl"
-#include "IGEN_DOMHTMLButtonElement.idl"
-#include "IGEN_DOMHTMLCollection.idl"
-#include "IGEN_DOMHTMLDListElement.idl"
-#include "IGEN_DOMHTMLDirectoryElement.idl"
-#include "IGEN_DOMHTMLDivElement.idl"
-#include "IGEN_DOMHTMLDocument.idl"
-#include "IGEN_DOMHTMLElement.idl"
-#include "IGEN_DOMHTMLEmbedElement.idl"
-#include "IGEN_DOMHTMLFieldSetElement.idl"
-#include "IGEN_DOMHTMLFontElement.idl"
-#include "IGEN_DOMHTMLFormElement.idl"
-#include "IGEN_DOMHTMLFrameElement.idl"
-#include "IGEN_DOMHTMLFrameSetElement.idl"
-#include "IGEN_DOMHTMLHRElement.idl"
-#include "IGEN_DOMHTMLHeadElement.idl"
-#include "IGEN_DOMHTMLHeadingElement.idl"
-#include "IGEN_DOMHTMLHtmlElement.idl"
-#include "IGEN_DOMHTMLIFrameElement.idl"
-#include "IGEN_DOMHTMLImageElement.idl"
-#include "IGEN_DOMHTMLInputElement.idl"
-#include "IGEN_DOMHTMLIsIndexElement.idl"
-#include "IGEN_DOMHTMLLIElement.idl"
-#include "IGEN_DOMHTMLLabelElement.idl"
-#include "IGEN_DOMHTMLLegendElement.idl"
-#include "IGEN_DOMHTMLLinkElement.idl"
-#include "IGEN_DOMHTMLMapElement.idl"
-#include "IGEN_DOMHTMLMarqueeElement.idl"
-#include "IGEN_DOMHTMLMenuElement.idl"
-#include "IGEN_DOMHTMLMetaElement.idl"
-#include "IGEN_DOMHTMLModElement.idl"
-#include "IGEN_DOMHTMLOListElement.idl"
-#include "IGEN_DOMHTMLObjectElement.idl"
-#include "IGEN_DOMHTMLOptGroupElement.idl"
-#include "IGEN_DOMHTMLOptionElement.idl"
-#include "IGEN_DOMHTMLOptionsCollection.idl"
-#include "IGEN_DOMHTMLParagraphElement.idl"
-#include "IGEN_DOMHTMLParamElement.idl"
-#include "IGEN_DOMHTMLPreElement.idl"
-#include "IGEN_DOMHTMLQuoteElement.idl"
-#include "IGEN_DOMHTMLScriptElement.idl"
-#include "IGEN_DOMHTMLSelectElement.idl"
-#include "IGEN_DOMHTMLStyleElement.idl"
-#include "IGEN_DOMHTMLTableCaptionElement.idl"
-#include "IGEN_DOMHTMLTableCellElement.idl"
-#include "IGEN_DOMHTMLTableColElement.idl"
-#include "IGEN_DOMHTMLTableElement.idl"
-#include "IGEN_DOMHTMLTableRowElement.idl"
-#include "IGEN_DOMHTMLTableSectionElement.idl"
-#include "IGEN_DOMHTMLTextAreaElement.idl"
-#include "IGEN_DOMHTMLTitleElement.idl"
-#include "IGEN_DOMHTMLUListElement.idl"
-#include "IGEN_DOMMediaList.idl"
-#include "IGEN_DOMNamedNodeMap.idl"
-#include "IGEN_DOMNode.idl"
-#include "IGEN_DOMNodeList.idl"
-#include "IGEN_DOMNotation.idl"
-#include "IGEN_DOMProcessingInstruction.idl"
-#include "IGEN_DOMRect.idl"
-#include "IGEN_DOMStyleSheet.idl"
-#include "IGEN_DOMStyleSheetList.idl"
-
 #define __TYPELIB_VERSION__ __BUILD_NUMBER_MAJOR__##.##__BUILD_NUMBER_MINOR__
 
 cpp_quote("void shutDownWebKit();")
@@ -370,4 +272,3 @@ library WebKit
         [default] interface IWebWorkersPrivate;
     }
 }
-
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.cpp b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
index 5d39452..0bae1ae 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
@@ -571,6 +571,13 @@ void WebChromeClient::reachedMaxAppCacheSize(int64_t spaceNeeded)
 
 void WebChromeClient::populateVisitedLinks()
 {
+    COMPtr<IWebHistoryDelegate> historyDelegate;
+    m_webView->historyDelegate(&historyDelegate);
+    if (historyDelegate) {
+        historyDelegate->populateVisitedLinksForWebView(m_webView);
+        return;
+    }
+
     WebHistory* history = WebHistory::sharedHistory();
     if (!history)
         return;
diff --git a/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp b/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
index e42b4cf..ca3a6c4 100644
--- a/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
@@ -143,7 +143,7 @@ void WebContextMenuClient::searchWithGoogle(const Frame* frame)
 
     ResourceRequest request = ResourceRequest(url);
     if (Page* page = frame->page())
-        page->mainFrame()->loader()->urlSelected(request, String(), 0, false, false, true);
+        page->mainFrame()->loader()->urlSelected(request, String(), 0, false, false, true, SendReferrer);
 }
 
 void WebContextMenuClient::lookUpInDictionary(Frame*)
diff --git a/WebKit/win/WebCoreSupport/WebDragClient.cpp b/WebKit/win/WebCoreSupport/WebDragClient.cpp
index 840fca1..8451bd6 100644
--- a/WebKit/win/WebCoreSupport/WebDragClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebDragClient.cpp
@@ -172,16 +172,27 @@ void WebDragClient::startDrag(DragImageRef image, const IntPoint& imageOrigin, c
         }
 
         DWORD okEffect = draggingSourceOperationMaskToDragCursors(m_webView->page()->dragController()->sourceDragOperation());
-        DWORD effect;
+        DWORD effect = DROPEFFECT_NONE;
         COMPtr<IWebUIDelegate> ui;
+        HRESULT hr = E_NOTIMPL;
         if (SUCCEEDED(m_webView->uiDelegate(&ui))) {
             COMPtr<IWebUIDelegatePrivate> uiPrivate;
             if (SUCCEEDED(ui->QueryInterface(IID_IWebUIDelegatePrivate, (void**)&uiPrivate)))
-                if (SUCCEEDED(uiPrivate->doDragDrop(m_webView, dataObject.get(), source.get(), okEffect, &effect)))
-                    return;
+                hr = uiPrivate->doDragDrop(m_webView, dataObject.get(), source.get(), okEffect, &effect);
         }
-
-        DoDragDrop(dataObject.get(), source.get(), okEffect, &effect);
+        if (hr == E_NOTIMPL)
+            hr = DoDragDrop(dataObject.get(), source.get(), okEffect, &effect);
+
+        DragOperation operation = DragOperationNone;
+        if (hr == DRAGDROP_S_DROP) {
+            if (effect & DROPEFFECT_COPY)
+                operation = DragOperationCopy;
+            else if (effect & DROPEFFECT_LINK)
+                operation = DragOperationLink;
+            else if (effect & DROPEFFECT_MOVE)
+                operation = DragOperationMove;
+        }
+        frame->eventHandler()->dragSourceEndedAt(generateMouseEvent(m_webView, false), operation);
     }
 }
 
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index 1281420..2a3bf3c 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -43,6 +43,7 @@
 #include "WebHistory.h"
 #include "WebHistoryItem.h"
 #include "WebMutableURLRequest.h"
+#include "WebNavigationData.h"
 #include "WebNotificationCenter.h"
 #include "WebSecurityOrigin.h"
 #include "WebURLAuthenticationChallenge.h"
@@ -493,34 +494,70 @@ void WebFrameLoaderClient::finishedLoading(DocumentLoader* loader)
 
 void WebFrameLoaderClient::updateGlobalHistory()
 {
+    DocumentLoader* loader = core(m_webFrame)->loader()->documentLoader();
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebHistoryDelegate> historyDelegate;
+    webView->historyDelegate(&historyDelegate);
+
+    if (historyDelegate) {
+        BString url(loader->urlForHistory());
+        BString title(loader->title());
+        BString redirectSource(loader->clientRedirectSourceForHistory());
+        COMPtr<IWebURLResponse> urlResponse(AdoptCOM, WebURLResponse::createInstance(loader->response()));
+        COMPtr<IWebURLRequest> urlRequest(AdoptCOM, WebMutableURLRequest::createInstance(loader->originalRequestCopy()));
+        
+        COMPtr<IWebNavigationData> navigationData(AdoptCOM, WebNavigationData::createInstance(
+            url, title, urlRequest.get(), urlResponse.get(), loader->substituteData().isValid(), redirectSource));
+
+        historyDelegate->didNavigateWithNavigationData(webView, navigationData.get(), m_webFrame);
+        return;
+    }
+
     WebHistory* history = WebHistory::sharedHistory();
     if (!history)
         return;
 
-    DocumentLoader* loader = core(m_webFrame)->loader()->documentLoader();
     history->visitedURL(loader->urlForHistory(), loader->title(), loader->originalRequestCopy().httpMethod(), loader->urlForHistoryReflectsFailure(), !loader->clientRedirectSourceForHistory());
 }
 
 void WebFrameLoaderClient::updateGlobalHistoryRedirectLinks()
 {
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebHistoryDelegate> historyDelegate;
+    webView->historyDelegate(&historyDelegate);
+
     WebHistory* history = WebHistory::sharedHistory();
-    if (!history)
-        return;
 
     DocumentLoader* loader = core(m_webFrame)->loader()->documentLoader();
     ASSERT(loader->unreachableURL().isEmpty());
 
     if (!loader->clientRedirectSourceForHistory().isNull()) {
-        if (COMPtr<IWebHistoryItem> iWebHistoryItem = history->itemForURLString(loader->clientRedirectSourceForHistory())) {
-            COMPtr<WebHistoryItem> webHistoryItem(Query, iWebHistoryItem);
-            webHistoryItem->historyItem()->addRedirectURL(loader->clientRedirectDestinationForHistory());
+        if (historyDelegate) {
+            BString sourceURL(loader->clientRedirectSourceForHistory());
+            BString destURL(loader->clientRedirectDestinationForHistory());
+            historyDelegate->didPerformClientRedirectFromURL(webView, sourceURL, destURL, m_webFrame);
+        } else {
+            if (history) {
+                if (COMPtr<IWebHistoryItem> iWebHistoryItem = history->itemForURLString(loader->clientRedirectSourceForHistory())) {
+                    COMPtr<WebHistoryItem> webHistoryItem(Query, iWebHistoryItem);
+                    webHistoryItem->historyItem()->addRedirectURL(loader->clientRedirectDestinationForHistory());
+                }
+            }
         }
     }
 
     if (!loader->serverRedirectSourceForHistory().isNull()) {
-        if (COMPtr<IWebHistoryItem> iWebHistoryItem = history->itemForURLString(loader->serverRedirectSourceForHistory())) {
-            COMPtr<WebHistoryItem> webHistoryItem(Query, iWebHistoryItem);
-            webHistoryItem->historyItem()->addRedirectURL(loader->serverRedirectDestinationForHistory());
+        if (historyDelegate) {
+            BString sourceURL(loader->serverRedirectSourceForHistory());
+            BString destURL(loader->serverRedirectDestinationForHistory());
+            historyDelegate->didPerformServerRedirectFromURL(webView, sourceURL, destURL, m_webFrame);
+        } else {
+            if (history) {
+                if (COMPtr<IWebHistoryItem> iWebHistoryItem = history->itemForURLString(loader->serverRedirectSourceForHistory())) {
+                    COMPtr<WebHistoryItem> webHistoryItem(Query, iWebHistoryItem);
+                    webHistoryItem->historyItem()->addRedirectURL(loader->serverRedirectDestinationForHistory());
+                }
+            }
         }
     }
 }
@@ -572,6 +609,16 @@ PassRefPtr<DocumentLoader> WebFrameLoaderClient::createDocumentLoader(const Reso
 
 void WebFrameLoaderClient::setTitle(const String& title, const KURL& url)
 {
+    WebView* webView = m_webFrame->webView();
+    COMPtr<IWebHistoryDelegate> historyDelegate;
+    webView->historyDelegate(&historyDelegate);
+    if (historyDelegate) {
+        BString titleBSTR(title);
+        BString urlBSTR(url.string());
+        historyDelegate->updateHistoryTitle(webView, titleBSTR, urlBSTR);
+        return;
+    }
+
     BOOL privateBrowsingEnabled = FALSE;
     COMPtr<IWebPreferences> preferences;
     if (SUCCEEDED(m_webFrame->webView()->preferences(&preferences)))
@@ -795,24 +842,3 @@ bool WebFrameLoaderClient::shouldUsePluginDocument(const String& mimeType) const
 
     return webView->shouldUseEmbeddedView(mimeType);
 }
-
-bool WebFrameLoaderClient::shouldLoadMediaElementURL(const KURL& url) const
-{
-    WebView* webView = m_webFrame->webView();
-    if (!webView)
-        return true;
-
-    COMPtr<IWebPolicyDelegate> policyDelegate;
-    if (FAILED(webView->policyDelegate(&policyDelegate)) || !policyDelegate)
-        return true;
-
-    COMPtr<IWebPolicyDelegatePrivate> policyDelegatePrivate(Query, policyDelegate);
-    if (!policyDelegatePrivate)
-        return true;
-
-    BOOL retval;
-    if (FAILED(policyDelegatePrivate->shouldLoadMediaURL(webView, BString(url), m_webFrame, &retval)))
-        return true;
-
-    return retval;
-}
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
index a215cf9..921ae91 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.h
@@ -112,7 +112,6 @@ public:
     virtual bool shouldUsePluginDocument(const WebCore::String& mimeType) const;
 
     virtual void dispatchDidFailToStartPlugin(const WebCore::PluginView*) const;
-    virtual bool shouldLoadMediaElementURL(const WebCore::KURL&) const;
 
 protected:
     WebFrameLoaderClient(WebFrame*);
diff --git a/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp b/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
index aef313b..78daf8d 100644
--- a/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebPluginHalterClient.cpp
@@ -56,3 +56,12 @@ bool WebPluginHalterClient::shouldHaltPlugin(WebCore::Node* n) const
 
     return shouldHalt;
 }
+
+bool WebPluginHalterClient::enabled() const
+{
+    IWebPluginHalterDelegate* d;
+    if (FAILED(m_webView->pluginHalterDelegate(&d)) || !d)
+        return false;
+
+    return true;
+}
diff --git a/WebKit/win/WebCoreSupport/WebPluginHalterClient.h b/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
index 1752444..7d05fe9 100644
--- a/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
+++ b/WebKit/win/WebCoreSupport/WebPluginHalterClient.h
@@ -39,6 +39,7 @@ public:
     WebPluginHalterClient(WebView* webView);
 
     virtual bool shouldHaltPlugin(WebCore::Node* n) const;
+    virtual bool enabled() const;
 
 private:
     WebView* m_webView;
diff --git a/WebKit/win/WebDropSource.cpp b/WebKit/win/WebDropSource.cpp
index 63465e2..5c26b37 100644
--- a/WebKit/win/WebDropSource.cpp
+++ b/WebKit/win/WebDropSource.cpp
@@ -106,10 +106,6 @@ STDMETHODIMP WebDropSource::QueryContinueDrag(BOOL fEscapePressed, DWORD grfKeyS
 {
     if (fEscapePressed || !(grfKeyState & (MK_LBUTTON|MK_RBUTTON))) {
         m_dropped = !fEscapePressed;
-        if (Page* page = m_webView->page())
-            if (Frame* frame = page->mainFrame()) 
-                //FIXME: We need to figure out how to find out what actually happened in the drag <rdar://problem/5015961>
-                frame->eventHandler()->dragSourceEndedAt(generateMouseEvent(m_webView.get(), false), fEscapePressed ? DragOperationNone : DragOperationCopy);
         return fEscapePressed? DRAGDROP_S_CANCEL : DRAGDROP_S_DROP;
     } else if (Page* page = m_webView->page())
         if (Frame* frame = page->mainFrame()) 
diff --git a/WebKit/win/WebDropSource.h b/WebKit/win/WebDropSource.h
index 4a969ef..5f06355 100644
--- a/WebKit/win/WebDropSource.h
+++ b/WebKit/win/WebDropSource.h
@@ -32,6 +32,12 @@
 
 class WebView;
 
+namespace WebCore {
+    class PlatformMouseEvent;
+}
+
+WebCore::PlatformMouseEvent generateMouseEvent(WebView*, bool isDrag);
+
 class WebDropSource : public IDropSource
 {
 public:
diff --git a/WebKit/win/WebElementPropertyBag.cpp b/WebKit/win/WebElementPropertyBag.cpp
index 151c9e1..e68b92e 100644
--- a/WebKit/win/WebElementPropertyBag.cpp
+++ b/WebKit/win/WebElementPropertyBag.cpp
@@ -37,6 +37,7 @@
 #include <WebCore/FrameLoader.h>
 #include <WebCore/Image.h>
 #include <WebCore/KURL.h>
+#include <WebCore/RenderObject.h>
 #pragma warning(pop)
 
 using namespace WebCore;
@@ -145,7 +146,9 @@ HRESULT STDMETHODCALLTYPE WebElementPropertyBag::Read(LPCOLESTR pszPropName, VAR
         return S_OK;
     } else if (isEqual(WebElementImageRectKey, key)) {
         V_VT(pVar) = VT_ARRAY;
-        V_ARRAY(pVar) = MarshallingHelpers::intRectToSafeArray(m_result->boundingBox());
+        IntRect boundingBox = m_result->innerNonSharedNode() && m_result->innerNonSharedNode()->renderer() ?
+                                m_result->innerNonSharedNode()->renderer()->absoluteBoundingBoxRect(true) : IntRect();
+        V_ARRAY(pVar) = MarshallingHelpers::intRectToSafeArray(boundingBox);
         return S_OK;
     } else if (isEqual(WebElementImageURLKey, key))
         return convertStringToVariant(pVar, m_result->absoluteImageURL().string());
diff --git a/WebKit/win/WebFrame.cpp b/WebKit/win/WebFrame.cpp
index 6bdf51e..0a1f6d0 100644
--- a/WebKit/win/WebFrame.cpp
+++ b/WebKit/win/WebFrame.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -77,7 +78,6 @@
 #include <WebCore/HTMLPlugInElement.h>
 #include <WebCore/JSDOMWindow.h>
 #include <WebCore/KeyboardEvent.h>
-#include <WebCore/MIMETypeRegistry.h>
 #include <WebCore/MouseRelatedEvent.h>
 #include <WebCore/NotImplemented.h>
 #include <WebCore/Page.h>
@@ -96,6 +96,9 @@
 #include <WebCore/ScriptController.h>
 #include <WebCore/SecurityOrigin.h>
 #include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSLock.h>
+#include <JavaScriptCore/JSObject.h>
+#include <JavaScriptCore/JSValue.h>
 #include <wtf/MathExtras.h>
 #pragma warning(pop)
 
@@ -116,6 +119,11 @@ extern "C" {
 using namespace WebCore;
 using namespace HTMLNames;
 
+using JSC::JSGlobalObject;
+using JSC::JSLock;
+using JSC::JSValue;
+using JSC::SilenceAssertionsOnly;
+
 #define FLASH_REDRAW 0
 
 
@@ -479,7 +487,17 @@ JSGlobalContextRef STDMETHODCALLTYPE WebFrame::globalContext()
     if (!coreFrame)
         return 0;
 
-    return toGlobalRef(coreFrame->script()->globalObject()->globalExec());
+    return toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
+}
+
+JSGlobalContextRef STDMETHODCALLTYPE WebFrame::contextForWorldID(
+    /* [in] */ unsigned worldID)
+{
+    Frame* coreFrame = core(this);
+    if (!coreFrame)
+        return 0;
+
+    return toGlobalRef(coreFrame->script()->globalObject(worldID)->globalExec());
 }
 
 HRESULT STDMETHODCALLTYPE WebFrame::loadRequest( 
@@ -806,6 +824,25 @@ HRESULT STDMETHODCALLTYPE WebFrame::renderTreeAsExternalRepresentation(
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE WebFrame::counterValueForElementById(
+    /* [in] */ BSTR id, /* [retval][out] */ BSTR *result)
+{
+    if (!result)
+        return E_POINTER;
+
+    Frame* coreFrame = core(this);
+    if (!coreFrame)
+        return E_FAIL;
+
+    String coreId = String(id, SysStringLen(id));
+
+    Element* element = coreFrame->document()->getElementById(coreId);
+    if (!element)
+        return E_FAIL;
+    *result = BString(counterValueForElement(element)).release();
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE WebFrame::scrollOffset(
         /* [retval][out] */ SIZE* offset)
 {
@@ -1664,25 +1701,9 @@ PassRefPtr<Widget> WebFrame::createJavaAppletWidget(const IntSize& pluginSize, H
     return pluginView;
 }
 
-ObjectContentType WebFrame::objectContentType(const KURL& url, const String& mimeTypeIn)
+ObjectContentType WebFrame::objectContentType(const KURL& url, const String& mimeType)
 {
-    String mimeType = mimeTypeIn;
-    if (mimeType.isEmpty())
-        mimeType = MIMETypeRegistry::getMIMETypeForExtension(url.path().substring(url.path().reverseFind('.') + 1));
-
-    if (mimeType.isEmpty())
-        return ObjectContentFrame; // Go ahead and hope that we can display the content.
-
-    if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
-        return WebCore::ObjectContentImage;
-
-    if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
-        return WebCore::ObjectContentNetscapePlugin;
-
-    if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
-        return WebCore::ObjectContentFrame;
-
-    return WebCore::ObjectContentNone;
+    return WebCore::FrameLoader::defaultObjectContentType(url, mimeType);
 }
 
 String WebFrame::overrideMediaType() const
@@ -1702,8 +1723,8 @@ void WebFrame::windowObjectCleared()
 
     COMPtr<IWebFrameLoadDelegate> frameLoadDelegate;
     if (SUCCEEDED(d->webView->frameLoadDelegate(&frameLoadDelegate))) {
-        JSContextRef context = toRef(coreFrame->script()->globalObject()->globalExec());
-        JSObjectRef windowObject = toRef(coreFrame->script()->globalObject());
+        JSContextRef context = toRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
+        JSObjectRef windowObject = toRef(coreFrame->script()->globalObject(mainThreadNormalWorld()));
         ASSERT(windowObject);
 
         if (FAILED(frameLoadDelegate->didClearWindowObject(d->webView, context, windowObject, this)))
@@ -2148,6 +2169,49 @@ HRESULT STDMETHODCALLTYPE WebFrame::isDescendantOfFrame(
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE WebFrame::stringByEvaluatingJavaScriptInIsolatedWorld(
+    /* [in] */ unsigned int worldID,
+    /* [in] */ OLE_HANDLE jsGlobalObject,
+    /* [in] */ BSTR script,
+    /* [retval][out] */ BSTR* evaluationResult)
+{
+    if (!evaluationResult)
+        return E_POINTER;
+    *evaluationResult = 0;
+
+    Frame* coreFrame = core(this);
+    JSObjectRef globalObjectRef = reinterpret_cast<JSObjectRef>(jsGlobalObject);
+    String string = String(script, SysStringLen(script));
+
+    // Start off with some guess at a frame and a global object, we'll try to do better...!
+    JSDOMWindow* anyWorldGlobalObject = coreFrame->script()->globalObject(mainThreadNormalWorld());
+
+    // The global object is probably a shell object? - if so, we know how to use this!
+    JSC::JSObject* globalObjectObj = toJS(globalObjectRef);
+    if (!strcmp(globalObjectObj->classInfo()->className, "JSDOMWindowShell"))
+        anyWorldGlobalObject = static_cast<JSDOMWindowShell*>(globalObjectObj)->window();
+
+    // Get the frame frome the global object we've settled on.
+    Frame* frame = anyWorldGlobalObject->impl()->frame();
+    ASSERT(frame->document());
+    JSValue result = frame->script()->executeScriptInIsolatedWorld(worldID, string, true).jsValue();
+
+    if (!frame) // In case the script removed our frame from the page.
+        return S_OK;
+
+    // This bizarre set of rules matches behavior from WebKit for Safari 2.0.
+    // If you don't like it, use -[WebScriptObject evaluateWebScript:] or 
+    // JSEvaluateScript instead, since they have less surprising semantics.
+    if (!result || !result.isBoolean() && !result.isString() && !result.isNumber())
+        return S_OK;
+
+    JSLock lock(SilenceAssertionsOnly);
+    String resultString = String(result.toString(anyWorldGlobalObject->globalExec()));
+    *evaluationResult = BString(resultString).release();
+
+    return S_OK;
+}
+
 void WebFrame::unmarkAllMisspellings()
 {
     Frame* coreFrame = core(this);
diff --git a/WebKit/win/WebFrame.h b/WebKit/win/WebFrame.h
index 8edc81a..d0f6adf 100644
--- a/WebKit/win/WebFrame.h
+++ b/WebKit/win/WebFrame.h
@@ -158,6 +158,10 @@ public:
     virtual HRESULT STDMETHODCALLTYPE renderTreeAsExternalRepresentation(
         /* [retval][out] */ BSTR *result);
 
+    virtual HRESULT STDMETHODCALLTYPE counterValueForElementById(
+        /* [in] */ BSTR id,
+        /* [retval][out] */ BSTR *result);
+
     virtual HRESULT STDMETHODCALLTYPE scrollOffset(
         /* [retval][out] */ SIZE* offset);
 
@@ -244,6 +248,15 @@ public:
         /* [in] */ BSTR url,
         /* [retval][out] */ BOOL* result);
 
+    virtual HRESULT STDMETHODCALLTYPE stringByEvaluatingJavaScriptInIsolatedWorld( 
+        /* [in] */ unsigned int worldID,
+        /* [in] */ OLE_HANDLE jsGlobalObject,
+        /* [in] */ BSTR script,
+        /* [retval][out] */ BSTR* evaluationResult);
+
+    virtual /* [local] */ JSGlobalContextRef STDMETHODCALLTYPE contextForWorldID(
+        /* [in] */ unsigned worldID);
+
     // IWebDocumentText
     virtual HRESULT STDMETHODCALLTYPE supportsTextEncoding( 
         /* [retval][out] */ BOOL* result);
diff --git a/WebKit/win/WebHistory.cpp b/WebKit/win/WebHistory.cpp
index 854031a..deb75e5 100644
--- a/WebKit/win/WebHistory.cpp
+++ b/WebKit/win/WebHistory.cpp
@@ -577,6 +577,18 @@ HRESULT WebHistory::data(IStream** stream)
     return result.copyRefTo(stream);
 }
 
+HRESULT WebHistory::setVisitedLinkTrackingEnabled(BOOL visitedLinkTrackingEnabled)
+{
+    PageGroup::setShouldTrackVisitedLinks(visitedLinkTrackingEnabled);
+    return S_OK;
+}
+
+HRESULT WebHistory::removeAllVisitedLinks()
+{
+    PageGroup::removeAllVisitedLinks();
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE WebHistory::setHistoryItemLimit( 
     /* [in] */ int limit)
 {
diff --git a/WebKit/win/WebHistory.h b/WebKit/win/WebHistory.h
index 96e1404..9d8acb3 100644
--- a/WebKit/win/WebHistory.h
+++ b/WebKit/win/WebHistory.h
@@ -116,6 +116,9 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE data(IStream**);
 
+    virtual HRESULT STDMETHODCALLTYPE setVisitedLinkTrackingEnabled(BOOL visitedLinkTrackingEnable);
+    virtual HRESULT STDMETHODCALLTYPE removeAllVisitedLinks();
+
     // WebHistory
     static WebHistory* sharedHistory();
     void visitedURL(const WebCore::KURL&, const WebCore::String& title, const WebCore::String& httpMethod, bool wasFailure, bool increaseVisitCount);
diff --git a/WebKit/win/WebKit.vcproj/Interfaces.vcproj b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
index cbc8231..75c7c11 100644
--- a/WebKit/win/WebKit.vcproj/Interfaces.vcproj
+++ b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
@@ -784,6 +784,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebHistoryDelegate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebHistoryItem.idl"

 			>

 			<FileConfiguration

@@ -1044,6 +1064,26 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebNavigationData.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebNotification.idl"

 			>

 			<FileConfiguration

diff --git a/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj b/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj
deleted file mode 100644
index f6cc1d4..0000000
--- a/WebKit/win/WebKit.vcproj/InterfacesGenerated.vcproj
+++ /dev/null
@@ -1,48 +0,0 @@
-<?xml version="1.0" encoding="Windows-1252"?>

-<VisualStudioProject

-	ProjectType="Visual C++"

-	Version="8.00"

-	Name="InterfacesGenerated"

-	ProjectGUID="{62C897BE-E207-4BC4-B37D-6F9F9116F166}"

-	Keyword="MakeFileProj"

-	>

-	<Platforms>

-		<Platform

-			Name="Win32"

-		/>

-	</Platforms>

-	<ToolFiles>

-	</ToolFiles>

-	<Configurations>

-		<Configuration

-			Name="Release|Win32"

-			OutputDirectory="$(WebKitOutputDir)\lib"

-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

-			ConfigurationType="0"

-			>

-			<Tool

-				Name="VCNMakeTool"

-				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

-				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

-				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

-				Output=""

-				PreprocessorDefinitions=""

-				IncludeSearchPath=""

-				ForcedIncludes=""

-				AssemblySearchPath=""

-				ForcedUsingAssemblies=""

-				CompileAsManaged=""

-			/>

-		</Configuration>

-	</Configurations>

-	<References>

-	</References>

-	<Files>

-		<File

-			RelativePath=".\build-generated-files.sh"

-			>

-		</File>

-	</Files>

-	<Globals>

-	</Globals>

-</VisualStudioProject>

diff --git a/WebKit/win/WebKit.vcproj/WebKit.make b/WebKit/win/WebKit.vcproj/WebKit.make
index 29802a7..072d724 100755
--- a/WebKit/win/WebKit.vcproj/WebKit.make
+++ b/WebKit/win/WebKit.vcproj/WebKit.make
@@ -1,7 +1,7 @@
 !IF !defined(BUILDSTYLE)
 BUILDSTYLE=Release
 !ELSEIF "$(BUILDSTYLE)"=="DEBUG"
-BUILDSTYLE=Debug_Internal
+BUILDSTYLE=Debug_All
 !ENDIF
 
 install:
diff --git a/WebKit/win/WebKit.vcproj/WebKit.rc b/WebKit/win/WebKit.vcproj/WebKit.rc
index a7cbfd3..3d00011 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.rc
+++ b/WebKit/win/WebKit.vcproj/WebKit.rc
@@ -2,7 +2,7 @@
 //
 #include "resource.h"
 #include "autoversion.h"
-#include "winres.h"
+#include "winresrc.h"
 
 #ifdef _WIN32
 LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
diff --git a/WebKit/win/WebKit.vcproj/WebKit.sln b/WebKit/win/WebKit.vcproj/WebKit.sln
index 79dff87..433bf4c 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.sln
+++ b/WebKit/win/WebKit.vcproj/WebKit.sln
@@ -13,7 +13,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebKitGUID", "WebKitGUID.vc
 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Interfaces", "Interfaces.vcproj", "{91762BE2-87EF-4F5A-A480-48B90EB3F406}"

 	ProjectSection(ProjectDependencies) = postProject

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166} = {62C897BE-E207-4BC4-B37D-6F9F9116F166}

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6} = {1C16337B-ACF3-4D03-AA90-851C5B5EADA6}

 	EndProjectSection

 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebCore", "..\..\..\WebCore\WebCore.vcproj\WebCore.vcproj", "{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}"

@@ -58,11 +58,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ImageDiff", "..\..\..\WebKi
 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "JavaScriptCoreGenerated", "..\..\..\JavaScriptCore\JavaScriptCore.vcproj\JavaScriptCore\JavaScriptCoreGenerated.vcproj", "{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}"

 EndProject

-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InterfacesGenerated", "InterfacesGenerated.vcproj", "{62C897BE-E207-4BC4-B37D-6F9F9116F166}"

-	ProjectSection(ProjectDependencies) = postProject

-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6} = {1C16337B-ACF3-4D03-AA90-851C5B5EADA6}

-	EndProjectSection

-EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebCoreGenerated", "..\..\..\WebCore\WebCore.vcproj\WebCoreGenerated.vcproj", "{0A324352-B3B6-496C-9E5B-4C7E923E628B}"

 	ProjectSection(ProjectDependencies) = postProject

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5} = {011D10F1-B656-4A1B-A0C3-3842F02122C5}

@@ -87,6 +82,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "record-memory-win", "..\..\
 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Cairo|Win32 = Debug_Cairo|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

@@ -94,6 +90,8 @@ Global
 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -104,6 +102,8 @@ Global
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.ActiveCfg = Release|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.Build.0 = Release|Win32

+		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_Cairo|Win32.Build.0 = Debug|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -114,6 +114,8 @@ Global
 		{B8437A41-67BC-4769-9452-45203827F821}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.ActiveCfg = Release|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.Build.0 = Release|Win32

+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.ActiveCfg = Debug|Win32

+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.Build.0 = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_Cairo|Win32.Build.0 = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

@@ -124,6 +126,8 @@ Global
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.ActiveCfg = Release|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.Build.0 = Release|Win32

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -134,6 +138,8 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32

+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -144,6 +150,8 @@ Global
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.ActiveCfg = Release|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.Build.0 = Release|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -154,6 +162,8 @@ Global
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.ActiveCfg = Release|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.Build.0 = Release|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo|Win32.Build.0 = Debug_CFLite|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -164,6 +174,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.Build.0 = Debug_CFLite|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -174,6 +186,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo|Win32.Build.0 = Debug|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -184,16 +198,20 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Cairo|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Cairo|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Cairo|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = all|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Cairo|Win32.Build.0 = Debug|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

@@ -204,36 +222,32 @@ Global
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.ActiveCfg = Release|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo|Win32.Build.0 = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = Release|Win32

-		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug_Cairo|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Release_Cairo|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Release_Cairo|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Release|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Release|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Cairo|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo|Win32.Build.0 = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32

-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Internal|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo|Win32.Build.0 = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Cairo|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Cairo|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Internal|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = all|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

@@ -242,16 +256,20 @@ Global
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_Cairo|Win32.ActiveCfg = Release|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

-		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

-		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Internal|Win32.Build.0 = Debug|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug|Win32.ActiveCfg = Debug|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug|Win32.Build.0 = Debug|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_Cairo|Win32.ActiveCfg = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.ActiveCfg = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.Build.0 = Release|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.Build.0 = Debug_CFLite|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

@@ -262,6 +280,8 @@ Global
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.ActiveCfg = Release|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.Build.0 = Release|Win32

+		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_All|Win32.ActiveCfg = Release|Win32

+		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_All|Win32.Build.0 = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_Cairo|Win32.Build.0 = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_Internal|Win32.ActiveCfg = Release|Win32

diff --git a/WebKit/win/WebKit.vcproj/WebKit.submit.sln b/WebKit/win/WebKit.vcproj/WebKit.submit.sln
index c3c2bb9..dbbc8e0 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.submit.sln
+++ b/WebKit/win/WebKit.vcproj/WebKit.submit.sln
@@ -1,57 +1,51 @@
 

 Microsoft Visual Studio Solution File, Format Version 9.00

-# Visual C++ Express 2005

+# Visual Studio 2005

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebKit", "WebKit.vcproj", "{0662A8A9-82A3-4638-97D8-EC425D8D87C9}"

 	ProjectSection(ProjectDependencies) = postProject

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166} = {62C897BE-E207-4BC4-B37D-6F9F9116F166}

-		{B8437A41-67BC-4769-9452-45203827F821} = {B8437A41-67BC-4769-9452-45203827F821}

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406} = {91762BE2-87EF-4F5A-A480-48B90EB3F406}

+		{B8437A41-67BC-4769-9452-45203827F821} = {B8437A41-67BC-4769-9452-45203827F821}

 	EndProjectSection

 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebKitGUID", "WebKitGUID.vcproj", "{B8437A41-67BC-4769-9452-45203827F821}"

 	ProjectSection(ProjectDependencies) = postProject

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166} = {62C897BE-E207-4BC4-B37D-6F9F9116F166}

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406} = {91762BE2-87EF-4F5A-A480-48B90EB3F406}

 	EndProjectSection

 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Interfaces", "Interfaces.vcproj", "{91762BE2-87EF-4F5A-A480-48B90EB3F406}"

-	ProjectSection(ProjectDependencies) = postProject

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166} = {62C897BE-E207-4BC4-B37D-6F9F9116F166}

-	EndProjectSection

-EndProject

-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InterfacesGenerated", "InterfacesGenerated.vcproj", "{62C897BE-E207-4BC4-B37D-6F9F9116F166}"

 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug|Win32.ActiveCfg = Debug|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug|Win32.Build.0 = Debug|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.ActiveCfg = Release|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.Build.0 = Release|Win32

+		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug|Win32.ActiveCfg = Debug|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug|Win32.Build.0 = Debug|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.ActiveCfg = Release|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.Build.0 = Release|Win32

+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.ActiveCfg = Debug|Win32

+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.Build.0 = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_Internal|Win32.Build.0 = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug|Win32.ActiveCfg = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug|Win32.Build.0 = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.ActiveCfg = Release|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug_Internal|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug_Internal|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Debug|Win32.Build.0 = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Release|Win32.ActiveCfg = Release|Win32

-		{62C897BE-E207-4BC4-B37D-6F9F9116F166}.Release|Win32.Build.0 = Release|Win32

 	EndGlobalSection

 	GlobalSection(SolutionProperties) = preSolution

 		HideSolutionNode = FALSE

diff --git a/WebKit/win/WebKit.vcproj/WebKit.vcproj b/WebKit/win/WebKit.vcproj/WebKit.vcproj
index 021dc94..121f773 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.vcproj
+++ b/WebKit/win/WebKit.vcproj/WebKit.vcproj
@@ -247,8 +247,6 @@
 		</Configuration>

 		<Configuration

 			Name="Debug_Cairo|Win32"

-			OutputDirectory="$(WebKitOutputDir)\bin"

-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

 			ConfigurationType="2"

 			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\WinCairo.vsprops;$(WebKitLibrariesDir)\tools\vsprops\cURL.vsprops"

 			CharacterSet="1"

@@ -403,6 +401,83 @@
 				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\include\JavaScriptCore\*&quot; &quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..\WebCoreSupport&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

+				PreprocessorDefinitions="_USRDLL;WEBKIT_EXPORTS;FRAMEWORK_NAME=WebKit;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_VIDEO;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"

+				UsePrecompiledHeader="2"

+				PrecompiledHeaderThrough="WebKitPrefix.h"

+				Detect64BitPortabilityProblems="false"

+				DisableSpecificWarnings="4819"

+				ForcedIncludeFiles="WebKitPrefix.h"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories="$(WebKitOutputDir)\obj\WebKit\"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+				CommandLine=""

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="delayimp.lib kernel32.lib user32.lib gdi32.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib usp10.lib comctl32.lib version.lib shlwapi.lib libxml2$(LibraryConfigSuffix).lib libxslt$(LibraryConfigSuffix).lib icuin$(LibraryConfigSuffix).lib icuuc$(LibraryConfigSuffix).lib SQLite3$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebCore$(WebKitConfigSuffix).lib WebKitSystemInterface$(WebKitConfigSuffix).lib msimg32.lib QTMovieWin$(WebKitConfigSuffix).lib crypt32.lib iphlpapi.lib winmm.lib rpcrt4.lib comsuppw.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitDLLConfigSuffix).dll"

+				AdditionalLibraryDirectories=""

+				ModuleDefinitionFile="WebKit$(WebKitDLLConfigSuffix).def"

+				DelayLoadDLLs="comdlg32.dll;usp10.dll;comctl32.dll;version.dll;libxslt$(LibraryConfigSuffix).dll;SQLite3$(LibraryConfigSuffix).dll;msimg32.dll;QTMovieWin$(WebKitConfigSuffix).dll;iphlpapi.dll;rpcrt4.dll"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebLocalizableStrings.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitGraphics.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebKitCOMAPI.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\WebPreferenceKeysPrivate.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npfunctions.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npapi.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\include\WebCore\npruntime_internal.h&quot; &quot;$(WebKitOutputDir)\include\WebKit&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\..\English.lproj\Localizable.strings&quot; &quot;$(OutDir)\WebKit.resources\en.lproj\&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

@@ -451,6 +526,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\AccessibleImage.h"

+				>

+			</File>

+			<File

 				RelativePath=".\autoversion.h"

 				>

 			</File>

@@ -679,6 +758,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebNavigationData.h"

+				>

+			</File>

+			<File

 				RelativePath="..\WebNodeHighlight.h"

 				>

 			</File>

@@ -763,6 +846,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\AccessibleImage.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\CFDictionaryPropertyBag.cpp"

 				>

 			</File>

@@ -865,6 +952,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\WebCoreStatistics.cpp"

@@ -933,6 +1028,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\WebDropSource.cpp"

@@ -995,6 +1098,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\WebNavigationData.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\WebNotification.cpp"

 				>

 			</File>

@@ -1081,6 +1188,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\WebURLCredential.cpp"

@@ -1181,6 +1296,14 @@
 						AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\lib&quot;;&quot;$(WebKitOutputDir)\obj\$(ProjectName)\Interfaces&quot;"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCResourceCompilerTool"

+						AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\lib&quot;;&quot;$(WebKitOutputDir)\obj\$(ProjectName)\Interfaces&quot;"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath=".\zoomInCursor.png"

@@ -1232,814 +1355,6 @@
 			</File>

 		</Filter>

 		<Filter

-			Name="DOM"

-			>

-			<File

-				RelativePath="..\DOMCreateInstance.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\DOMCreateInstance.h"

-				>

-			</File>

-			<File

-				RelativePath="..\GEN_DOMObject.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\GEN_DOMObject.h"

-				>

-			</File>

-			<Filter

-				Name="DerivedSources"

-				>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMAttr.cpp"

-					>

-					<FileConfiguration

-						Name="Debug_Internal|Win32"

-						>

-						<Tool

-							Name="VCCLCompilerTool"

-							ShowIncludes="false"

-						/>

-					</FileConfiguration>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMAttr.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCDATASection.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCDATASection.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCharacterData.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCharacterData.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMComment.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMComment.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCounter.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCounter.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSCharsetRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSCharsetRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSFontFaceRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSFontFaceRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSImportRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSImportRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSMediaRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSMediaRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSPageRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSPageRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSPrimitiveValue.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSPrimitiveValue.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSRuleList.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSRuleList.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSStyleDeclaration.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSStyleDeclaration.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSStyleRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSStyleRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSStyleSheet.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSStyleSheet.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSUnknownRule.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSUnknownRule.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSValue.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSValue.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSValueList.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMCSSValueList.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDocument.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDocument.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDocumentFragment.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDocumentFragment.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDocumentType.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDocumentType.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDOMImplementation.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMDOMImplementation.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEntity.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEntity.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEntityReference.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEntityReference.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEvent.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEvent.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEventListener.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMEventTarget.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLAnchorElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLAnchorElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLAppletElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLAppletElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLAreaElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLAreaElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBaseElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBaseElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBaseFontElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBaseFontElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBlockquoteElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBlockquoteElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBodyElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBodyElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBRElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLBRElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLButtonElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLButtonElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLCollection.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLCollection.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDirectoryElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDirectoryElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDivElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDivElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDListElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDListElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDocument.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLDocument.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLEmbedElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLEmbedElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFieldSetElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFieldSetElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFontElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFontElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFormElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFormElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFrameElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFrameElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFrameSetElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLFrameSetElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHeadElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHeadElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHeadingElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHeadingElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHRElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHRElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHtmlElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLHtmlElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLIFrameElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLIFrameElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLImageElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLImageElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLInputElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLInputElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLIsIndexElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLIsIndexElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLabelElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLabelElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLegendElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLegendElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLIElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLIElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLinkElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLLinkElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMapElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMapElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMarqueeElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMarqueeElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMenuElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMenuElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMetaElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLMetaElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLModElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLModElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLObjectElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLObjectElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOListElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOListElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOptGroupElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOptGroupElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOptionElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOptionElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOptionsCollection.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLOptionsCollection.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLParagraphElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLParagraphElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLParamElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLParamElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLPreElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLPreElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLQuoteElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLQuoteElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLScriptElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLScriptElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLSelectElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLSelectElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLStyleElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLStyleElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableCaptionElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableCaptionElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableCellElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableCellElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableColElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableColElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableRowElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableRowElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableSectionElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTableSectionElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTextAreaElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTextAreaElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTitleElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLTitleElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLUListElement.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMHTMLUListElement.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMMediaList.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMMediaList.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNamedNodeMap.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNamedNodeMap.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNode.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNode.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNodeList.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNodeList.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNotation.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMNotation.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMProcessingInstruction.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMProcessingInstruction.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMRect.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMRect.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMStyleSheet.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMStyleSheet.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMStyleSheetList.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMStyleSheetList.h"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMText.cpp"

-					>

-				</File>

-				<File

-					RelativePath="$(WebKitOutputDir)\obj\WebKit\DerivedSources\GEN_DOMText.h"

-					>

-				</File>

-			</Filter>

-		</Filter>

-		<Filter

 			Name="WebCoreSupport"

 			>

 			<File

@@ -2171,6 +1486,15 @@
 					UsePrecompiledHeader="1"

 				/>

 			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_All|Win32"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+					UsePrecompiledHeader="1"

+					PrecompiledHeaderThrough="WebKitPrefix.h"

+				/>

+			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\WebKitPrefix.h"

diff --git a/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj b/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
index 309a021..ab7a0b2 100644
--- a/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
+++ b/WebKit/win/WebKit.vcproj/WebKitGUID.vcproj
@@ -196,6 +196,66 @@
 				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			OutputDirectory="$(WebKitOutputDir)\lib"

+			ConfigurationType="4"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+				AdditionalIncludeDirectories="Interfaces"

+				OutputDirectory="Debug"

+				HeaderFileName="$(InputName).h"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="$(WebKitOutputDir)\$(ConfigurationName)\WebKit"

+				PreprocessorDefinitions="_USRDLL;WEBKITGUID_EXPORTS"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLibrarianTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/WebKit/win/WebKitClassFactory.cpp b/WebKit/win/WebKitClassFactory.cpp
index d1c4b72..c2143b5 100644
--- a/WebKit/win/WebKitClassFactory.cpp
+++ b/WebKit/win/WebKitClassFactory.cpp
@@ -61,7 +61,7 @@
 
 // WebKitClassFactory ---------------------------------------------------------
 #if USE(SAFARI_THEME)
-#if !defined(NDEBUG) && defined(USE_DEBUG_SAFARI_THEME)
+#ifdef DEBUG_ALL
 SOFT_LINK_DEBUG_LIBRARY(SafariTheme)
 #else
 SOFT_LINK_LIBRARY(SafariTheme)
diff --git a/WebKit/win/WebLocalizableStrings.cpp b/WebKit/win/WebLocalizableStrings.cpp
index e2da4cb..69675e2 100644
--- a/WebKit/win/WebLocalizableStrings.cpp
+++ b/WebKit/win/WebLocalizableStrings.cpp
@@ -37,6 +37,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/RetainPtr.h>
+#include <wtf/StdLibExtras.h>
 #include <CoreFoundation/CoreFoundation.h>
 
 class LocalizedString;
@@ -45,8 +46,31 @@ using namespace WebCore;
 
 WebLocalizableStringsBundle WebKitLocalizableStringsBundle = { "com.apple.WebKit", 0 };
 
-static HashMap<String, LocalizedString*> mainBundleLocStrings;
-static HashMap<String, LocalizedString*> frameworkLocStrings;
+typedef HashMap<String, LocalizedString*> LocalizedStringMap;
+
+static Mutex& mainBundleLocStringsMutex()
+{
+    DEFINE_STATIC_LOCAL(Mutex, mutex, ());
+    return mutex;
+}
+
+static LocalizedStringMap& mainBundleLocStrings()
+{
+    DEFINE_STATIC_LOCAL(LocalizedStringMap, map, ());
+    return map;
+}
+
+static Mutex& frameworkLocStringsMutex()
+{
+    DEFINE_STATIC_LOCAL(Mutex, mutex, ());
+    return mutex;
+}
+
+static LocalizedStringMap frameworkLocStrings()
+{
+    DEFINE_STATIC_LOCAL(LocalizedStringMap, map, ());
+    return map;
+}
 
 class LocalizedString : public Noncopyable {
 public:
@@ -156,11 +180,15 @@ static CFStringRef copyLocalizedStringFromBundle(WebLocalizableStringsBundle* st
 
 static LocalizedString* findCachedString(WebLocalizableStringsBundle* stringsBundle, const String& key)
 {
-    if (!stringsBundle)
-        return mainBundleLocStrings.get(key);
+    if (!stringsBundle) {
+        MutexLocker lock(mainBundleLocStringsMutex());
+        return mainBundleLocStrings().get(key);
+    }
 
-    if (stringsBundle->bundle == WebKitLocalizableStringsBundle.bundle)
-        return frameworkLocStrings.get(key);
+    if (stringsBundle->bundle == WebKitLocalizableStringsBundle.bundle) {
+        MutexLocker lock(frameworkLocStringsMutex());
+        return frameworkLocStrings().get(key);
+    }
 
     return 0;
 }
@@ -168,11 +196,13 @@ static LocalizedString* findCachedString(WebLocalizableStringsBundle* stringsBun
 static void cacheString(WebLocalizableStringsBundle* stringsBundle, const String& key, LocalizedString* value)
 {
     if (!stringsBundle) {
-        mainBundleLocStrings.set(key, value);
+        MutexLocker lock(mainBundleLocStringsMutex());
+        mainBundleLocStrings().set(key, value);
         return;
     }
 
-    frameworkLocStrings.set(key, value);
+    MutexLocker lock(frameworkLocStringsMutex());
+    frameworkLocStrings().set(key, value);
 }
 
 static const LocalizedString& localizedString(WebLocalizableStringsBundle* stringsBundle, const String& key)
diff --git a/WebKit/win/WebNavigationData.cpp b/WebKit/win/WebNavigationData.cpp
new file mode 100644
index 0000000..1ae3fe5
--- /dev/null
+++ b/WebKit/win/WebNavigationData.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitDLL.h"
+#include "WebNavigationData.h"
+
+#include <WebCore/BString.h>
+using WebCore::BString;
+
+// IUnknown -------------------------------------------------------------------
+
+HRESULT STDMETHODCALLTYPE WebNavigationData::QueryInterface(REFIID riid, void** ppvObject)
+{
+    *ppvObject = 0;
+    if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IWebNavigationData*>(this);
+    else if (IsEqualGUID(riid, IID_IWebNavigationData))
+        *ppvObject = static_cast<IWebNavigationData*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+ULONG STDMETHODCALLTYPE WebNavigationData::AddRef(void)
+{
+    return ++m_refCount;
+}
+
+ULONG STDMETHODCALLTYPE WebNavigationData::Release(void)
+{
+    ULONG newRef = --m_refCount;
+    if (!newRef)
+        delete(this);
+
+    return newRef;
+}
+
+// WebNavigationData -------------------------------------------------------------------
+
+WebNavigationData::WebNavigationData(BSTR url, BSTR title, IWebURLRequest* request, IWebURLResponse* response, bool hasSubstituteData, BSTR clientRedirectSource)
+    : m_refCount(0)
+    , m_request(request)
+    , m_response(response)
+    , m_hasSubstituteData(hasSubstituteData)
+
+{
+    gClassCount++;
+    gClassNameCount.add("WebNavigationData");
+
+    m_url.adoptBSTR(url);
+    m_title.adoptBSTR(title);
+    m_clientRedirectSource.adoptBSTR(clientRedirectSource);
+}
+
+WebNavigationData::~WebNavigationData()
+{
+    gClassCount--;
+    gClassNameCount.remove("WebNavigationData");
+}
+
+WebNavigationData* WebNavigationData::createInstance(BSTR url, BSTR title, IWebURLRequest* request, IWebURLResponse* response, bool hasSubstituteData, BSTR clientRedirectSource)
+{
+    WebNavigationData* instance = new WebNavigationData(url, title, request, response, hasSubstituteData, clientRedirectSource);
+    instance->AddRef();
+    return instance;
+}
+
+// IWebNavigationData -------------------------------------------------------------------
+
+HRESULT WebNavigationData::url(BSTR* url)
+{
+    if (!url)
+        return E_POINTER;
+    *url = BString(m_url).release();
+    return S_OK;
+}
+
+HRESULT WebNavigationData::title(BSTR* title)
+{
+    if (!title)
+        return E_POINTER;
+    *title = BString(m_title).release();
+    return S_OK;
+}
+
+HRESULT WebNavigationData::originalRequest(IWebURLRequest** request)
+{
+    if (!request)
+        return E_POINTER;
+    *request = m_request.get();
+    m_request->AddRef();
+    return S_OK;
+}
+
+HRESULT WebNavigationData::response(IWebURLResponse** response)
+{
+    if (!response)
+        return E_POINTER;
+    *response = m_response.get();
+    m_response->AddRef();
+    return S_OK;
+}
+
+HRESULT WebNavigationData::hasSubstituteData(BOOL* hasSubstituteData)
+{
+    if (!hasSubstituteData)
+        return E_POINTER;
+    *hasSubstituteData = m_hasSubstituteData;
+    return S_OK;
+}
+
+HRESULT WebNavigationData::clientRedirectSource(BSTR* clientRedirectSource)
+{
+    if (!clientRedirectSource)
+        return E_POINTER;
+
+    *clientRedirectSource = BString(m_clientRedirectSource).release();
+    return S_OK;
+}
diff --git a/WebKit/win/WebNavigationData.h b/WebKit/win/WebNavigationData.h
new file mode 100644
index 0000000..0443fd7
--- /dev/null
+++ b/WebKit/win/WebNavigationData.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebNavigationData_h
+#define WebNavigationData_h
+
+#include "WebKit.h"
+
+#include "COMPtr.h"
+#include <WebCore/BString.h>
+
+class WebNavigationData : public IWebNavigationData {
+public:
+    static WebNavigationData* createInstance(BSTR, BSTR, IWebURLRequest*, IWebURLResponse*, bool, BSTR);
+private:
+    WebNavigationData(BSTR url, BSTR title, IWebURLRequest*, IWebURLResponse*, bool hasSubstituteData, BSTR clientRedirectSource);
+    ~WebNavigationData();
+
+public:
+    // IUnknown
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
+    virtual ULONG STDMETHODCALLTYPE AddRef(void);
+    virtual ULONG STDMETHODCALLTYPE Release(void);
+
+    // IWebNavigationData
+    virtual HRESULT STDMETHODCALLTYPE url(
+        /* [retval][out] */ BSTR*);
+
+    virtual HRESULT STDMETHODCALLTYPE title(
+        /* [retval][out] */ BSTR*);
+
+    virtual HRESULT STDMETHODCALLTYPE originalRequest(
+        /* [retval][out] */ IWebURLRequest**);
+
+    virtual HRESULT STDMETHODCALLTYPE response(
+        /* [retval][out] */ IWebURLResponse**);
+
+    virtual HRESULT STDMETHODCALLTYPE hasSubstituteData(
+        /* [retval][out] */ BOOL*);
+
+    virtual HRESULT STDMETHODCALLTYPE clientRedirectSource(
+        /* [retval][out] */ BSTR*);
+
+private:
+    ULONG m_refCount;
+    WebCore::BString m_url;
+    WebCore::BString m_title;
+    COMPtr<IWebURLRequest> m_request;
+    COMPtr<IWebURLResponse> m_response;
+    bool m_hasSubstituteData;
+    WebCore::BString m_clientRedirectSource;
+
+};
+
+#endif // WebNavigationData_h
diff --git a/WebKit/win/WebPreferenceKeysPrivate.h b/WebKit/win/WebPreferenceKeysPrivate.h
index e0c2b6f..09aeaff 100644
--- a/WebKit/win/WebPreferenceKeysPrivate.h
+++ b/WebKit/win/WebPreferenceKeysPrivate.h
@@ -54,7 +54,6 @@
 #define WebKitDatabasesEnabledPreferenceKey "WebKitDatabasesEnabled"
 #define WebKitLocalStorageEnabledPreferenceKey "WebKitLocalStorageEnabled"
 #define WebKitExperimentalNotificationsEnabledPreferenceKey "WebKitExperimentalNotificationsEnabled"
-#define WebKitExperimentalWebSocketsEnabledPreferenceKey "WebKitExperimentalWebSocketsEnabled"
 #define WebKitAllowAnimatedImagesPreferenceKey "WebKitAllowAnimatedImagesPreferenceKey"
 #define WebKitAllowAnimatedImageLoopingPreferenceKey "WebKitAllowAnimatedImageLoopingPreferenceKey"
 #define WebKitDisplayImagesKey "WebKitDisplayImagesKey"
@@ -129,6 +128,4 @@
 
 #define WebKitUseHighResolutionTimersPreferenceKey "WebKitUseHighResolutionTimers"
 
-#define WebKitPluginHalterEnabledPreferenceKey "WebKitPluginHalterEnabled"
-
 #define WebKitPluginAllowedRunTimePreferenceKey "WebKitPluginAllowedRunTime"
diff --git a/WebKit/win/WebPreferences.cpp b/WebKit/win/WebPreferences.cpp
index e37177e..652e619 100644
--- a/WebKit/win/WebPreferences.cpp
+++ b/WebKit/win/WebPreferences.cpp
@@ -213,7 +213,6 @@ void WebPreferences::initializeDefaultSettings()
     CFDictionaryAddValue(defaults, CFSTR(WebKitDatabasesEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitLocalStorageEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitExperimentalNotificationsEnabledPreferenceKey), kCFBooleanFalse);
-    CFDictionaryAddValue(defaults, CFSTR(WebKitExperimentalWebSocketsEnabledPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitAllowAnimatedImagesPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitAllowAnimatedImageLoopingPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitDisplayImagesKey), kCFBooleanTrue);
@@ -253,8 +252,6 @@ void WebPreferences::initializeDefaultSettings()
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitUseHighResolutionTimersPreferenceKey), kCFBooleanTrue);
 
-    CFDictionaryAddValue(defaults, CFSTR(WebKitPluginHalterEnabledPreferenceKey), kCFBooleanFalse);
-
     RetainPtr<CFStringRef> pluginAllowedRunTime(AdoptCF, CFStringCreateWithFormat(0, 0, CFSTR("%u"), numeric_limits<unsigned>::max()));
     CFDictionaryAddValue(defaults, CFSTR(WebKitPluginAllowedRunTimePreferenceKey), pluginAllowedRunTime.get());
 
@@ -1312,18 +1309,6 @@ HRESULT STDMETHODCALLTYPE WebPreferences::experimentalNotificationsEnabled(BOOL*
     return S_OK;
 }
 
-HRESULT STDMETHODCALLTYPE WebPreferences::setExperimentalWebSocketsEnabled(BOOL enabled)
-{
-    setBoolValue(CFSTR(WebKitExperimentalWebSocketsEnabledPreferenceKey), enabled);
-    return S_OK;
-}
-
-HRESULT STDMETHODCALLTYPE WebPreferences::experimentalWebSocketsEnabled(BOOL* enabled)
-{
-    *enabled = boolValueForKey(CFSTR(WebKitExperimentalWebSocketsEnabledPreferenceKey));
-    return S_OK;
-}
-
 HRESULT WebPreferences::setZoomsTextOnly(BOOL zoomsTextOnly)
 {
     setBoolValue(CFSTR(WebKitZoomsTextOnlyPreferenceKey), zoomsTextOnly);
@@ -1348,19 +1333,6 @@ HRESULT STDMETHODCALLTYPE WebPreferences::shouldUseHighResolutionTimers(BOOL* us
     return S_OK;
 }
 
-
-HRESULT STDMETHODCALLTYPE WebPreferences::setPluginHalterEnabled(BOOL enabled)
-{
-    setBoolValue(CFSTR(WebKitPluginHalterEnabledPreferenceKey), enabled);
-    return S_OK;
-}
-
-HRESULT STDMETHODCALLTYPE WebPreferences::pluginHalterEnabled(BOOL* enabled)
-{
-    *enabled = boolValueForKey(CFSTR(WebKitPluginHalterEnabledPreferenceKey));
-    return S_OK;
-}
-
 HRESULT WebPreferences::setPluginAllowedRunTime(UINT allowedRunTime)
 {
     setIntegerValue(CFSTR(WebKitPluginAllowedRunTimePreferenceKey), allowedRunTime);
diff --git a/WebKit/win/WebPreferences.h b/WebKit/win/WebPreferences.h
index 14035d0..2a89269 100644
--- a/WebKit/win/WebPreferences.h
+++ b/WebKit/win/WebPreferences.h
@@ -332,12 +332,6 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setExperimentalNotificationsEnabled(
         /* [in] */ BOOL enabled);
 
-    virtual HRESULT STDMETHODCALLTYPE experimentalWebSocketsEnabled(
-        /* [retval][out] */ BOOL *enabled);
-
-    virtual HRESULT STDMETHODCALLTYPE setExperimentalWebSocketsEnabled(
-        /* [in] */ BOOL enabled);
-
     virtual HRESULT STDMETHODCALLTYPE setShouldPaintNativeControls( 
     /* [in] */ BOOL shouldPaint);
 
@@ -380,12 +374,6 @@ public:
     virtual HRESULT STDMETHODCALLTYPE shouldUseHighResolutionTimers(
     /* [retval][out] */ BOOL* useHighResolutionTimers);
 
-    virtual HRESULT STDMETHODCALLTYPE setPluginHalterEnabled(
-    /* [in] */ BOOL enabled);
-
-    virtual HRESULT STDMETHODCALLTYPE pluginHalterEnabled(
-    /* [retval][out] */ BOOL* enabled);
-
     virtual HRESULT STDMETHODCALLTYPE setPluginAllowedRunTime(
     /* [in] */ UINT allowedRunTime);
 
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index 85b2ac2..e2f3fae 100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -100,6 +100,7 @@
 #include <WebCore/ProgressTracker.h>
 #include <WebCore/RenderTheme.h>
 #include <WebCore/RenderView.h>
+#include <WebCore/RenderWidget.h>
 #include <WebCore/ResourceHandle.h>
 #include <WebCore/ResourceHandleClient.h>
 #include <WebCore/ScriptValue.h>
@@ -639,6 +640,7 @@ HRESULT STDMETHODCALLTYPE WebView::close()
     setEditingDelegate(0);
     setFrameLoadDelegate(0);
     setFrameLoadDelegatePrivate(0);
+    setHistoryDelegate(0);
     setPolicyDelegate(0);
     setResourceLoadDelegate(0);
     setUIDelegate(0);
@@ -1983,6 +1985,10 @@ static LRESULT CALLBACK WebViewWndProc(HWND hWnd, UINT message, WPARAM wParam, L
             // Send blur events unless we're losing focus to a child of ours.
             if (!IsChild(hWnd, newFocusWnd))
                 focusController->setFocused(false);
+
+            // If we are pan-scrolling when we lose focus, stop the pan scrolling.
+            frame->eventHandler()->stopAutoscrollTimer();
+
             break;
         }
         case WM_WINDOWPOSCHANGED:
@@ -2865,7 +2871,7 @@ HRESULT STDMETHODCALLTYPE WebView::stringByEvaluatingJavaScriptFromString(
     if (!coreFrame)
         return E_FAIL;
 
-    JSC::JSValue scriptExecutionResult = coreFrame->loader()->executeScript(WebCore::String(script), true).jsValue();
+    JSC::JSValue scriptExecutionResult = coreFrame->script()->executeScript(WebCore::String(script), true).jsValue();
     if (!scriptExecutionResult)
         return E_FAIL;
     else if (scriptExecutionResult.isString()) {
@@ -3360,10 +3366,34 @@ HRESULT STDMETHODCALLTYPE WebView::setMainFrameURL(
 }
     
 HRESULT STDMETHODCALLTYPE WebView::mainFrameURL( 
-        /* [retval][out] */ BSTR* /*urlString*/)
+        /* [retval][out] */ BSTR* urlString)
 {
-    ASSERT_NOT_REACHED();
-    return E_NOTIMPL;
+    if (!urlString)
+        return E_POINTER;
+
+    if (!m_mainFrame)
+        return E_FAIL;
+
+    COMPtr<IWebDataSource> dataSource;
+
+    if (FAILED(m_mainFrame->provisionalDataSource(&dataSource))) {
+        if (FAILED(m_mainFrame->dataSource(&dataSource)))
+            return E_FAIL;
+    }
+
+    if (!dataSource) {
+        *urlString = 0;
+        return S_OK;
+    }
+    
+    COMPtr<IWebMutableURLRequest> request;
+    if (FAILED(dataSource->request(&request)) || !request)
+        return E_FAIL;
+
+    if (FAILED(request->URL(urlString)))
+        return E_FAIL;
+
+    return S_OK;
 }
     
 HRESULT STDMETHODCALLTYPE WebView::mainFrameDocument( 
@@ -4409,11 +4439,6 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setExperimentalNotificationsEnabled(enabled);
 
-    hr = prefsPrivate->experimentalWebSocketsEnabled(&enabled);
-    if (FAILED(hr))
-        return hr;
-    settings->setExperimentalWebSocketsEnabled(enabled);
-
     hr = prefsPrivate->isWebSecurityEnabled(&enabled);
     if (FAILED(hr))
         return hr;
@@ -4441,11 +4466,6 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setShouldUseHighResolutionTimers(enabled);
 
-    hr = prefsPrivate->pluginHalterEnabled(&enabled);
-    if (FAILED(hr))
-        return hr;
-    settings->setPluginHalterEnabled(enabled);
-
     UINT runTime;
     hr = prefsPrivate->pluginAllowedRunTime(&runTime);
     if (FAILED(hr))
@@ -4624,11 +4644,25 @@ static DWORD dragOperationToDragCursor(DragOperation op) {
     return res;
 }
 
-static DragOperation keyStateToDragOperation(DWORD) {
-    //FIXME: This is currently very simple, it may need to actually
-    //work out an appropriate DragOperation in future -- however this
-    //behaviour appears to match FireFox
-    return (DragOperation)(DragOperationCopy | DragOperationLink);
+DragOperation WebView::keyStateToDragOperation(DWORD grfKeyState) const
+{
+    if (!m_page)
+        return DragOperationNone;
+
+    // Conforms to Microsoft's key combinations as documented for 
+    // IDropTarget::DragOver. Note, grfKeyState is the current 
+    // state of the keyboard modifier keys on the keyboard. See:
+    // <http://msdn.microsoft.com/en-us/library/ms680129(VS.85).aspx>.
+    DragOperation operation = m_page->dragController()->sourceDragOperation();
+
+    if ((grfKeyState & (MK_CONTROL | MK_SHIFT)) == (MK_CONTROL | MK_SHIFT))
+        operation = DragOperationLink;
+    else if ((grfKeyState & MK_CONTROL) == MK_CONTROL)
+        operation = DragOperationCopy;
+    else if ((grfKeyState & MK_SHIFT) == MK_SHIFT)
+        operation = DragOperationGeneric;
+
+    return operation;
 }
 
 HRESULT STDMETHODCALLTYPE WebView::DragEnter(
@@ -4645,6 +4679,7 @@ HRESULT STDMETHODCALLTYPE WebView::DragEnter(
         IntPoint(pt.x, pt.y), keyStateToDragOperation(grfKeyState));
     *pdwEffect = dragOperationToDragCursor(m_page->dragController()->dragEntered(&data));
 
+    m_lastDropEffect = *pdwEffect;
     m_dragData = pDataObject;
 
     return S_OK;
@@ -4665,6 +4700,7 @@ HRESULT STDMETHODCALLTYPE WebView::DragOver(
     } else
         *pdwEffect = DROPEFFECT_NONE;
 
+    m_lastDropEffect = *pdwEffect;
     return S_OK;
 }
 
@@ -4689,7 +4725,7 @@ HRESULT STDMETHODCALLTYPE WebView::Drop(
         m_dropTargetHelper->Drop(pDataObject, (POINT*)&pt, *pdwEffect);
 
     m_dragData = 0;
-    *pdwEffect = DROPEFFECT_NONE;
+    *pdwEffect = m_lastDropEffect;
     POINTL localpt = pt;
     ::ScreenToClient(m_viewWindow, (LPPOINT)&localpt);
     DragData data(pDataObject, IntPoint(localpt.x, localpt.y), 
@@ -4815,7 +4851,7 @@ HRESULT STDMETHODCALLTYPE WebView::loadBackForwardListFromOtherView(
             // If this item is showing , save away its current scroll and form state,
             // since that might have changed since loading and it is normally not saved
             // until we leave that page.
-            otherWebView->m_page->mainFrame()->loader()->saveDocumentAndScrollState();
+            otherWebView->m_page->mainFrame()->loader()->history()->saveDocumentAndScrollState();
         }
         RefPtr<HistoryItem> newItem = otherBackForwardList->itemAtIndex(i)->copy();
         if (!i) 
@@ -5458,9 +5494,9 @@ HRESULT WebView::addUserScriptToGroup(BSTR groupName, unsigned worldID, BSTR sou
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->addUserScript(String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
-                             toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist), worldID,
-                             injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
+    pageGroup->addUserScriptToWorld(worldID, String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
+                                    toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist),
+                                    injectionTime == WebInjectAtDocumentStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
 
     return S_OK;
 }
@@ -5478,13 +5514,13 @@ HRESULT WebView::addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->addUserStyleSheet(String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
-                                 toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist), worldID);
+    pageGroup->addUserStyleSheetToWorld(worldID, String(source, SysStringLen(source)), KURL(KURL(), String(url, SysStringLen(url))),
+                                        toStringVector(whitelistCount, whitelist), toStringVector(blacklistCount, blacklist));
 
     return S_OK;
 }
 
-HRESULT WebView::removeUserContentWithURLFromGroup(BSTR groupName, unsigned worldID, BSTR url)
+HRESULT WebView::removeUserScriptFromGroup(BSTR groupName, unsigned worldID, BSTR url)
 {
     String group(groupName, SysStringLen(groupName));
     if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
@@ -5495,12 +5531,43 @@ HRESULT WebView::removeUserContentWithURLFromGroup(BSTR groupName, unsigned worl
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->removeUserContentWithURLForWorld(KURL(KURL(), String(url, SysStringLen(url))), worldID);
+    pageGroup->removeUserScriptFromWorld(worldID, KURL(KURL(), String(url, SysStringLen(url))));
+
+    return S_OK;
+}
+
+HRESULT WebView::removeUserStyleSheetFromGroup(BSTR groupName, unsigned worldID, BSTR url)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
+
+    pageGroup->removeUserStyleSheetFromWorld(worldID, KURL(KURL(), String(url, SysStringLen(url))));
+
+    return S_OK;
+}
+
+HRESULT WebView::removeUserScriptsFromGroup(BSTR groupName, unsigned worldID)
+{
+    String group(groupName, SysStringLen(groupName));
+    if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
+        return E_INVALIDARG;
+
+    PageGroup* pageGroup = PageGroup::pageGroup(group);
+    ASSERT(pageGroup);
+    if (!pageGroup)
+        return E_FAIL;
 
+    pageGroup->removeUserScriptsFromWorld(worldID);
     return S_OK;
 }
 
-HRESULT WebView::removeUserContentFromGroup(BSTR groupName, unsigned worldID)
+HRESULT WebView::removeUserStyleSheetsFromGroup(BSTR groupName, unsigned worldID)
 {
     String group(groupName, SysStringLen(groupName));
     if (group.isEmpty() || !worldID || worldID == numeric_limits<unsigned>::max())
@@ -5511,7 +5578,7 @@ HRESULT WebView::removeUserContentFromGroup(BSTR groupName, unsigned worldID)
     if (!pageGroup)
         return E_FAIL;
 
-    pageGroup->removeUserContentForWorld(worldID);
+    pageGroup->removeUserStyleSheetsFromWorld(worldID);
     return S_OK;
 }
 
@@ -5560,6 +5627,33 @@ HRESULT WebView::resetOriginAccessWhiteLists()
     SecurityOrigin::resetOriginAccessWhiteLists();
     return S_OK;
 }
+ 
+HRESULT WebView::setHistoryDelegate(IWebHistoryDelegate* historyDelegate)
+{
+    m_historyDelegate = historyDelegate;
+    return S_OK;
+}
+
+HRESULT WebView::historyDelegate(IWebHistoryDelegate** historyDelegate)
+{
+    if (!historyDelegate)
+        return E_POINTER;
+
+    return m_historyDelegate.copyRefTo(historyDelegate);
+}
+
+HRESULT WebView::addVisitedLinks(BSTR* visitedURLs, unsigned visitedURLCount)
+{
+    PageGroup& group = core(this)->group();
+    
+    for (unsigned i = 0; i < visitedURLCount; ++i) {
+        BSTR url = visitedURLs[i];
+        unsigned length = SysStringLen(url);
+        group.addVisitedLink(url, length);
+    }
+
+    return S_OK;
+}
 
 void WebView::downloadURL(const KURL& url)
 {
@@ -5587,6 +5681,70 @@ HRESULT STDMETHODCALLTYPE WebView::pluginHalterDelegate(IWebPluginHalterDelegate
     return m_pluginHalterDelegate.copyRefTo(d);
 }
 
+static PluginView* pluginViewForNode(IDOMNode* domNode)
+{
+    COMPtr<DOMNode> webKitDOMNode(Query, domNode);
+    if (!webKitDOMNode)
+        return 0;
+
+    Node* node = webKitDOMNode->node();
+    if (!node)
+        return 0;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer || !renderer->isWidget())
+        return 0;
+
+    Widget* widget = toRenderWidget(renderer)->widget();
+    if (!widget || !widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget);
+}
+
+HRESULT WebView::isNodeHaltedPlugin(IDOMNode* domNode, BOOL* result)
+{
+    if (!domNode || !result)
+        return E_POINTER;
+
+    *result = FALSE;
+
+    PluginView* view = pluginViewForNode(domNode);
+    if (!view)
+        return E_FAIL;
+
+    *result = view->isHalted();
+    return S_OK;
+}
+
+HRESULT WebView::restartHaltedPluginForNode(IDOMNode* domNode)
+{
+    if (!domNode)
+        return E_POINTER;
+
+    PluginView* view = pluginViewForNode(domNode);
+    if (!view)
+        return E_FAIL;
+
+    view->restart();
+    return S_OK;
+}
+
+HRESULT WebView::hasPluginForNodeBeenHalted(IDOMNode* domNode, BOOL* result)
+{
+    if (!domNode || !result)
+        return E_POINTER;
+
+    *result = FALSE;
+
+    PluginView* view = pluginViewForNode(domNode);
+    if (!view)
+        return E_FAIL;
+
+    *result = view->hasBeenHalted();
+    return S_OK;
+}
+
 class EnumTextMatches : public IEnumTextMatches
 {
     long m_ref;
diff --git a/WebKit/win/WebView.h b/WebKit/win/WebView.h
index 3f20c69..b4c1239 100644
--- a/WebKit/win/WebView.h
+++ b/WebKit/win/WebView.h
@@ -11,7 +11,7 @@
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * EXPRESS OR IMPLIED WARRANTIES, INCfLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
@@ -747,8 +747,10 @@ public:
     virtual HRESULT STDMETHODCALLTYPE addUserStyleSheetToGroup(BSTR groupName, unsigned worldID, BSTR source, BSTR url,
                                                                unsigned whitelistCount, BSTR* whitelist, 
                                                                unsigned blacklistCount, BSTR* blacklist);
-    virtual HRESULT STDMETHODCALLTYPE removeUserContentWithURLFromGroup(BSTR groupName, unsigned worldID, BSTR url);
-    virtual HRESULT STDMETHODCALLTYPE removeUserContentFromGroup(BSTR groupName, unsigned worldID);
+    virtual HRESULT STDMETHODCALLTYPE removeUserScriptFromGroup(BSTR groupName, unsigned worldID, BSTR url);
+    virtual HRESULT STDMETHODCALLTYPE removeUserStyleSheetFromGroup(BSTR groupName, unsigned worldID, BSTR url);
+    virtual HRESULT STDMETHODCALLTYPE removeUserScriptsFromGroup(BSTR groupName, unsigned worldID);
+    virtual HRESULT STDMETHODCALLTYPE removeUserStyleSheetsFromGroup(BSTR groupName, unsigned worldID);
     virtual HRESULT STDMETHODCALLTYPE removeAllUserContentFromGroup(BSTR groupName);
 
     virtual HRESULT STDMETHODCALLTYPE setPluginHalterDelegate(IWebPluginHalterDelegate*);
@@ -759,6 +761,15 @@ public:
     virtual HRESULT STDMETHODCALLTYPE whiteListAccessFromOrigin(BSTR sourceOrigin, BSTR destinationProtocol, BSTR destinationHost, BOOL allowDestinationSubdomains);
     virtual HRESULT STDMETHODCALLTYPE resetOriginAccessWhiteLists();
 
+
+    virtual HRESULT STDMETHODCALLTYPE setHistoryDelegate(IWebHistoryDelegate* historyDelegate);
+    virtual HRESULT STDMETHODCALLTYPE historyDelegate(IWebHistoryDelegate** historyDelegate);
+    virtual HRESULT STDMETHODCALLTYPE addVisitedLinks(BSTR* visitedURLs, unsigned visitedURLCount);
+
+    virtual HRESULT STDMETHODCALLTYPE isNodeHaltedPlugin(IDOMNode*, BOOL*);
+    virtual HRESULT STDMETHODCALLTYPE restartHaltedPluginForNode(IDOMNode*);
+    virtual HRESULT STDMETHODCALLTYPE hasPluginForNodeBeenHalted(IDOMNode*, BOOL*);
+
     // WebView
     bool shouldUseEmbeddedView(const WebCore::String& mimeType) const;
 
@@ -865,6 +876,14 @@ private:
     void paintIntoBackingStore(WebCore::FrameView*, HDC bitmapDC, const WebCore::IntRect& dirtyRect, WindowsToPaint);
     void updateBackingStore(WebCore::FrameView*, HDC = 0, bool backingStoreCompletelyDirty = false, WindowsToPaint = PaintWebViewOnly);
 
+    WebCore::DragOperation keyStateToDragOperation(DWORD grfKeyState) const;
+
+    // FIXME: This variable is part of a workaround. The drop effect (pdwEffect) passed to Drop is incorrect. 
+    // We set this variable in DragEnter and DragOver so that it can be used in Drop to set the correct drop effect. 
+    // Thus, on return from DoDragDrop we have the correct pdwEffect for the drag-and-drop operation.
+    // (see https://bugs.webkit.org/show_bug.cgi?id=29264)
+    DWORD m_lastDropEffect;
+
 protected:
     HIMC getIMMContext();
     void releaseIMMContext(HIMC);
@@ -904,6 +923,7 @@ protected:
     COMPtr<IWebPolicyDelegate> m_policyDelegate;
     COMPtr<IWebResourceLoadDelegate> m_resourceLoadDelegate;
     COMPtr<IWebDownloadDelegate> m_downloadDelegate;
+    COMPtr<IWebHistoryDelegate> m_historyDelegate;
     COMPtr<WebPreferences> m_preferences;
     COMPtr<WebInspector> m_webInspector;
     COMPtr<IWebPluginHalterDelegate> m_pluginHalterDelegate;
diff --git a/WebKit/wx/ChangeLog b/WebKit/wx/ChangeLog
index 76f4533..f2cc27f 100644
--- a/WebKit/wx/ChangeLog
+++ b/WebKit/wx/ChangeLog
@@ -1,3 +1,92 @@
+2009-10-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Update the globalObject calls after changes.
+
+        * WebFrame.cpp:
+        (wxWebFrame::RunScript):
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+        (WebCore::FrameLoaderClientWx::windowObjectCleared):
+
+2009-10-21  Pedro Romano  <pmcnr72@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Include 'WebFrame.h' declared classes in wxPython bindings.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30504
+
+        * bindings/python/webview.i:
+
+2009-10-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add the ability to specify a proxy for wxWebKit.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30446
+
+        * WebView.cpp:
+        (curlProxyType):
+        (wxWebView::SetProxyInfo):
+        * WebView.h:
+
+2009-10-18  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add basic database support to wx API
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30445
+
+        * WebKitSupport/ChromeClientWx.cpp:
+        (WebCore::ChromeClientWx::exceededDatabaseQuota):
+        * WebView.cpp:
+        (wxWebView::Create):
+        (wxWebView::SetDatabaseDirectory):
+        (wxWebView::GetDatabaseDirectory):
+        * WebView.h:
+
+2009-10-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Optionally allow the user to zoom text using the mouse wheel.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30444
+
+        * WebView.cpp:
+        (wxWebView::wxWebView):
+        (wxWebView::OnMouseEvents):
+        * WebView.h:
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW non-precomp headers build fix.
+
+        * WebView.cpp:
+
+2009-10-15  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Update the wxPython simple.py sample to match current wxWebKit API.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30406
+
+        * bindings/python/samples/simple.py:
+
+2009-10-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move executeScript from FrameLoader to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=30200
+
+        Update API call.
+
+        * WebFrame.cpp:
+        (wxWebFrame::RunScript):
+
 2009-10-07  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/WebKit/wx/WebFrame.cpp b/WebKit/wx/WebFrame.cpp
index f205152..9018d37 100644
--- a/WebKit/wx/WebFrame.cpp
+++ b/WebKit/wx/WebFrame.cpp
@@ -188,9 +188,9 @@ wxString wxWebFrame::RunScript(const wxString& javascript)
 {
     wxString returnValue = wxEmptyString;
     if (m_impl->frame) {
-        JSC::JSValue result = m_impl->frame->loader()->executeScript(javascript, true).jsValue();
+        JSC::JSValue result = m_impl->frame->script()->executeScript(javascript, true).jsValue();
         if (result)
-            returnValue = wxString(result.toString(m_impl->frame->script()->globalObject()->globalExec()).UTF8String().c_str(), wxConvUTF8);        
+            returnValue = wxString(result.toString(m_impl->frame->script()->globalObject(WebCore::mainThreadNormalWorld())->globalExec()).UTF8String().c_str(), wxConvUTF8);        
     }
     return returnValue;
 }
diff --git a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
index 9b2f264..629463f 100644
--- a/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/ChromeClientWx.cpp
@@ -28,8 +28,12 @@
 #include "config.h"
 #include "ChromeClientWx.h"
 #include "Console.h"
+#if ENABLE(DATABASE)
+#include "DatabaseTracker.h"
+#endif
 #include "FileChooser.h"
 #include "FloatRect.h"
+#include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
@@ -381,7 +385,13 @@ void ChromeClientWx::print(Frame*)
 #if ENABLE(DATABASE)
 void ChromeClientWx::exceededDatabaseQuota(Frame*, const String&)
 {
-    notImplemented();
+    unsigned long long quota = 5 * 1024 * 1024;
+
+    if (wxWebFrame* webFrame = m_webView->GetMainFrame())
+        if (Frame* frame = webFrame->GetFrame())
+            if (Document* document = frame->document())
+                if (!DatabaseTracker::tracker().hasEntryForOrigin(document->securityOrigin()))
+                    DatabaseTracker::tracker().setQuota(document->securityOrigin(), quota);
 }
 #endif
 
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index 0a5eeaf..9d12ca7 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -836,8 +836,8 @@ void FrameLoaderClientWx::windowObjectCleared()
     if (m_webView) {
         wxWebViewWindowObjectClearedEvent wkEvent(m_webView);
         Frame* coreFrame = m_webView->GetMainFrame()->GetFrame();
-        JSGlobalContextRef context = toGlobalRef(coreFrame->script()->globalObject()->globalExec());
-        JSObjectRef windowObject = toRef(coreFrame->script()->globalObject());
+        JSGlobalContextRef context = toGlobalRef(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
+        JSObjectRef windowObject = toRef(coreFrame->script()->globalObject(mainThreadNormalWorld()));
         wkEvent.SetJSContext(context);
         wkEvent.SetWindowObject(windowObject);
         m_webView->GetEventHandler()->ProcessEvent(wkEvent);
diff --git a/WebKit/wx/WebView.cpp b/WebKit/wx/WebView.cpp
index 88b5990..1b27cde 100644
--- a/WebKit/wx/WebView.cpp
+++ b/WebKit/wx/WebView.cpp
@@ -39,6 +39,7 @@
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HTMLFormElement.h"
 #include "Logging.h"
 #include "markup.h"
 #include "Page.h"
@@ -49,6 +50,7 @@
 #include "PluginHalterClient.h"
 #include "RenderObject.h"
 #include "RenderView.h"
+#include "ResourceHandleManager.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
@@ -67,6 +69,10 @@
 #include <runtime/JSValue.h>
 #include <runtime/UString.h>
 
+#if ENABLE(DATABASE)
+#include "DatabaseTracker.h"
+#endif
+
 #include "wx/wxprec.h"
 #ifndef WX_PRECOMP
     #include "wx/wx.h"
@@ -268,6 +274,7 @@ wxWebView::wxWebView() :
     m_isEditable(false),
     m_isInitialized(false),
     m_beingDestroyed(false),
+    m_mouseWheelZooms(false),
     m_title(wxEmptyString)
 {
 }
@@ -278,6 +285,7 @@ wxWebView::wxWebView(wxWindow* parent, int id, const wxPoint& position,
     m_isEditable(false),
     m_isInitialized(false),
     m_beingDestroyed(false),
+    m_mouseWheelZooms(false),
     m_title(wxEmptyString)
 {
     Create(parent, id, position, size, style, name);
@@ -327,6 +335,10 @@ bool wxWebView::Create(wxWindow* parent, int id, const wxPoint& position,
     settings->setStandardFontFamily("Times New Roman");
     settings->setJavaScriptEnabled(true);
 
+#if ENABLE(DATABASE)
+    settings->setDatabasesEnabled(true);
+#endif
+
     m_isInitialized = true;
 
     return true;
@@ -591,8 +603,16 @@ void wxWebView::OnMouseEvents(wxMouseEvent& event)
     wxEventType type = event.GetEventType();
     
     if (type == wxEVT_MOUSEWHEEL) {
-        WebCore::PlatformWheelEvent wkEvent(event, globalPoint);
-        frame->eventHandler()->handleWheelEvent(wkEvent);
+        if (m_mouseWheelZooms && event.ControlDown() && !event.AltDown() && !event.ShiftDown()) {
+            if (event.GetWheelRotation() < 0)
+                DecreaseTextSize();
+            else if (event.GetWheelRotation() > 0)
+                IncreaseTextSize();
+        } else {
+            WebCore::PlatformWheelEvent wkEvent(event, globalPoint);
+            frame->eventHandler()->handleWheelEvent(wkEvent);
+        }
+
         return;
     }
     
@@ -887,3 +907,47 @@ bool wxWebView::ShouldClose() const
 
     return true;
 }
+
+/* static */
+void wxWebView::SetDatabaseDirectory(const wxString& databaseDirectory)
+{
+#if ENABLE(DATABASE)
+    WebCore::DatabaseTracker::tracker().setDatabaseDirectoryPath(databaseDirectory);
+#endif
+}
+
+/* static */
+wxString wxWebView::GetDatabaseDirectory()
+{
+#if ENABLE(DATABASE)
+    return WebCore::DatabaseTracker::tracker().databaseDirectoryPath();
+#else
+    return wxEmptyString;
+#endif
+}
+
+static WebCore::ResourceHandleManager::ProxyType curlProxyType(wxProxyType type)
+{
+    switch (type) {
+        case HTTP: return WebCore::ResourceHandleManager::HTTP;
+        case Socks4: return WebCore::ResourceHandleManager::Socks4;
+        case Socks4A: return WebCore::ResourceHandleManager::Socks4A;
+        case Socks5: return WebCore::ResourceHandleManager::Socks5;
+        case Socks5Hostname: return WebCore::ResourceHandleManager::Socks5Hostname;
+        default:
+            ASSERT_NOT_REACHED();
+            return WebCore::ResourceHandleManager::HTTP;
+    }
+}
+
+/* static */
+void wxWebView::SetProxyInfo(const wxString& host,
+                             unsigned long port,
+                             wxProxyType type,
+                             const wxString& username,
+                             const wxString& password)
+{
+    using WebCore::ResourceHandleManager;
+    if (ResourceHandleManager* mgr = ResourceHandleManager::sharedInstance())
+        mgr->setProxyInfo(host, port, curlProxyType(type), username, password);
+}
diff --git a/WebKit/wx/WebView.h b/WebKit/wx/WebView.h
index e83c420..9b1cfab 100644
--- a/WebKit/wx/WebView.h
+++ b/WebKit/wx/WebView.h
@@ -105,6 +105,14 @@ enum {
     WebKitErrorJavaUnavailable =                                202,
 };
 
+enum wxProxyType {
+    HTTP,
+    Socks4,
+    Socks4A,
+    Socks5,
+    Socks5Hostname
+};
+
 class WXDLLIMPEXP_WEBKIT wxWebView : public wxWindow
 {
     // ChromeClientWx needs to get the Page* stored by the wxWebView
@@ -194,6 +202,18 @@ public:
     static void SetCachePolicy(const wxWebViewCachePolicy& cachePolicy);
     static wxWebViewCachePolicy GetCachePolicy();
 
+    void SetMouseWheelZooms(bool mouseWheelZooms) { m_mouseWheelZooms = mouseWheelZooms; }
+    bool GetMouseWheelZooms() const { return m_mouseWheelZooms; }
+
+    static void SetDatabaseDirectory(const wxString& databaseDirectory);
+    static wxString GetDatabaseDirectory();
+
+    static void SetProxyInfo(const wxString& host = wxEmptyString,
+                             unsigned long port = 0,
+                             wxProxyType type = HTTP,
+                             const wxString& username = wxEmptyString,
+                             const wxString& password = wxEmptyString);
+
 protected:
 
     // event handlers (these functions should _not_ be virtual)
@@ -216,6 +236,7 @@ private:
     bool m_isEditable;
     bool m_isInitialized;
     bool m_beingDestroyed;
+    bool m_mouseWheelZooms;
     WebViewPrivate* m_impl;
     wxWebFrame* m_mainFrame;
     wxString m_title;
diff --git a/WebKit/wx/bindings/python/samples/simple.py b/WebKit/wx/bindings/python/samples/simple.py
index 52d4e1b..2756760 100644
--- a/WebKit/wx/bindings/python/samples/simple.py
+++ b/WebKit/wx/bindings/python/samples/simple.py
@@ -92,11 +92,11 @@ class TestPanel(wx.Panel):
     def OnStateChanged(self, event):
         statusbar = self.GetParent().GetStatusBar() 
         if statusbar:
-            if event.GetState() == wx.webview.WEBVIEW_STATE_NEGOTIATING:
+            if event.GetState() == wx.webview.WEBVIEW_LOAD_NEGOTIATING:
                 statusbar.SetStatusText("Contacting " + event.GetURL())
-            elif event.GetState() == wx.webview.WEBVIEW_STATE_TRANSFERRING:
+            elif event.GetState() == wx.webview.WEBVIEW_LOAD_TRANSFERRING:
                 statusbar.SetStatusText("Loading " + event.GetURL())
-            elif event.GetState() == wx.webview.WEBVIEW_STATE_STOP:
+            elif event.GetState() == wx.webview.WEBVIEW_LOAD_DOC_COMPLETED:
                 statusbar.SetStatusText("")
                 self.location.SetValue(event.GetURL())
                 self.GetParent().SetTitle("wxWebView - " + self.webview.GetPageTitle())
diff --git a/WebKit/wx/bindings/python/webview.i b/WebKit/wx/bindings/python/webview.i
index 44b38ab..410191a 100644
--- a/WebKit/wx/bindings/python/webview.i
+++ b/WebKit/wx/bindings/python/webview.i
@@ -28,6 +28,7 @@
 %{
 #include "wx/wxPython/wxPython.h"
 #include "wx/wxPython/pyclasses.h"
+#include "WebFrame.h"
 #include "WebView.h"
 #include "WebBrowserShell.h"
 %}
@@ -38,9 +39,11 @@
 
 MAKE_CONST_WXSTRING(WebViewNameStr);
 
+MustHaveApp(wxWebFrame);
 MustHaveApp(wxWebView);
 MustHaveApp(wxWebBrowserShell);
 
+%include WebFrame.h
 %include WebView.h
 %include WebBrowserShell.h
 
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index 6ad863d..50d4e19 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,51 @@
+2009-10-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up the regex madness in auto-version.sh to make it obvious what the script is doing.
+
+        Also teaches auto-version.sh to handle RC_PROJECTSOURCEVERSION that has more than three digits
+        in the major component of the version number.
+
+        * win/tools/scripts/auto-version.sh:
+
+2009-10-19  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        added cairo include and lib directories to debug_wincairo.vsprops
+        https://bugs.webkit.org/show_bug.cgi?id=29831
+
+        * win/tools/vsprops/debug_wincairo.vsprops:
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * win/tools/vsprops/debug_all.vsprops:
+        Define DEBUG_ALL in Debug_All configuration.
+        Continue to define USE_DEBUG_SAFARI_THEME for open source SafariTheme header usage.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * win/tools/vsprops/debug_all.vsprops: Added.
+        Use debug C runtime library in debug_all.
+        Specify USE_DEBUG_SAFARI_THEME to get "_debug" suffix for debug_all.
+        * win/tools/vsprops/debug_internal.vsprops:
+        Don't specify debug C runtime library in debug_internal.
+        Don't specify _debug suffix for standard debug_internal builds.
+
 2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
 
         Reviewed by Simon Fraser
diff --git a/WebKitLibraries/win/tools/scripts/auto-version.sh b/WebKitLibraries/win/tools/scripts/auto-version.sh
index 2e9a9ed..a67184f 100755
--- a/WebKitLibraries/win/tools/scripts/auto-version.sh
+++ b/WebKitLibraries/win/tools/scripts/auto-version.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/bash
 
-# Copyright (C) 2007 Apple Inc.  All rights reserved.
+# Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -23,60 +23,80 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-SRCPATH=`cygpath -u "$WEBKITLIBRARIESDIR\Tools\Scripts"`
-VERSIONPATH=`cygpath -u "$1"`
-VERSIONPATH=$VERSIONPATH/include
-VERSIONFILE=$VERSIONPATH/autoversion.h
-mkdir -p "$VERSIONPATH"
 
-if [ "$RC_PROJECTSOURCEVERSION" == "" ]; then
-    PROPOSEDVERSION=`cat $SRCPATH/VERSION`
-else
-    PROPOSEDVERSION="$RC_PROJECTSOURCEVERSION"
-fi
-PROPOSEDVERSION=`echo "$PROPOSEDVERSION" | sed -r 's/(.+?)[\r\n]*$/\1/'`
+# Trim any trailing \r or \n from the given variable.
+chomp()
+{
+    local old_value=$(eval echo "\$$1");
+    local value=$(echo "$old_value" | sed 's/[\r\n]*$//')
+    eval $1=\$value;
+}
 
-BLDMAJORVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\1/'`
-BLDMINORVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\3/'`
-BLDVARIANTVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\5/'`
-if [ "$BLDMINORVERSION" == "" ]; then
-    BLDMINORVERSION=0
-fi
-if [ "$BLDVARIANTVERSION" == "" ]; then
-    BLDVARIANTVERSION=0
-fi
-SVNOPENSOURCEREVISION=`svn info | grep '^Revision' | sed -r 's/^Revision: (.+?)[\r\n]*$/\1/'`
+FALLBACK_VERSION_PATH=`cygpath -u "$WEBKITLIBRARIESDIR\\tools\\scripts\\VERSION"`
+OUTPUT_FILE=$(cygpath -u "$1")/include/autoversion.h
+mkdir -p $(dirname "$OUTPUT_FILE")
 
-MAJORVERSION=`echo "$PROPOSEDVERSION" | sed 's/\(.\)[^\.]*\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\1/'`
-MINORVERSION=`echo "$PROPOSEDVERSION" | sed 's/.\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\1/'`
-TINYVERSION=`echo "$PROPOSEDVERSION" | sed 's/\([^\.]*\)\(\.\([^.]*\)\(\.\([^.]*\)\)\?\)\?/\3/'`
-if [ "$MINORVERSION" == "" ]; then
-    MINORVERSION=0
-fi
-if [ "$TINYVERSION" == "" ]; then
-    TINYVERSION=0
-fi
+# Take the initial version number from RC_PROJECTSOURCEVERSION if it
+# exists, otherwise fall back to the version number stored in the source.
+ENVIRONMENT_VERSION="$RC_PROJECTSOURCEVERSION";
+FALLBACK_VERSION=$(cat "$FALLBACK_VERSION_PATH");
+PROPOSED_VERSION=${ENVIRONMENT_VERSION:-$FALLBACK_VERSION}
+chomp PROPOSED_VERSION
+
+# Split out the three components of the dotted version number.  We pad
+# the input with trailing dots to handle the case where the input version
+# has fewer components than we expect.
+BUILD_MAJOR_VERSION=$(echo "$PROPOSED_VERSION.." | cut -d '.' -f 1)
+BUILD_MINOR_VERSION=$(echo "$PROPOSED_VERSION.." | cut -d '.' -f 2)
+BUILD_TINY_VERSION=$(echo "$PROPOSED_VERSION.." | cut -d '.' -f 3)
+
+# Cut the major component down to three characters by dropping any
+# extra leading digits, then adjust the major version portion of the
+# version string to match.
+CHARACTERS_TO_DROP=$(( ${#BUILD_MAJOR_VERSION} - 3 ))
+BUILD_MAJOR_VERSION=${BUILD_MAJOR_VERSION:$CHARACTERS_TO_DROP}
+PROPOSED_VERSION=${PROPOSED_VERSION:$CHARACTERS_TO_DROP}
+
+# Have the minor and tiny components default to zero if not present.
+BUILD_MINOR_VERSION=${BUILD_MINOR_VERSION:-0}
+BUILD_TINY_VERSION=${BUILD_TINY_VERSION:-0}
+
+# Split the first component further by using the first digit for the
+# major version and the remaining two characters as the minor version.
+# The minor version is shifted down to the tiny version, with the tiny
+# version becoming the variant version.
+MAJOR_VERSION=${BUILD_MAJOR_VERSION:0:1}
+MINOR_VERSION=${BUILD_MAJOR_VERSION:1}
+TINY_VERSION=${BUILD_MINOR_VERSION}
+VARIANT_VERSION=${BUILD_TINY_VERSION}
+
+VERSION_TEXT=${PROPOSED_VERSION}
+VERSION_TEXT_SHORT=${VERSION_TEXT}
+
+if [ -z ${ENVIRONMENT_VERSION} ]; then
+    # If we didn't pull the version number from the environment then we're doing
+    # an engineering build and we'll stamp the build with some more information.
+
+    BUILD_DATE=$(date)
+    SVN_REVISION=$(svn info | grep '^Revision' | sed 's/^Revision: //')
 
-BLDNMBR="$PROPOSEDVERSION"
-BLDNMBRSHORT="$BLDNMBR"
+    chomp BUILD_DATE
+    chomp SVN_REVISION
 
-if [ "$RC_PROJECTSOURCEVERSION" == "" ]; then
-    BLDNMBRSHORT="$BLDNMBRSHORT+"
-    BLDUSERNAME=`echo "$(whoami)" | sed -r 's/(.+?)[\r\n]*$/\1/'`
-    BLDDATE=`echo "$(date)" | sed -r 's/(.+?)[\r\n]*$/\1/'`
-    BLDNMBR="$BLDNMBRSHORT $BLDUSERNAME - $BLDDATE - r$SVNOPENSOURCEREVISION"
+    VERSION_TEXT_SHORT="${VERSION_TEXT_SHORT}+"
+    VERSION_TEXT="${VERSION_TEXT_SHORT} ${USER} - ${BUILD_DATE} - r${SVN_REVISION}"
 fi
 
-cat > "$VERSIONFILE" <<EOF
-#define __VERSION_TEXT__ "$BLDNMBR"
-#define __BUILD_NUMBER__ "$BLDNMBR"
-#define __BUILD_NUMBER_SHORT__ "$BLDNMBRSHORT"
-#define __VERSION_MAJOR__ $MAJORVERSION
-#define __VERSION_MINOR__ $MINORVERSION
-#define __VERSION_TINY__ $TINYVERSION
-#define __VERSION_BUILD__ $BLDVARIANTVERSION
-#define __BUILD_NUMBER_MAJOR__ $BLDMAJORVERSION
-#define __BUILD_NUMBER_MINOR__ $BLDMINORVERSION
-#define __BUILD_NUMBER_VARIANT__ $BLDVARIANTVERSION
-#define __SVN_REVISION__ $SVNREVISION
+cat > "$OUTPUT_FILE" <<EOF
+#define __VERSION_TEXT__ "${VERSION_TEXT}"
+#define __BUILD_NUMBER__ "${VERSION_TEXT}"
+#define __BUILD_NUMBER_SHORT__ "${VERSION_TEXT_SHORT}"
+#define __VERSION_MAJOR__ ${MAJOR_VERSION}
+#define __VERSION_MINOR__ ${MINOR_VERSION}
+#define __VERSION_TINY__ ${TINY_VERSION}
+#define __VERSION_BUILD__ ${VARIANT_VERSION}
+#define __BUILD_NUMBER_MAJOR__ ${BUILD_MAJOR_VERSION}
+#define __BUILD_NUMBER_MINOR__ ${BUILD_MINOR_VERSION}
+#define __BUILD_NUMBER_VARIANT__ ${BUILD_TINY_VERSION}
+#define __SVN_REVISION__ ${SVN_REVISION}
 EOF
diff --git a/WebKitLibraries/win/tools/vsprops/debug_all.vsprops b/WebKitLibraries/win/tools/vsprops/debug_all.vsprops
new file mode 100644
index 0000000..63c4627
--- /dev/null
+++ b/WebKitLibraries/win/tools/vsprops/debug_all.vsprops
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="debug_all"
+	>
+	<Tool
+		Name="VCCLCompilerTool"
+		PreprocessorDefinitions="USE_DEBUG_SAFARI_THEME;DEBUG_INTERNAL;DEBUG_ALL"
+		RuntimeLibrary="3"
+	/>
+	<UserMacro
+		Name="WebKitConfigSuffix"
+		Value="_debug"
+		PerformEnvironmentSet="true"
+	/>
+	<UserMacro
+		Name="LibraryConfigSuffix"
+		Value="_debug"
+		PerformEnvironmentSet="true"
+	/>
+	<UserMacro
+		Name="WebKitDLLConfigSuffix"
+		Value="_debug"
+	/>
+</VisualStudioPropertySheet>
diff --git a/WebKitLibraries/win/tools/vsprops/debug_internal.vsprops b/WebKitLibraries/win/tools/vsprops/debug_internal.vsprops
index ef7674a..d0c61c1 100644
--- a/WebKitLibraries/win/tools/vsprops/debug_internal.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/debug_internal.vsprops
@@ -6,21 +6,20 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="USE_DEBUG_SAFARI_THEME;DEBUG_INTERNAL"
-		RuntimeLibrary="3"
+		PreprocessorDefinitions="DEBUG_INTERNAL"
 	/>
 	<UserMacro
 		Name="WebKitConfigSuffix"
-		Value="_debug"
+		Value=""
 		PerformEnvironmentSet="true"
 	/>
 	<UserMacro
 		Name="LibraryConfigSuffix"
-		Value="_debug"
+		Value=""
 		PerformEnvironmentSet="true"
 	/>
 	<UserMacro
 		Name="WebKitDLLConfigSuffix"
-		Value="_debug"
+		Value=""
 	/>
 </VisualStudioPropertySheet>
diff --git a/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops b/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
index 0e7db13..7d424e6 100644
--- a/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/debug_wincairo.vsprops
@@ -10,10 +10,12 @@
 		MinimalRebuild="true"

 		BasicRuntimeChecks="3"

 		RuntimeLibrary="2"

+		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;"

 	/>

 	<Tool

 		Name="VCLinkerTool"

 		LinkIncremental="2"

+		AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\lib&quot;"

 	/>

 	<UserMacro

 		Name="WebKitConfigSuffix"

diff --git a/WebKitTools/ChangeLog b/WebKitTools/ChangeLog
index 6a8a912..7dcbf6c 100644
--- a/WebKitTools/ChangeLog
+++ b/WebKitTools/ChangeLog
@@ -1,3 +1,1028 @@
+2009-10-28  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Adding myself to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Adding myself to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        [GTK] API to start inspector for a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=22551
+
+        Use the new inspector API to implement the LayoutTestController
+        interfaces used to test the inspector.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (webInspectorInspectWebView):
+        (createWebView):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        (LayoutTestController::evaluateInWebInspector):
+
+2009-10-28  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] WebFrame::counterValueForElementById must not be exposed
+        https://bugs.webkit.org/show_bug.cgi?id=30882
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::counterValueForElementById):
+
+2009-10-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Oliver Hunt.
+
+        Fix the warning:
+
+        "warning: ignoring return value of 'char* getcwd(char*, size_t)',
+        declared with attribute warn_unused_result".
+
+        by actually checking the result. In the case it is null, an
+        error has occoured, so treat it as the other fatal errors.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::initializeFonts):
+
+2009-10-27  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Provide a way to get counter values with layoutTestContoller
+        https://bugs.webkit.org/show_bug.cgi?id=30555
+
+        Define layoutTestContoller.counterValueForElementById.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (counterValueForElementByIdCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::counterValueForElementById):
+
+2009-10-27  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by Oliver Hunt.
+
+        Change two methods to be internal for DRT use only.
+
+        Part of [Qt] Review all new API in Qt 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=29843#c11
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::whiteListAccessFromOrigin):
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION: svn-apply exits(1) when applying a patch with a file add
+        https://bugs.webkit.org/show_bug.cgi?id=30826
+
+        * Scripts/svn-apply:
+         - Add () around all system() calls.
+         - Use the correct system() == 0 or die instead of system() or die
+         - Add descriptive messages to all die statements.
+
+2009-10-27  Steve Block  <steveblock@google.com>
+
+        Reviewed by NOBODY.
+
+        Adds steveblock@google.com to list of committers.
+
+        * Scripts/modules/committers.py: Adds steveblock@google.com to list of committers.
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        svn-apply can exit(0) even on patch failure
+        https://bugs.webkit.org/show_bug.cgi?id=29622
+
+        * Scripts/svn-apply:
+         - Add a bunch of "or die" statements, hopefully catching all
+           possible cases where failure could still exit(0).
+
+2009-10-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        svn-* scripts should share code through VCSUtils.pm
+        https://bugs.webkit.org/show_bug.cgi?id=30791
+
+        Just moving code into a shared location.
+
+        * Scripts/VCSUtils.pm:
+        * Scripts/prepare-ChangeLog:
+        * Scripts/resolve-ChangeLogs:
+        * Scripts/svn-apply:
+        * Scripts/svn-create-patch:
+        * Scripts/svn-unapply:
+        * Scripts/update-webkit:
+
+2009-10-27  Vadim Zeitlin  <vadim@wxwidgets.org>
+
+        Suppress a huge number of MSVC warnings when building wxWebKit.
+
+        * wx/build/settings.py:
+
+2009-10-26  Eric Seidel  <eric@webkit.org>
+
+        No review, just adding Mike Belshe to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Make .rc files compile on Windows without depending on MFC headers
+        https://bugs.webkit.org/show_bug.cgi?id=30750
+
+        * DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.rc: Use
+        windows.h instead of afxres.h because it exists even when MFC is not 
+        installed, and is all that's needed here.
+
+        * FindSafari/FindSafari.rc: Ditto
+
+2009-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool post-diff should know how to mark commit-queue=?
+        https://bugs.webkit.org/show_bug.cgi?id=29202
+
+        * Scripts/bugzilla-tool:
+         - Add --commit-queue option to post-diff, post-commits and create-bug.
+        * Scripts/modules/bugzilla.py:
+         - Added support for --commit-queue to add_patch_to_bug and create_bug_with_patch.
+         - Added _fill_attachment_form to share code between add_patch_to_bug and create_bug_with_patch.
+
+2009-10-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool commit-queue does not notice modifications to committers.py
+        https://bugs.webkit.org/show_bug.cgi?id=30084
+
+        * Scripts/bugzilla-tool:
+         - Make commit-queue re-exec itself instead of using while(1).
+         - Add a --is-relaunch parameter to commit-queue to bypass initialization on re-launch.
+         - Add a _next_patch() method which calls exec() (and could eventually call update-webkit too).
+
+2009-10-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue will get stuck on patches if land-patches terminates unexpectedly
+        https://bugs.webkit.org/show_bug.cgi?id=30634
+
+        * Scripts/bugzilla-tool:
+         - Add a way for land-patches to exit(2) to indicate an error, but one it has handled.
+         - Make commit-queue auto cq- any patch where land-patches exited anything other than '0' or '2'.
+
+2009-10-26  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Upgrade pywebsocket to 0.4.1. This will make reusing LayoutTests/fast/js/resources easier, for example.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30763
+
+        * pywebsocket/mod_pywebsocket/__init__.py:
+        * pywebsocket/mod_pywebsocket/dispatch.py:
+        * pywebsocket/mod_pywebsocket/headerparserhandler.py:
+        * pywebsocket/mod_pywebsocket/standalone.py:
+        * pywebsocket/setup.py:
+        * pywebsocket/test/test_dispatch.py:
+
+2009-10-26  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Levin.
+
+        REGRESSION: 2 failures in run-webkit-unittests
+        https://bugs.webkit.org/show_bug.cgi?id=30645
+
+        * Scripts/modules/cpp_style_unittest.py:
+        Fixed a few test scenarios which apparently lost some spaces from 
+        text literals.
+
+2009-10-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Make sure isQt() doesn't return true if --wx was passed to build-webkit.
+
+        * Scripts/webkitdirs.pm:
+
+2009-10-26  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Unification of using null device in perl scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=30572
+
+        * Scripts/VCSUtils.pm:
+        * Scripts/bisect-builds:
+        * Scripts/resolve-ChangeLogs:
+        * Scripts/run-iexploder-tests:
+        * Scripts/run-jsc:
+        * Scripts/run-mangleme-tests:
+        * Scripts/run-webkit-tests:
+        * Scripts/webkitdirs.pm:
+        Using File::Spec->devnull() instead of hard coded /dev/null.
+
+2009-10-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Reviewers are missing from committers.py
+        https://bugs.webkit.org/show_bug.cgi?id=30733
+
+        * Scripts/modules/committers.py:
+
+2009-10-23  Eric Seidel  <eric@webkit.org>
+
+        No review, only adding Alice to the list of reviewers.
+
+        * Scripts/modules/committers.py:
+
+2009-10-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Eric Carlson.
+
+        fast/media/mq-transform-02.html failed on Leopard Commit Bot
+        https://bugs.webkit.org/show_bug.cgi?id=30700
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues): Update QuickTime version check.
+
+2009-10-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix, needs to link against WebKitSystemInterfaceTiger to get 
+        character measurement APIs that are private on Tiger.
+
+        * wx/build/settings.py:
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY (build fix).
+        Build fix following bug #30696.
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+
+2009-10-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig & Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30696
+        Enable isolated-worlds tests on mac.
+
+        Add private interface for DRT to invoke execution in a given world.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (evaluateScriptInIsolatedWorldCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+
+2009-10-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        bugzilla-tool's "patch failed to download an apply" error should give more information
+        https://bugs.webkit.org/show_bug.cgi?id=30632
+
+        * Scripts/modules/scm.py:
+         - Use the common run_command method instead of custom POpen code.
+         - Make run_command know how to take pipes as input.
+        * Scripts/modules/scm_unittest.py:
+         - Add new tests to cover change.
+         - Also move test_error_handlers into new SCMClassTests so we don't run it 3 times.
+
+2009-10-21  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed.  Adding myself to the committers list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-21  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Update the Windows installer builder to work with Vista / Win 7 and with git.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30649
+
+        * wx/build/build_utils.py:
+        * wx/packaging/build-mac-installer.py:
+        * wx/packaging/build-win-installer.py:
+        * wx/packaging/wxWebKitInstaller.iss.in:
+
+2009-10-21  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Added conditional code to avoid using
+        gdk_window_get_root_coords if we do not have a gtk+ release newer
+        than 2.17.3.
+        https://bugs.webkit.org/show_bug.cgi?id=30636
+
+        * WebKitTools/DumpRenderTree/gtk/EventSender.cpp:
+
+2009-10-21  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Added dummy implementation for keepWebHistory()
+        https://bugs.webkit.org/show_bug.cgi?id=30592
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::keepWebHistory):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2009-10-21  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fixed the double click condition, it is not double click if
+        we move in just in one direction.
+        https://bugs.webkit.org/show_bug.cgi?id=30636
+
+        * WebKitTools/DumpRenderTree/gtk/EventSender.cpp:
+
+2009-10-21  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Initialize the events completly before emitting them.
+        https://bugs.webkit.org/show_bug.cgi?id=30633
+
+        * WebKitTools/DumpRenderTree/gtk/EventSender.cpp:
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Fix for when linking using --as-needed with gcc.
+
+        * wx/browser/wscript:
+
+2009-10-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac 10.4 build fix. Build and link against a version of libcurl new enough
+        to support all the features used by CURL backend.
+        
+        * wx/build/settings.py:
+        * wx/install-unix-extras:
+
+2009-10-20  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add {ager,antonm,yurys}@chromium.org into committers.py
+        https://bugs.webkit.org/show_bug.cgi?id=30560
+
+        * Scripts/modules/committers.py:
+
+2009-10-20  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the Netscape Test plugin available to the Qt launcher.
+
+        * Scripts/run-launcher:
+
+2009-10-20  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by David Levin.
+
+        Removed WebSocket runtime settings.
+        https://bugs.webkit.org/show_bug.cgi?id=29896
+
+        WebSocket runtime configuration is supported by chromium/v8 only.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-10-19  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add testFail() to test plugin so we can test our handling of a
+        plugin invoke call returning false.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30239
+
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp: Add testFail().
+        (pluginInvoke):
+        (testIdentifierToString): Always return true, since returning false will now cause an exception to be thrown.
+
+2009-10-19  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Enable DOM pasting when running layout tests.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-10-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Use the setPreferredContentsSize method instead
+        of setFixedContentsSize, as the method has been renamed.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::open):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::setFixedContentsSize):
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30456
+        Fixes for new Debug_All Windows build configuration.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (sharedCFURLCache): Use new DEBUG_ALL preprocessor define for library naming.
+        * DumpRenderTree/win/DumpRenderTree.vcproj: Remove unused DEBUG_WEBKIT_HAS_SUFFIX.
+
+2009-10-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue status bot should list which buildbot is blocking the queue
+        https://bugs.webkit.org/show_bug.cgi?id=30452
+
+        Add new methods and testing.
+
+        * Scripts/bugzilla-tool:
+        * Scripts/modules/buildbot.py:
+        * Scripts/modules/buildbot_unittest.py:
+
+2009-10-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        run-webkit-tests fails when CWD is not inside a WebKit checkout
+        https://bugs.webkit.org/show_bug.cgi?id=30451
+
+        * Scripts/modules/scm.py: in_working_directory shouldn't throw exceptions on failure.
+        * Scripts/modules/scm_unittest.py:
+          - Remove use of original_path (we don't need to restore the CWD).
+          - Don't use '.' to find the webkit checkout, use __file__ instead.
+
+2009-10-16  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a Debug_All configuration to build entire stack as debug.
+        Change Debug_Internal to:
+        - stop using _debug suffix for all WebKit/Safari binaries
+        - not use _debug as a DLL naming suffix
+        - use non-debug C runtime lib.
+
+        * DumpRenderTree/DumpRenderTree.sln: Add Debug_All configuration.
+        * DumpRenderTree/win/DumpRenderTree.vcproj: Add Debug_All configuration.
+        * DumpRenderTree/win/ImageDiff.vcproj: Add Debug_All configuration.
+        * DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj:
+        Add missing debug.vsprops inherited property sheet.
+        Add Debug_All configuration.
+        * FindSafari/FindSafari.vcproj: Renamed single configuration from "Release" to "all".
+        * WinLauncher/WinLauncher.vcproj:
+        Removed extraneous definitions inherited from vsprops.
+        Add Debug_All configuration.
+
+2009-10-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Levin.
+
+        check-webkit-style is wrong about indent checking in namespaces
+        in header files and a few other things
+        https://bugs.webkit.org/show_bug.cgi?id=30362
+
+        The few other things include:
+        + check-webkit-style does not require spaces around the equal sign
+          inside 'if' statements and around binary operators that take 
+          numeric literals.
+        + check-webkit-style reports false errors for the / operator
+          when part of a filename in the #include directive.
+
+        * Scripts/modules/cpp_style.py:
+        Improved indentation checking and space checking around
+        binary operators. While the checks are still not perfect,
+        they are clearly better than before.
+        * Scripts/modules/cpp_style_unittest.py:
+        Added test cases for the newly supported checks and modified old
+        test cases to match the new guidelines
+
+2009-10-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix. Link to MSW library needed by PluginPackageWin.cpp.
+
+        * wx/build/settings.py:
+
+2009-10-15  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by David Levin.
+
+        Add mod_pywebsocket to test Web Sockets.
+        http://code.google.com/p/pywebsocket/
+        https://bugs.webkit.org/show_bug.cgi?id=27490
+
+        * pywebsocket/COPYING: Added.
+        * pywebsocket/MANIFEST.in: Added.
+        * pywebsocket/README: Added.
+        * pywebsocket/example/echo_client.py: Added.
+        * pywebsocket/example/echo_wsh.py: Added.
+        * pywebsocket/mod_pywebsocket/__init__.py: Added.
+        * pywebsocket/mod_pywebsocket/dispatch.py: Added.
+        * pywebsocket/mod_pywebsocket/handshake.py: Added.
+        * pywebsocket/mod_pywebsocket/headerparserhandler.py: Added.
+        * pywebsocket/mod_pywebsocket/msgutil.py: Added.
+        * pywebsocket/mod_pywebsocket/standalone.py: Added.
+        * pywebsocket/mod_pywebsocket/util.py: Added.
+        * pywebsocket/setup.py: Added.
+        * pywebsocket/test/config.py: Added.
+        * pywebsocket/test/mock.py: Added.
+        * pywebsocket/test/run_all.py: Added.
+        * pywebsocket/test/test_dispatch.py: Added.
+        * pywebsocket/test/test_handshake.py: Added.
+        * pywebsocket/test/test_mock.py: Added.
+        * pywebsocket/test/test_msgutil.py: Added.
+        * pywebsocket/test/test_util.py: Added.
+        * pywebsocket/test/testdata/handlers/blank_wsh.py: Added.
+        * pywebsocket/test/testdata/handlers/origin_check_wsh.py: Added.
+        * pywebsocket/test/testdata/handlers/sub/exception_in_transfer_wsh.py: Added.
+        * pywebsocket/test/testdata/handlers/sub/no_wsh_at_the_end.py: Added.
+        * pywebsocket/test/testdata/handlers/sub/non_callable_wsh.py: Added.
+        * pywebsocket/test/testdata/handlers/sub/plain_wsh.py: Added.
+        * pywebsocket/test/testdata/handlers/sub/wrong_handshake_sig_wsh.py: Added.
+        * pywebsocket/test/testdata/handlers/sub/wrong_transfer_sig_wsh.py: Added.
+
+2009-10-15  James Robinson  <jamesr@google.com>
+
+        Reviewed by David Levin.
+
+        Updates check-webkit-style to reflect that code inside a namespace should not be indented, even in a header file.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30426
+
+        * Scripts/modules/cpp_style.py:
+        * Scripts/modules/cpp_style_unittest.py:
+
+2009-10-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes <http://webkit.org/b/30411>.
+        REGRESSION(49485): pdevenv doesn't compile in parallel for non-chromium builds on Windows.
+        
+        Added a check for isChromium() in pdevenv, and pass /useenv if we are not
+        building Chromium.
+
+        * Scripts/pdevenv:
+
+2009-10-15  Robin Dunn  <robin@alldunn.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add Mac package building scripts for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=30405
+
+        * wx/build/build_utils.py:
+        * wx/build/settings.py:
+        * wx/packaging/build-mac-installer.py: Added.
+
+2009-10-15  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Enable Web Sockets support when running layout tests.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-10-15  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Need to initialize event.button.button, since in most cases a
+        button number is not passed as an argument.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (mouseDownCallback):
+        (mouseUpCallback):
+
+2009-10-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. More SDK fixes for Mac, make sure we use the SDK corresponding to
+        the OS if none was explicitly set.
+
+        * wx/build/settings.py:
+
+2009-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: enable developers extras within inspector layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30014
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+
+2009-10-14  José Millán Soto  <jmillan@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        GtkLauncher is using a deprecated signal
+        https://bugs.webkit.org/show_bug.cgi?id=30364
+
+        Modified GtkLauncher to use notify::title signal instead of
+        deprecated title-changed signal
+
+        * GtkLauncher/main.c:
+        (notify_title_cb):
+        (create_browser):
+
+2009-10-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Don't set the history delegate on new windows that are opened during a test, as the history delegate:
+        1 - Disables WebHistory
+        2 - Doesn't make sense in that context anyway.
+
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (createWebViewAndOffscreenWindow):
+
+2009-10-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMac build fix. Ensure 10.4 compatibility for deps, and allow the user to specify
+        the SDK to use since Python overrides any user-set value of MACOSX_DEPLOYMENT_TARGET.
+
+        * wx/build/settings.py:
+        * wx/install-unix-extras:
+
+2009-10-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit Win API should provide a delegate interface for global history.
+        https://bugs.webkit.org/show_bug.cgi?id=29905
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController::dumpHistoryDelegateCallbacks):
+        (LayoutTestController::setDumpHistoryDelegateCallbacks):
+                
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (shouldLogHistoryDelegates):
+        (runTest):
+        (createWebViewAndOffscreenWindow):
+        (main):
+        * DumpRenderTree/win/DumpRenderTree.vcproj:
+        
+        Add the IWebHistoryDelegate to DRT Windows:
+        * DumpRenderTree/win/HistoryDelegate.cpp: Added.
+        (wstringFromBSTR):
+        (HistoryDelegate::HistoryDelegate):
+        (HistoryDelegate::~HistoryDelegate):
+        (HistoryDelegate::QueryInterface):
+        (HistoryDelegate::AddRef):
+        (HistoryDelegate::Release):
+        (HistoryDelegate::didNavigateWithNavigationData):
+        (HistoryDelegate::didPerformClientRedirectFromURL):
+        (HistoryDelegate::didPerformServerRedirectFromURL):
+        (HistoryDelegate::updateHistoryTitle):
+        (HistoryDelegate::populateVisitedLinksForWebView):
+        * DumpRenderTree/win/HistoryDelegate.h: Added.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::removeAllVisitedLinks):
+
+2009-10-14  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement support for setPOSIXLocale on Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=30268 
+ 
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::setPOSIXLocale):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2009-10-13  Stephanie Lewis  <slewis@apple.com>
+
+        Unreviewed, adding myself to reviewers list.
+
+        * Scripts/modules/committers.py:
+
+2009-10-13  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix null assignment so root tests work again.
+
+        * Scripts/webkitdirs.pm:
+
+2009-10-13  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Refactor LayoutTestController, EventSender, TextInputController and WorkQueueItem classes
+        out of jsobjects into separate files to get a more structured DumpRenderTree implementation.
+        This is done in preparation of implementing missing features in DRT.
+        No functionality changes made yet.
+
+        * DumpRenderTree/qt/DumpRenderTree.cpp:
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/EventSenderQt.cpp: Added.
+        (EventSender::EventSender):
+        (EventSender::mouseDown):
+        (EventSender::mouseUp):
+        (EventSender::mouseMoveTo):
+        (EventSender::leapForward):
+        (EventSender::keyDown):
+        (EventSender::contextClick):
+        (EventSender::scheduleAsynchronousClick):
+        (EventSender::frameUnderMouse):
+        * DumpRenderTree/qt/EventSenderQt.h: Added.
+        (EventSender::clearKillRing):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp: Added.
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::reset):
+        (LayoutTestController::processWork):
+        (LayoutTestController::maybeDump):
+        (LayoutTestController::waitUntilDone):
+        (LayoutTestController::notifyDone):
+        (LayoutTestController::windowCount):
+        (LayoutTestController::clearBackForwardList):
+        (LayoutTestController::dumpEditingCallbacks):
+        (LayoutTestController::dumpResourceLoadCallbacks):
+        (LayoutTestController::queueBackNavigation):
+        (LayoutTestController::queueForwardNavigation):
+        (LayoutTestController::queueLoad):
+        (LayoutTestController::queueReload):
+        (LayoutTestController::queueScript):
+        (LayoutTestController::provisionalLoad):
+        (LayoutTestController::timerEvent):
+        (LayoutTestController::encodeHostName):
+        (LayoutTestController::decodeHostName):
+        (LayoutTestController::setJavaScriptProfilingEnabled):
+        (LayoutTestController::setFixedContentsSize):
+        (LayoutTestController::setPrivateBrowsingEnabled):
+        (LayoutTestController::setPopupBlockingEnabled):
+        (LayoutTestController::pauseAnimationAtTimeOnElementWithId):
+        (LayoutTestController::pauseTransitionAtTimeOnElementWithId):
+        (LayoutTestController::numberOfActiveAnimations):
+        (LayoutTestController::disableImageLoading):
+        (LayoutTestController::dispatchPendingLoadRequests):
+        (LayoutTestController::setDatabaseQuota):
+        (LayoutTestController::clearAllDatabases):
+        (LayoutTestController::whiteListAccessFromOrigin):
+        (LayoutTestController::waitForPolicyDelegate):
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h: Added.
+        (LayoutTestController::isLoading):
+        (LayoutTestController::setLoading):
+        (LayoutTestController::shouldDumpAsText):
+        (LayoutTestController::shouldDumpBackForwardList):
+        (LayoutTestController::shouldDumpChildrenAsText):
+        (LayoutTestController::shouldDumpDatabaseCallbacks):
+        (LayoutTestController::shouldDumpStatusCallbacks):
+        (LayoutTestController::shouldWaitUntilDone):
+        (LayoutTestController::canOpenWindows):
+        (LayoutTestController::shouldDumpTitleChanges):
+        (LayoutTestController::waitForPolicy):
+        (LayoutTestController::dumpAsText):
+        (LayoutTestController::dumpChildFramesAsText):
+        (LayoutTestController::dumpDatabaseCallbacks):
+        (LayoutTestController::dumpStatusCallbacks):
+        (LayoutTestController::setCanOpenWindows):
+        (LayoutTestController::dumpBackForwardList):
+        (LayoutTestController::setCloseRemainingWindowsWhenComplete):
+        (LayoutTestController::display):
+        (LayoutTestController::dumpTitleChanges):
+        (LayoutTestController::dumpSelectionRect):
+        * DumpRenderTree/qt/TextInputControllerQt.cpp: Added.
+        (TextInputController::TextInputController):
+        (TextInputController::doCommand):
+        * DumpRenderTree/qt/TextInputControllerQt.h: Added.
+        * DumpRenderTree/qt/WorkQueue.cpp:
+        * DumpRenderTree/qt/WorkQueue.h:
+        * DumpRenderTree/qt/WorkQueueItem.h:
+        * DumpRenderTree/qt/WorkQueueItemQt.cpp: Added.
+        (findFrameNamed):
+        (LoadItem::invoke):
+        (ReloadItem::invoke):
+        (ScriptItem::invoke):
+        (BackForwardItem::invoke):
+        * DumpRenderTree/qt/jsobjects.cpp: Move all the above classes into separate files
+        * DumpRenderTree/qt/jsobjects.h:
+
+2009-10-13  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, adding myself to the list of reviewers.
+
+        * Scripts/modules/committers.py:
+
+2009-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6660507> Add "privacy mode" to Netscape Plug-in API
+
+        Make the private browsing mode testable by the test plug-in.
+        
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp:
+        (pluginGetProperty):
+        * DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h:
+        * DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp:
+        (NPP_New):
+        (NPP_SetValue):
+
+2009-10-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        No review, just adding self to the list of reviewers.
+
+        * Scripts/modules/committers.py:
+
+2009-10-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Web Inspector: Use proper web view in inspector layout
+        tests for windows.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30298
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::showWebInspector):
+        (LayoutTestController::closeWebInspector):
+        (LayoutTestController::evaluateInWebInspector):
+
+2009-10-12  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Enable experimentalWebSocket in DumpRenderTree for LayoutTest.
+        https://bugs.webkit.org/show_bug.cgi?id=29841
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2009-10-12  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium Port - Windows
+        https://bugs.webkit.org/show_bug.cgi?id=29969
+
+        * Scripts/pdevenv: removed msvc's /useenv for chromium builds
+        * Scripts/webkitdirs.pm:
+
+2009-10-12  Csaba Osztrogonac  <ossy@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        jsc scripts cleanup and Qt/GTK fix
+        https://bugs.webkit.org/show_bug.cgi?id=30288
+
+        Duplicated jscPath() moved to webkitdirs.pm.
+        New jscProductDir() added to webkitdirs.pm instead of duplicated codes.
+        Configuration added (release/debug) to path for Qt-port on Windows.
+
+        * Scripts/run-javascriptcore-tests:
+        * Scripts/run-jsc:
+        * Scripts/run-sunspider:
+        * Scripts/sunspider-compare-results:
+        * Scripts/webkitdirs.pm:
+
+2009-10-11  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Add Collin to committers.py.
+
+        * Scripts/modules/committers.py:
+
+2009-10-11  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, add bindings to source/include dirs now that there are sources there.
+
+        * wx/build/settings.py:
+
+2009-10-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Enable plug-in halting in DumpRenderTree.
+
+        We drop the plug-in halting delay to 1 second and opt in the delegate method to never halt plug-ins.
+        This is sufficient to ensure that the crash covered by <rdar://problem/7290671> no longer occurs.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/mac/UIDelegate.mm:
+        (-[UIDelegate webView:shouldHaltPlugin:]):
+
+2009-10-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Ask the History Delegate to populate the visited links hash.
+        <rdar://problem/7285293> and https://webkit.org/b/29904
+
+        Add the ability for LayoutTestController to clear all visited links.
+        Also lets the History Delegate dump visited links, but only if this test specifically cleared them.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (removeAllVisitedLinksCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::removeAllVisitedLinks):
+
+        * DumpRenderTree/mac/HistoryDelegate.mm:
+        (-[HistoryDelegate populateVisitedLinksForWebView:]):
+
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::removeAllVisitedLinks):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::removeAllVisitedLinks):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::removeAllVisitedLinks):
+
+
+2009-10-08  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30175
+        
+        The Windows DRT equivalent of DoDragDrop (i.e. UIDelegate::doDragDrop) does not return
+        the OLE drag-and-drop return value like the function it emulates. Currently, 
+        UIDelegate::doDragDrop returns a hard-coded S_OK. Hence, the caller cannot determine 
+        whether the drag-and-drop operation was successful or was cancelled.
+        
+        This patch fixes this issue by having UIDelegate::doDragDrop return the OLE drag-and-drop 
+        return value according to whether the drop operation was successful or not.
+
+        * DumpRenderTree/win/EventSender.cpp:
+        (doMouseUp): Added parameter oleDragAndDropReturnValue.
+        (replaySavedEvents): Ditto.
+        * DumpRenderTree/win/EventSender.h:
+        * DumpRenderTree/win/UIDelegate.cpp:
+        (UIDelegate::doDragDrop): Modified to return OLE drag-and-drop return value.
+
+2009-10-08  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Added support for a parameter setting the button that was
+        pressed in the mouseDown function.
+        https://bugs.webkit.org/show_bug.cgi?id=30220
+
+        * WebKitTools/DumpRenderTree/gtk/EventSender.cpp:
+
+2009-10-08  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Added a line to the bottom of the expected result to match
+        the output of the test.
+        https://bugs.webkit.org/show_bug.cgi?id=30220
+
+        * LayoutTests/platform/gtk/editing/pasteboard/middle-click-onpaste-
+        expected.txt:
+
 2009-10-08  Adam Roben  <aroben@apple.com>
 
         Use QueryInterface to get IWebInspectorPrivate
diff --git a/WebKitTools/DumpRenderTree/DumpRenderTree.sln b/WebKitTools/DumpRenderTree/DumpRenderTree.sln
index 43d2b61..399c002 100644
--- a/WebKitTools/DumpRenderTree/DumpRenderTree.sln
+++ b/WebKitTools/DumpRenderTree/DumpRenderTree.sln
@@ -11,29 +11,38 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ImageDiff", "win\ImageDiff.
 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		Debug_All|Win32 = Debug_All|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

 		Debug|Win32 = Debug|Win32

 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug|Win32.ActiveCfg = Debug|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug|Win32.Build.0 = Debug|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.ActiveCfg = Release|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.Build.0 = Release|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.ActiveCfg = Debug|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug|Win32.Build.0 = Debug|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.ActiveCfg = Release|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.Build.0 = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = Debug|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = Release|Win32

-		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Internal|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug|Win32.Build.0 = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = all|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug|Win32.ActiveCfg = Debug|Win32

diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
index 1f34325..daf888f 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
@@ -31,6 +31,7 @@
 
 #include "WorkQueue.h"
 #include "WorkQueueItem.h"
+#include <JavaScriptCore/JSContextRef.h>
 #include <JavaScriptCore/JSObjectRef.h>
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <stdio.h>
@@ -48,12 +49,14 @@ LayoutTestController::LayoutTestController(const std::string& testPathOrURL, con
     , m_dumpDatabaseCallbacks(false)
     , m_dumpEditingCallbacks(false)
     , m_dumpFrameLoadCallbacks(false)
+    , m_dumpHistoryDelegateCallbacks(false)
     , m_dumpResourceLoadCallbacks(false)
     , m_dumpResourceResponseMIMETypes(false)
     , m_dumpSelectionRect(false)
     , m_dumpSourceAsWebArchive(false)
     , m_dumpStatusCallbacks(false)
     , m_dumpTitleChanges(false)
+    , m_dumpVisitedLinksCallback(false)
     , m_dumpWillCacheResponse(false)
     , m_callCloseOnWebViews(true)
     , m_canOpenWindows(false)
@@ -204,6 +207,14 @@ static JSValueRef pathToLocalResourceCallback(JSContextRef context, JSObjectRef
     return JSValueMakeString(context, convertedPath.get());
 }
 
+static JSValueRef removeAllVisitedLinksCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setDumpVisitedLinksCallback(true);
+    controller->removeAllVisitedLinks();
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef repaintSweepHorizontallyCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -374,6 +385,22 @@ static JSValueRef execCommandCallback(JSContextRef context, JSObjectRef function
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef counterValueForElementByIdCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount < 1)
+        return JSValueMakeUndefined(context);
+
+    JSRetainPtr<JSStringRef> elementId(Adopt, JSValueToStringCopy(context, arguments[0], exception));
+    if (*exception)
+        return JSValueMakeUndefined(context);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    JSRetainPtr<JSStringRef> counterValue(controller->counterValueForElementById(elementId.get()));
+    if (!counterValue.get())
+        return JSValueMakeUndefined(context);
+    return JSValueMakeString(context, counterValue.get());
+}
+
 static JSValueRef grantDesktopNotificationPermissionCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     // Has Windows implementation
@@ -968,6 +995,18 @@ static JSValueRef evaluateInWebInspectorCallback(JSContextRef context, JSObjectR
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef evaluateScriptInIsolatedWorldCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    double worldID = JSValueToNumber(context, arguments[0], exception);
+    ASSERT(!*exception);
+    JSRetainPtr<JSStringRef> script(Adopt, JSValueToStringCopy(context, arguments[1], exception));
+    ASSERT(!*exception);
+
+    controller->evaluateScriptInIsolatedWorld(static_cast<unsigned>(worldID), JSContextGetGlobalObject(context), script.get());
+    return JSValueMakeUndefined(context);
+}
+
 static JSValueRef elementDoesAutoCompleteForElementWithIdCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -1176,7 +1215,9 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "elementDoesAutoCompleteForElementWithId", elementDoesAutoCompleteForElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "encodeHostName", encodeHostNameCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "evaluateInWebInspector", evaluateInWebInspectorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "evaluateScriptInIsolatedWorld", evaluateScriptInIsolatedWorldCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "execCommand", execCommandCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "counterValueForElementById", counterValueForElementByIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "grantDesktopNotificationPermission", grantDesktopNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
         { "isCommandEnabled", isCommandEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "keepWebHistory", keepWebHistoryCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -1193,6 +1234,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "queueLoadingScript", queueLoadingScriptCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueNonLoadingScript", queueNonLoadingScriptCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueReload", queueReloadCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "removeAllVisitedLinks", removeAllVisitedLinksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "repaintSweepHorizontally", repaintSweepHorizontallyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAcceptsEditing", setAcceptsEditingCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setAlwaysAcceptCookies", setAlwaysAcceptCookiesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.h b/WebKitTools/DumpRenderTree/LayoutTestController.h
index 7c829ef..79ffb99 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.h
@@ -30,6 +30,7 @@
 #define LayoutTestController_h
 
 #include <JavaScriptCore/JSObjectRef.h>
+#include <JavaScriptCore/JSRetainPtr.h>
 #include <wtf/RefCounted.h>
 #include <string>
 #include <vector>
@@ -51,6 +52,7 @@ public:
     void dispatchPendingLoadRequests();
     void display();
     void execCommand(JSStringRef name, JSStringRef value);
+    JSRetainPtr<JSStringRef> counterValueForElementById(JSStringRef id);
     bool isCommandEnabled(JSStringRef name);
     void keepWebHistory();
     void notifyDone();
@@ -62,6 +64,7 @@ public:
     void queueLoadingScript(JSStringRef script);
     void queueNonLoadingScript(JSStringRef script);
     void queueReload();
+    void removeAllVisitedLinks();
     void setAcceptsEditing(bool acceptsEditing);
     void setAppCacheMaximumSize(unsigned long long quota);
     void setAuthorAndUserStylesEnabled(bool);
@@ -120,6 +123,9 @@ public:
     bool dumpFrameLoadCallbacks() const { return m_dumpFrameLoadCallbacks; }
     void setDumpFrameLoadCallbacks(bool dumpFrameLoadCallbacks) { m_dumpFrameLoadCallbacks = dumpFrameLoadCallbacks; }
 
+    bool dumpHistoryDelegateCallbacks() const { return m_dumpHistoryDelegateCallbacks; }
+    void setDumpHistoryDelegateCallbacks(bool dumpHistoryDelegateCallbacks) { m_dumpHistoryDelegateCallbacks = dumpHistoryDelegateCallbacks; }
+    
     bool dumpResourceLoadCallbacks() const { return m_dumpResourceLoadCallbacks; }
     void setDumpResourceLoadCallbacks(bool dumpResourceLoadCallbacks) { m_dumpResourceLoadCallbacks = dumpResourceLoadCallbacks; }
     
@@ -137,6 +143,9 @@ public:
 
     bool dumpTitleChanges() const { return m_dumpTitleChanges; }
     void setDumpTitleChanges(bool dumpTitleChanges) { m_dumpTitleChanges = dumpTitleChanges; }
+
+    bool dumpVisitedLinksCallback() const { return m_dumpVisitedLinksCallback; }
+    void setDumpVisitedLinksCallback(bool dumpVisitedLinksCallback) { m_dumpVisitedLinksCallback = dumpVisitedLinksCallback; }
     
     bool dumpWillCacheResponse() const { return m_dumpWillCacheResponse; }
     void setDumpWillCacheResponse(bool dumpWillCacheResponse) { m_dumpWillCacheResponse = dumpWillCacheResponse; }
@@ -206,6 +215,7 @@ public:
     void showWebInspector();
     void closeWebInspector();
     void evaluateInWebInspector(long callId, JSStringRef script);
+    void evaluateScriptInIsolatedWorld(unsigned worldId, JSObjectRef globalObject, JSStringRef script);
 
     void setPOSIXLocale(JSStringRef locale);
 
@@ -219,12 +229,14 @@ private:
     bool m_dumpDatabaseCallbacks;
     bool m_dumpEditingCallbacks;
     bool m_dumpFrameLoadCallbacks;
+    bool m_dumpHistoryDelegateCallbacks;
     bool m_dumpResourceLoadCallbacks;
     bool m_dumpResourceResponseMIMETypes;
     bool m_dumpSelectionRect;
     bool m_dumpSourceAsWebArchive;
     bool m_dumpStatusCallbacks;
     bool m_dumpTitleChanges;
+    bool m_dumpVisitedLinksCallback;
     bool m_dumpWillCacheResponse;
     bool m_callCloseOnWebViews;
     bool m_canOpenWindows;
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
index 3a04c3c..14280ba 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.cpp
@@ -106,13 +106,17 @@ NPClass *getPluginClass(void)
 
 static bool identifiersInitialized = false;
 
-#define ID_PROPERTY_PROPERTY                    0
-#define ID_PROPERTY_EVENT_LOGGING               1
-#define ID_PROPERTY_HAS_STREAM                  2
-#define ID_PROPERTY_TEST_OBJECT                 3
-#define ID_PROPERTY_LOG_DESTROY                 4
-#define ID_PROPERTY_RETURN_ERROR_FROM_NEWSTREAM 5
-#define NUM_PROPERTY_IDENTIFIERS                6
+enum {
+    ID_PROPERTY_PROPERTY = 0,
+    ID_PROPERTY_EVENT_LOGGING,
+    ID_PROPERTY_HAS_STREAM,
+    ID_PROPERTY_TEST_OBJECT,
+    ID_PROPERTY_LOG_DESTROY,
+    ID_PROPERTY_RETURN_ERROR_FROM_NEWSTREAM,
+    ID_PROPERTY_PRIVATE_BROWSING_ENABLED,
+    ID_PROPERTY_CACHED_PRIVATE_BROWSING_ENABLED,
+    NUM_PROPERTY_IDENTIFIERS
+};
 
 static NPIdentifier pluginPropertyIdentifiers[NUM_PROPERTY_IDENTIFIERS];
 static const NPUTF8 *pluginPropertyIdentifierNames[NUM_PROPERTY_IDENTIFIERS] = {
@@ -122,6 +126,8 @@ static const NPUTF8 *pluginPropertyIdentifierNames[NUM_PROPERTY_IDENTIFIERS] = {
     "testObject",
     "logDestroy",
     "returnErrorFromNewStream",
+    "privateBrowsingEnabled",
+    "cachedPrivateBrowsingEnabled",
 };
 
 enum {
@@ -144,6 +150,7 @@ enum {
     ID_TEST_POSTURL_FILE,
     ID_TEST_CONSTRUCT,
     ID_TEST_THROW_EXCEPTION_METHOD,
+    ID_TEST_FAIL_METHOD,
     ID_DESTROY_NULL_STREAM,
     NUM_METHOD_IDENTIFIERS
 };
@@ -169,6 +176,7 @@ static const NPUTF8 *pluginMethodIdentifierNames[NUM_METHOD_IDENTIFIERS] = {
     "testPostURLFile",
     "testConstruct",
     "testThrowException",
+    "testFail",
     "destroyNullStream"
 };
 
@@ -226,6 +234,14 @@ static bool pluginGetProperty(NPObject* obj, NPIdentifier name, NPVariant* resul
     } else if (name == pluginPropertyIdentifiers[ID_PROPERTY_RETURN_ERROR_FROM_NEWSTREAM]) {
         BOOLEAN_TO_NPVARIANT(plugin->returnErrorFromNewStream, *result);
         return true;
+    } else if (name == pluginPropertyIdentifiers[ID_PROPERTY_PRIVATE_BROWSING_ENABLED]) {
+        NPBool privateBrowsingEnabled = FALSE;
+        browser->getvalue(plugin->npp, NPNVprivateModeBool, &privateBrowsingEnabled);
+        BOOLEAN_TO_NPVARIANT(privateBrowsingEnabled, *result);
+        return true;
+    } else if (name == pluginPropertyIdentifiers[ID_PROPERTY_CACHED_PRIVATE_BROWSING_ENABLED]) {
+        BOOLEAN_TO_NPVARIANT(plugin->cachedPrivateBrowsingMode, *result);
+        return true;
     }
     return false;
 }
@@ -309,13 +325,13 @@ static NPIdentifier variantToIdentifier(NPVariant variant)
 static bool testIdentifierToString(PluginObject*, const NPVariant* args, uint32_t argCount, NPVariant* result)
 {
     if (argCount != 1)
-        return false;
+        return true;
     NPIdentifier identifier = variantToIdentifier(args[0]);
     if (!identifier)
-        return false;
+        return true;
     NPUTF8* utf8String = browser->utf8fromidentifier(identifier);
     if (!utf8String)
-        return false;
+        return true;
     STRINGZ_TO_NPVARIANT(utf8String, *result);
     return true;
 }
@@ -669,6 +685,10 @@ static bool pluginInvoke(NPObject* header, NPIdentifier name, const NPVariant* a
     else if (name == pluginMethodIdentifiers[ID_TEST_THROW_EXCEPTION_METHOD]) {
         browser->setexception(header, "plugin object testThrowException SUCCESS");
         return true;
+    } else if (name == pluginMethodIdentifiers[ID_TEST_FAIL_METHOD]) {
+        NPObject* windowScriptObject;
+        browser->getvalue(plugin->npp, NPNVWindowNPObject, &windowScriptObject);
+        browser->invoke(plugin->npp, windowScriptObject, name, args, argCount, result);
     } else if (name == pluginMethodIdentifiers[ID_DESTROY_NULL_STREAM]) 
         return destroyNullStream(plugin, args, argCount, result);
     
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h
index 17b11e1..7437d04 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/PluginObject.h
@@ -35,6 +35,7 @@ typedef struct {
     NPBool logSetWindow;
     NPBool logDestroy;
     NPBool returnErrorFromNewStream;
+    NPBool cachedPrivateBrowsingMode;
     NPObject* testObject;
     NPStream* stream;
     char* onStreamLoad;
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
index 88618c3..125d2e8 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn.subproj/main.cpp
@@ -130,7 +130,9 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16 mode, int16 argc, ch
         return NPERR_INCOMPATIBLE_VERSION_ERROR;
     }
     
+    browser->getvalue(instance, NPNVprivateModeBool, (void *)&obj->cachedPrivateBrowsingMode);
     browser->setvalue(instance, NPPVpluginEventModel, (void *)obj->eventModel);
+    
     return NPERR_NO_ERROR;
 }
 
@@ -383,5 +385,13 @@ NPError NPP_GetValue(NPP instance, NPPVariable variable, void *value)
 
 NPError NPP_SetValue(NPP instance, NPNVariable variable, void *value)
 {
-    return NPERR_GENERIC_ERROR;
+    PluginObject* obj = static_cast<PluginObject*>(instance->pdata);
+
+    switch (variable) {
+        case NPNVprivateModeBool:
+            obj->cachedPrivateBrowsingMode = *(NPBool*)value;
+            return NPERR_NO_ERROR;
+        default:
+            return NPERR_GENERIC_ERROR;
+    }
 }
diff --git a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 6ecd774..4ed6e36 100644
--- a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -319,6 +319,8 @@ static void resetDefaultsToConsistentValues()
                  "enable-offline-web-application-cache", TRUE,
                  "enable-universal-access-from-file-uris", TRUE,
                  "enable-scripts", TRUE,
+                 "enable-web-sockets", TRUE,
+                 "enable-dom-paste", TRUE,
                  "default-font-family", "Times",
                  "monospace-font-family", "Courier",
                  "serif-font-family", "Times",
@@ -706,6 +708,11 @@ static void databaseQuotaExceeded(WebKitWebView* view, WebKitWebFrame* frame, We
 
 static WebKitWebView* webViewCreate(WebKitWebView*, WebKitWebFrame*);
 
+static WebKitWebView* webInspectorInspectWebView(WebKitWebInspector*, gpointer data)
+{
+    return WEBKIT_WEB_VIEW(webkit_web_view_new());
+}
+
 static WebKitWebView* createWebView()
 {
     WebKitWebView* view = WEBKIT_WEB_VIEW(webkit_web_view_new());
@@ -730,6 +737,9 @@ static WebKitWebView* createWebView()
                      "signal::database-quota-exceeded", databaseQuotaExceeded, 0,
                      NULL);
 
+    WebKitWebInspector* inspector = webkit_web_view_get_inspector(view);
+    g_signal_connect(inspector, "inspect-web-view", G_CALLBACK(webInspectorInspectWebView), 0);
+
     return view;
 }
 
diff --git a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
index c3c72c1..f42928c 100644
--- a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
@@ -53,6 +53,7 @@ extern "C" {
 }
 
 static bool down = false;
+static bool currentEventButton = 1;
 static bool dragMode = true;
 static bool replayingSavedEvents = false;
 static int lastMousePositionX;
@@ -122,12 +123,27 @@ static JSValueRef contextClickCallback(JSContextRef context, JSObjectRef functio
 static void updateClickCount(int /* button */)
 {
     // FIXME: take the last clicked button number and the time of last click into account.
-    if (lastClickPositionX != lastMousePositionX && lastClickPositionY != lastMousePositionY)
+    if (lastClickPositionX != lastMousePositionX || lastClickPositionY != lastMousePositionY)
         clickCount = 1;
     else
         clickCount++;
 }
 
+#if !GTK_CHECK_VERSION(2,17,3)
+static void getRootCoords(GtkWidget* view, int* rootX, int* rootY)
+{
+    GtkWidget* window = gtk_widget_get_toplevel(GTK_WIDGET(view));
+    int tmpX, tmpY;
+
+    gtk_widget_translate_coordinates(view, window, lastMousePositionX, lastMousePositionY, &tmpX, &tmpY);
+
+    gdk_window_get_origin(window->window, rootX, rootY);
+
+    *rootX += tmpX;
+    *rootY += tmpY;
+}
+#endif
+
 static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
@@ -140,9 +156,29 @@ static JSValueRef mouseDownCallback(JSContextRef context, JSObjectRef function,
     memset(&event, 0, sizeof(event));
     event.type = GDK_BUTTON_PRESS;
     event.button.button = 1;
+
+    if (argumentCount == 1) {
+        event.button.button = (int)JSValueToNumber(context, arguments[0], exception) + 1;
+        g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+    }
+
+    currentEventButton = event.button.button;
+
     event.button.x = lastMousePositionX;
     event.button.y = lastMousePositionY;
     event.button.window = GTK_WIDGET(view)->window;
+    event.button.time = GDK_CURRENT_TIME;
+    event.button.device = gdk_device_get_core_pointer();
+
+    int x_root, y_root;
+#if GTK_CHECK_VERSION(2,17,3)
+    gdk_window_get_root_coords(GTK_WIDGET(view)->window, lastMousePositionX, lastMousePositionY, &x_root, &y_root);
+#else
+    getRootCoords(GTK_WIDGET(view), &x_root, &y_root);
+#endif
+
+    event.button.x_root = x_root;
+    event.button.y_root = y_root;
 
     updateClickCount(1);
 
@@ -177,9 +213,29 @@ static JSValueRef mouseUpCallback(JSContextRef context, JSObjectRef function, JS
     memset(&event, 0, sizeof(event));
     event.type = GDK_BUTTON_RELEASE;
     event.button.button = 1;
+
+    if (argumentCount == 1) {
+        event.button.button = (int)JSValueToNumber(context, arguments[0], exception) + 1;
+        g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
+    }
+
+    currentEventButton = event.button.button;
+
     event.button.x = lastMousePositionX;
     event.button.y = lastMousePositionY;
     event.button.window = GTK_WIDGET(view)->window;
+    event.button.time = GDK_CURRENT_TIME;
+    event.button.device = gdk_device_get_core_pointer();
+
+    int x_root, y_root;
+#if GTK_CHECK_VERSION(2,17,3)
+    gdk_window_get_root_coords(GTK_WIDGET(view)->window, lastMousePositionX, lastMousePositionY, &x_root, &y_root);
+#else
+    getRootCoords(GTK_WIDGET(view), &x_root, &y_root);
+#endif
+
+    event.button.x_root = x_root;
+    event.button.y_root = y_root;
 
     if ((dragMode && !replayingSavedEvents) || msgQueue[endOfQueue].delay) {
         msgQueue[endOfQueue].event = event;
@@ -213,11 +269,33 @@ static JSValueRef mouseMoveToCallback(JSContextRef context, JSObjectRef function
     g_return_val_if_fail((!exception || !*exception), JSValueMakeUndefined(context));
 
     GdkEvent event;
+    memset(&event, 0, sizeof(event));
     event.type = GDK_MOTION_NOTIFY;
     event.motion.x = lastMousePositionX;
     event.motion.y = lastMousePositionY;
     event.motion.time = GDK_CURRENT_TIME;
     event.motion.window = GTK_WIDGET(view)->window;
+    event.motion.device = gdk_device_get_core_pointer();
+
+    int x_root, y_root;
+#if GTK_CHECK_VERSION(2,17,3)
+    gdk_window_get_root_coords(GTK_WIDGET(view)->window, lastMousePositionX, lastMousePositionY, &x_root, &y_root);
+#else
+    getRootCoords(GTK_WIDGET(view), &x_root, &y_root);
+#endif
+
+    event.motion.x_root = x_root;
+    event.motion.y_root = y_root;
+
+    if (down) {
+        if (currentEventButton == 1)
+            event.motion.state = GDK_BUTTON1_MASK;
+        else if (currentEventButton == 2)
+            event.motion.state = GDK_BUTTON2_MASK;
+        else if (currentEventButton == 3)
+            event.motion.state = GDK_BUTTON3_MASK;
+    } else
+        event.motion.state = 0;
 
     if (dragMode && down && !replayingSavedEvents) {
         msgQueue[endOfQueue].event = event;
diff --git a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 0b4a38f..631fc31 100644
--- a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Nuanti Ltd.
  * Copyright (C) 2009 Jan Michael Alonzo <jmalonzo@gmail.com>
+ * Copyright (C) 2009 Collabora Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,6 +53,8 @@ unsigned int webkit_web_frame_number_of_active_animations(WebKitWebFrame* frame)
 void webkit_application_cache_set_maximum_size(unsigned long long size);
 unsigned int webkit_worker_thread_count(void);
 void webkit_white_list_access_from_origin(const gchar* sourceOrigin, const gchar* destinationProtocol, const gchar* destinationHost, bool allowDestinationSubdomains);
+gchar* webkit_web_frame_counter_value_for_element_by_id(WebKitWebFrame* frame, const gchar* id);
+void webkit_web_inspector_execute_script(WebKitWebInspector* inspector, long callId, const gchar* script);
 }
 
 static gchar* copyWebSettingKey(gchar* preferenceKey)
@@ -118,6 +121,17 @@ void LayoutTestController::display()
     displayWebView();
 }
 
+JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
+{
+    gchar* idGChar = JSStringCopyUTF8CString(id);
+    gchar* counterValueGChar = webkit_web_frame_counter_value_for_element_by_id(mainFrame, idGChar);
+    g_free(idGChar);
+    if (!counterValueGChar)
+        return 0;
+    JSRetainPtr<JSStringRef> counterValue(Adopt, JSStringCreateWithUTF8CString(counterValueGChar));
+    return counterValue;
+}
+
 void LayoutTestController::keepWebHistory()
 {
     // FIXME: implement
@@ -474,15 +488,40 @@ void LayoutTestController::addUserStyleSheet(JSStringRef source)
 
 void LayoutTestController::showWebInspector()
 {
-    // FIXME: Implement this.
+    WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
+    WebKitWebSettings* webSettings = webkit_web_view_get_settings(webView);
+    WebKitWebInspector* inspector = webkit_web_view_get_inspector(webView);
+
+    g_object_set(webSettings, "enable-developer-extras", TRUE, NULL);
+    webkit_web_inspector_inspect_coordinates(inspector, 0, 0);
 }
 
 void LayoutTestController::closeWebInspector()
 {
-    // FIXME: Implement this.
+    WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
+    WebKitWebSettings* webSettings = webkit_web_view_get_settings(webView);
+    WebKitWebInspector* inspector = webkit_web_view_get_inspector(webView);
+
+    webkit_web_inspector_close(inspector);
+    g_object_set(webSettings, "enable-developer-extras", FALSE, NULL);
 }
 
 void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
 {
+    WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
+    WebKitWebInspector* inspector = webkit_web_view_get_inspector(webView);
+    char* scriptString = JSStringCopyUTF8CString(script);
+
+    webkit_web_inspector_execute_script(inspector, callId, scriptString);
+    g_free(scriptString);
+}
+
+void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldID, JSObjectRef globalObject, JSStringRef script)
+{
+    // FIXME: Implement this.
+}
+
+void LayoutTestController::removeAllVisitedLinks()
+{
     // FIXME: Implement this.
 }
diff --git a/WebKitTools/DumpRenderTree/mac/Configurations/Base.xcconfig b/WebKitTools/DumpRenderTree/mac/Configurations/Base.xcconfig
index 79d1e14..a72dd7d 100644
--- a/WebKitTools/DumpRenderTree/mac/Configurations/Base.xcconfig
+++ b/WebKitTools/DumpRenderTree/mac/Configurations/Base.xcconfig
@@ -22,11 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 HEADER_SEARCH_PATHS = ForwardingHeaders mac/InternalHeaders;
-FRAMEWORK_SEARCH_PATHS = $(FRAMEWORK_SEARCH_PATHS_$(MAC_OS_X_VERSION_MAJOR));
-FRAMEWORK_SEARCH_PATHS_ = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks
-FRAMEWORK_SEARCH_PATHS_1040 = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks
-FRAMEWORK_SEARCH_PATHS_1050 = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks
-FRAMEWORK_SEARCH_PATHS_1060 = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks
+FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
 GCC_PREPROCESSOR_DEFINITIONS = ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST;
 DEBUG_INFORMATION_FORMAT = dwarf
 PREBINDING = NO
diff --git a/WebKitTools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig b/WebKitTools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig
index 05af1e5..96a39a9 100644
--- a/WebKitTools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig
+++ b/WebKitTools/DumpRenderTree/mac/Configurations/DebugRelease.xcconfig
@@ -28,6 +28,7 @@ ARCHS_ = $(ARCHS_1040);
 ARCHS_1040 = $(NATIVE_ARCH);
 ARCHS_1050 = $(NATIVE_ARCH);
 ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
 
 ONLY_ACTIVE_ARCH = YES;
 
@@ -36,3 +37,4 @@ MACOSX_DEPLOYMENT_TARGET_ = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
 MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
 MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
index 0c33381..98f4f9c 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -409,7 +409,7 @@ static void resetDefaultsToConsistentValues()
     [preferences setCacheModel:WebCacheModelDocumentBrowser];
     [preferences setXSSAuditorEnabled:NO];
     [preferences setExperimentalNotificationsEnabled:NO];
-    [preferences setExperimentalWebSocketsEnabled:NO];
+    [preferences setPluginAllowedRunTime:1];
 
     [preferences setPrivateBrowsingEnabled:NO];
     [preferences setAuthorAndUserStylesEnabled:YES];
@@ -434,9 +434,9 @@ static void resetDefaultsToConsistentValues()
     SInt32 qtVersion;
     OSErr err = Gestalt(gestaltQuickTimeVersion, &qtVersion);
     assert(err == noErr);
-    // Bug 7228836 exists in at least 7.6.3 and 7.6.4, hopefully it will be fixed in 7.6.5.
+    // Bug 7228836 exists in at least 7.6.3 through 7.6.4, hopefully it will be fixed in 7.6.5.
     // FIXME: Once we know the exact versions of QuickTime affected, we can update this check.
-    if (qtVersion <= 0x07640000)
+    if (qtVersion <= 0x07648000) // 7.6.4, final release (0x8).  See http://developer.apple.com/mac/library/techn
         [preferences setAcceleratedCompositingEnabled:NO];
     else
 #endif
diff --git a/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm b/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm
index 9e2b836..cbc4093 100644
--- a/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/HistoryDelegate.mm
@@ -29,6 +29,7 @@
 #import "LayoutTestController.h"
 
 #import <WebKit/WebNavigationData.h>
+#import <WebKit/WebView.h>
 
 @interface NSURL (DRTExtras)
 - (NSString *)_drt_descriptionSuitableForTestResult;
@@ -71,4 +72,10 @@
     printf("WebView updated the title for history URL \"%s\" to \"%s\".\n", [[[NSURL URLWithString:url]_drt_descriptionSuitableForTestResult] UTF8String], [title UTF8String]);
 }
 
+- (void)populateVisitedLinksForWebView:(WebView *)webView
+{
+    if (gLayoutTestController->dumpVisitedLinksCallback())
+        printf("Asked to populate visited links for WebView \"%s\"\n", [[[NSURL URLWithString:[webView mainFrameURL]] _drt_descriptionSuitableForTestResult] UTF8String]);
+}
+
 @end
diff --git a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 233c5fd..4d6a609 100644
--- a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -42,6 +42,7 @@
 #import <WebKit/DOMElement.h>
 #import <WebKit/WebApplicationCache.h>
 #import <WebKit/WebBackForwardList.h>
+#import <WebKit/WebCoreStatistics.h>
 #import <WebKit/WebDatabaseManagerPrivate.h>
 #import <WebKit/WebDataSource.h>
 #import <WebKit/WebFrame.h>
@@ -151,6 +152,19 @@ void LayoutTestController::display()
     displayWebView();
 }
 
+JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
+{
+    RetainPtr<CFStringRef> idCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, id));
+    NSString *idNS = (NSString *)idCF.get();
+
+    DOMElement *element = [[mainFrame DOMDocument] getElementById:idNS];
+    if (!element)
+        return 0;
+
+    JSRetainPtr<JSStringRef> counterValue(Adopt, JSStringCreateWithCFString((CFStringRef)[mainFrame counterValueForElement:element]));
+    return counterValue;
+}
+
 void LayoutTestController::keepWebHistory()
 {
     if (![WebHistory optionalSharedHistory]) {
@@ -333,6 +347,11 @@ void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value
     [[WebPreferences standardPreferences] _setPreferenceForTestWithValue:valueNS forKey:keyNS];
 }
 
+void LayoutTestController::removeAllVisitedLinks()
+{
+    [WebHistory _removeAllVisitedLinks];
+}
+
 void LayoutTestController::setPersistentUserStyleSheetLocation(JSStringRef jsURL)
 {
     RetainPtr<CFStringRef> urlString(AdoptCF, JSStringCopyCFString(0, jsURL));
@@ -482,24 +501,26 @@ void LayoutTestController::addUserScript(JSStringRef source, bool runAtStart)
 {
     RetainPtr<CFStringRef> sourceCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, source));
     NSString *sourceNS = (NSString *)sourceCF.get();
-    [WebView _addUserScriptToGroup:@"org.webkit.DumpRenderTree" source:sourceNS url:nil worldID:1 whitelist:nil blacklist:nil injectionTime:(runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd)];
+    [WebView _addUserScriptToGroup:@"org.webkit.DumpRenderTree" worldID:1 source:sourceNS url:nil whitelist:nil blacklist:nil injectionTime:(runAtStart ? WebInjectAtDocumentStart : WebInjectAtDocumentEnd)];
 }
 
 void LayoutTestController::addUserStyleSheet(JSStringRef source)
 {
     RetainPtr<CFStringRef> sourceCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, source));
     NSString *sourceNS = (NSString *)sourceCF.get();
-    [WebView _addUserStyleSheetToGroup:@"org.webkit.DumpRenderTree" source:sourceNS url:nil worldID:1 whitelist:nil blacklist:nil];
+    [WebView _addUserStyleSheetToGroup:@"org.webkit.DumpRenderTree" worldID:1 source:sourceNS url:nil whitelist:nil blacklist:nil];
 }
 
 void LayoutTestController::showWebInspector()
 {
+    [[[mainFrame webView] preferences] setDeveloperExtrasEnabled:true];
     [[[mainFrame webView] inspector] show:nil];
 }
 
 void LayoutTestController::closeWebInspector()
 {
     [[[mainFrame webView] inspector] close:nil];
+    [[[mainFrame webView] preferences] setDeveloperExtrasEnabled:false];
 }
 
 void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
@@ -508,3 +529,10 @@ void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef scrip
     NSString *scriptNS = (NSString *)scriptCF.get();
     [[[mainFrame webView] inspector] evaluateInFrontend:nil callId:callId script:scriptNS];
 }
+
+void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldID, JSObjectRef globalObject, JSStringRef script)
+{
+    RetainPtr<CFStringRef> scriptCF(AdoptCF, JSStringCopyCFString(kCFAllocatorDefault, script));
+    NSString *scriptNS = (NSString *)scriptCF.get();
+    [mainFrame _stringByEvaluatingJavaScriptInIsolatedWorld:worldID WithGlobalObject:globalObject FromString:scriptNS];
+}
diff --git a/WebKitTools/DumpRenderTree/mac/UIDelegate.mm b/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
index a52d5be..393899e 100644
--- a/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
+++ b/WebKitTools/DumpRenderTree/mac/UIDelegate.mm
@@ -157,6 +157,11 @@ DumpRenderTreeDraggingInfo *draggingInfo = nil;
         [geolocation setIsAllowed:gLayoutTestController->geolocationPermission()];
 }
 
+- (BOOL)webView:(WebView *)sender shouldHaltPlugin:(DOMNode *)pluginNode
+{
+    return NO;
+}
+
 - (void)dealloc
 {
     [draggingInfo release];
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
index 83626ac..9faa37f 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.cpp
@@ -30,6 +30,9 @@
  */
 
 #include "DumpRenderTree.h"
+#include "EventSenderQt.h"
+#include "LayoutTestControllerQt.h"
+#include "TextInputControllerQt.h"
 #include "jsobjects.h"
 #include "testplugin.h"
 #include "WorkQueue.h"
@@ -65,6 +68,7 @@ extern void qt_dump_set_accepts_editing(bool b);
 extern void qt_dump_frame_loader(bool b);
 extern void qt_drt_clearFrameName(QWebFrame* qFrame);
 extern void qt_drt_overwritePluginDirectories();
+extern void qt_drt_resetOriginAccessWhiteLists();
 
 namespace WebCore {
 
@@ -285,9 +289,10 @@ void DumpRenderTree::resetToConsistentStateBeforeTesting()
     //WorkQueue::shared()->setFrozen(false);
 
     m_controller->reset();
-    QWebSecurityOrigin::resetOriginAccessWhiteLists();
+    qt_drt_resetOriginAccessWhiteLists();
 
-    setlocale(LC_ALL, "");
+    QLocale qlocale;
+    QLocale::setDefault(qlocale); 
 }
 
 void DumpRenderTree::open(const QUrl& aurl)
@@ -312,7 +317,7 @@ void DumpRenderTree::open(const QUrl& aurl)
     int width = isW3CTest ? 480 : maxViewWidth;
     int height = isW3CTest ? 360 : maxViewHeight;
     m_page->view()->resize(QSize(width, height));
-    m_page->setFixedContentsSize(QSize());
+    m_page->setPreferredContentsSize(QSize());
     m_page->setViewportSize(QSize(width, height));
 
     QFocusEvent ev(QEvent::FocusIn);
@@ -591,7 +596,8 @@ void DumpRenderTree::initializeFonts()
         exit(1);
     }
     char currentPath[PATH_MAX+1];
-    getcwd(currentPath, PATH_MAX);
+    if (!getcwd(currentPath, PATH_MAX))
+        qFatal("Couldn't get current working directory");
     QByteArray configFile = currentPath;
     FcConfig *config = FcConfigCreate();
     configFile += "/WebKitTools/DumpRenderTree/qt/fonts.conf";
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
index 0daf8bd..571313c 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -12,8 +12,23 @@ PKGCONFIG += fontconfig
 QT = core gui network
 macx: QT += xml
 
-HEADERS = WorkQueue.h WorkQueueItem.h DumpRenderTree.h jsobjects.h testplugin.h
-SOURCES = WorkQueue.cpp DumpRenderTree.cpp main.cpp jsobjects.cpp testplugin.cpp
+HEADERS = WorkQueue.h \
+    WorkQueueItem.h \
+    DumpRenderTree.h \
+    EventSenderQt.h \
+    TextInputControllerQt.h \
+    LayoutTestControllerQt.h \
+    jsobjects.h \
+    testplugin.h
+SOURCES = WorkQueue.cpp \
+    DumpRenderTree.cpp \
+    EventSenderQt.cpp \
+    TextInputControllerQt.cpp \
+    WorkQueueItemQt.cpp \
+    LayoutTestControllerQt.cpp \
+    main.cpp \
+    jsobjects.cpp \
+    testplugin.cpp
 
 unix:!mac {
     QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
diff --git a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
new file mode 100644
index 0000000..bbefed9
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
@@ -0,0 +1,260 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "EventSenderQt.h"
+
+//#include <QtDebug>
+EventSender::EventSender(QWebPage* parent)
+    : QObject(parent)
+{
+    m_page = parent;
+}
+
+void EventSender::mouseDown(int button)
+{
+    Qt::MouseButton mouseButton;
+    switch (button) {
+    case 0:
+        mouseButton = Qt::LeftButton;
+        break;
+    case 1:
+        mouseButton = Qt::MidButton;
+        break;
+    case 2:
+        mouseButton = Qt::RightButton;
+        break;
+    case 3:
+        // fast/events/mouse-click-events expects the 4th button to be treated as the middle button
+        mouseButton = Qt::MidButton;
+        break;
+    default:
+        mouseButton = Qt::LeftButton;
+        break;
+    }
+
+//     qDebug() << "EventSender::mouseDown" << frame;
+    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, mouseButton, mouseButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event);
+}
+
+void EventSender::mouseUp(int button)
+{
+    Qt::MouseButton mouseButton;
+    switch (button) {
+    case 0:
+        mouseButton = Qt::LeftButton;
+        break;
+    case 1:
+        mouseButton = Qt::MidButton;
+        break;
+    case 2:
+        mouseButton = Qt::RightButton;
+        break;
+    case 3:
+        // fast/events/mouse-click-events expects the 4th button to be treated as the middle button
+        mouseButton = Qt::MidButton;
+        break;
+    default:
+        mouseButton = Qt::LeftButton;
+        break;
+    }
+
+//     qDebug() << "EventSender::mouseUp" << frame;
+    QMouseEvent event(QEvent::MouseButtonRelease, m_mousePos, mouseButton, mouseButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event);
+}
+
+void EventSender::mouseMoveTo(int x, int y)
+{
+//     qDebug() << "EventSender::mouseMoveTo" << x << y;
+    m_mousePos = QPoint(x, y);
+    QMouseEvent event(QEvent::MouseMove, m_mousePos, Qt::NoButton, Qt::NoButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event);
+}
+
+void EventSender::leapForward(int ms)
+{
+    m_timeLeap += ms;
+    //qDebug() << "EventSender::leapForward" << ms;
+}
+
+void EventSender::keyDown(const QString& string, const QStringList& modifiers)
+{
+    QString s = string;
+    Qt::KeyboardModifiers modifs = 0;
+    for (int i = 0; i < modifiers.size(); ++i) {
+        const QString& m = modifiers.at(i);
+        if (m == "ctrlKey")
+            modifs |= Qt::ControlModifier;
+        else if (m == "shiftKey")
+            modifs |= Qt::ShiftModifier;
+        else if (m == "altKey")
+            modifs |= Qt::AltModifier;
+        else if (m == "metaKey")
+            modifs |= Qt::MetaModifier;
+    }
+    int code = 0;
+    if (string.length() == 1) {
+        code = string.unicode()->unicode();
+        //qDebug() << ">>>>>>>>> keyDown" << code << (char)code;
+        // map special keycodes used by the tests to something that works for Qt/X11
+        if (code == '\t') {
+            code = Qt::Key_Tab;
+            if (modifs == Qt::ShiftModifier)
+                code = Qt::Key_Backtab;
+            s = QString();
+        } else if (code == 127) {
+            code = Qt::Key_Backspace;
+            if (modifs == Qt::AltModifier)
+                modifs = Qt::ControlModifier;
+            s = QString();
+        } else if (code == 'o' && modifs == Qt::ControlModifier) {
+            s = QLatin1String("\n");
+            code = '\n';
+            modifs = 0;
+        } else if (code == 'y' && modifs == Qt::ControlModifier) {
+            s = QLatin1String("c");
+            code = 'c';
+        } else if (code == 'k' && modifs == Qt::ControlModifier) {
+            s = QLatin1String("x");
+            code = 'x';
+        } else if (code == 'a' && modifs == Qt::ControlModifier) {
+            s = QString();
+            code = Qt::Key_Home;
+            modifs = 0;
+        } else if (code == 0xf702) {
+            s = QString();
+            code = Qt::Key_Left;
+            if (modifs & Qt::MetaModifier) {
+                code = Qt::Key_Home;
+                modifs &= ~Qt::MetaModifier;
+            }
+        } else if (code == 0xf703) {
+            s = QString();
+            code = Qt::Key_Right;
+            if (modifs & Qt::MetaModifier) {
+                code = Qt::Key_End;
+                modifs &= ~Qt::MetaModifier;
+            }
+        } else if (code == 0xf700) {
+            s = QString();
+            code = Qt::Key_Up;
+            if (modifs & Qt::MetaModifier) {
+                code = Qt::Key_PageUp;
+                modifs &= ~Qt::MetaModifier;
+            }
+        } else if (code == 0xf701) {
+            s = QString();
+            code = Qt::Key_Down;
+            if (modifs & Qt::MetaModifier) {
+                code = Qt::Key_PageDown;
+                modifs &= ~Qt::MetaModifier;
+            }
+        } else if (code == 'a' && modifs == Qt::ControlModifier) {
+            s = QString();
+            code = Qt::Key_Home;
+            modifs = 0;
+        } else
+            code = string.unicode()->toUpper().unicode();
+    } else {
+        //qDebug() << ">>>>>>>>> keyDown" << string;
+
+        if (string.startsWith(QLatin1Char('F')) && string.count() <= 3) {
+            s = s.mid(1);
+            int functionKey = s.toInt();
+            Q_ASSERT(functionKey >= 1 && functionKey <= 35);
+            code = Qt::Key_F1 + (functionKey - 1);
+        // map special keycode strings used by the tests to something that works for Qt/X11
+        } else if (string == QLatin1String("leftArrow")) {
+            s = QString();
+            code = Qt::Key_Left;
+        } else if (string == QLatin1String("rightArrow")) {
+            s = QString();
+            code = Qt::Key_Right;
+        } else if (string == QLatin1String("upArrow")) {
+            s = QString();
+            code = Qt::Key_Up;
+        } else if (string == QLatin1String("downArrow")) {
+            s = QString();
+            code = Qt::Key_Down;
+        } else if (string == QLatin1String("pageUp")) {
+            s = QString();
+            code = Qt::Key_PageUp;
+        } else if (string == QLatin1String("pageDown")) {
+            s = QString();
+            code = Qt::Key_PageDown;
+        } else if (string == QLatin1String("home")) {
+            s = QString();
+            code = Qt::Key_Home;
+        } else if (string == QLatin1String("end")) {
+            s = QString();
+            code = Qt::Key_End;
+        } else if (string == QLatin1String("delete")) {
+            s = QString();
+            code = Qt::Key_Delete;
+        }
+    }
+    QKeyEvent event(QEvent::KeyPress, code, modifs, s);
+    QApplication::sendEvent(m_page, &event);
+    QKeyEvent event2(QEvent::KeyRelease, code, modifs, s);
+    QApplication::sendEvent(m_page, &event2);
+}
+
+void EventSender::contextClick()
+{
+    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, Qt::RightButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event);
+    QMouseEvent event2(QEvent::MouseButtonRelease, m_mousePos, Qt::RightButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::sendEvent(m_page, &event2);
+}
+
+void EventSender::scheduleAsynchronousClick()
+{
+    QMouseEvent* event = new QMouseEvent(QEvent::MouseButtonPress, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::postEvent(m_page, event);
+    QMouseEvent* event2 = new QMouseEvent(QEvent::MouseButtonRelease, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
+    QApplication::postEvent(m_page, event2);
+}
+
+QWebFrame* EventSender::frameUnderMouse() const
+{
+    QWebFrame* frame = m_page->mainFrame();
+
+redo:
+    QList<QWebFrame*> children = frame->childFrames();
+    for (int i = 0; i < children.size(); ++i) {
+        if (children.at(i)->geometry().contains(m_mousePos)) {
+            frame = children.at(i);
+            goto redo;
+        }
+    }
+    if (frame->geometry().contains(m_mousePos))
+        return frame;
+    return 0;
+}
diff --git a/WebKitTools/DumpRenderTree/qt/EventSenderQt.h b/WebKitTools/DumpRenderTree/qt/EventSenderQt.h
new file mode 100644
index 0000000..fd74455
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/EventSenderQt.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef EventSenderQt_h
+#define EventSenderQt_h
+
+#include <QApplication>
+#include <QEvent>
+#include <QMouseEvent>
+#include <QObject>
+#include <QPoint>
+#include <QString>
+#include <QStringList>
+
+#include <qwebpage.h>
+#include <qwebframe.h>
+
+class EventSender : public QObject {
+    Q_OBJECT
+public:
+    EventSender(QWebPage* parent);
+
+public slots:
+    void mouseDown(int button = 0);
+    void mouseUp(int button = 0);
+    void mouseMoveTo(int x, int y);
+    void leapForward(int ms);
+    void keyDown(const QString& string, const QStringList& modifiers = QStringList());
+    void clearKillRing() {}
+    void contextClick();
+    void scheduleAsynchronousClick();
+
+private:
+    QPoint m_mousePos;
+    QWebPage* m_page;
+    int m_timeLeap;
+    QWebFrame* frameUnderMouse() const;
+};
+#endif //  EventSenderQt_h
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
new file mode 100644
index 0000000..b8de6a5
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "LayoutTestControllerQt.h"
+
+#include "DumpRenderTree.h"
+#include "WorkQueue.h"
+#include "WorkQueueItem.h"
+
+extern void qt_dump_editing_callbacks(bool b);
+extern void qt_dump_resource_load_callbacks(bool b);
+extern void qt_drt_setJavaScriptProfilingEnabled(QWebFrame*, bool enabled);
+extern bool qt_drt_pauseAnimation(QWebFrame*, const QString& name, double time, const QString& elementId);
+extern bool qt_drt_pauseTransitionOfProperty(QWebFrame*, const QString& name, double time, const QString& elementId);
+extern int qt_drt_numberOfActiveAnimations(QWebFrame*);
+extern void qt_drt_whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
+extern QString qt_drt_counterValueForElementById(QWebFrame* qFrame, const QString& id);
+
+LayoutTestController::LayoutTestController(WebCore::DumpRenderTree* drt)
+    : QObject()
+    , m_drt(drt)
+{
+    reset();
+}
+
+void LayoutTestController::reset()
+{
+    m_isLoading = true;
+    m_textDump = false;
+    m_dumpBackForwardList = false;
+    m_dumpChildrenAsText = false;
+    m_canOpenWindows = false;
+    m_waitForDone = false;
+    m_dumpTitleChanges = false;
+    m_dumpDatabaseCallbacks = false;
+    m_dumpStatusCallbacks = false;
+    m_timeoutTimer.stop();
+    m_topLoadingFrame = 0;
+    m_waitForPolicy = false;
+    qt_dump_editing_callbacks(false);
+    qt_dump_resource_load_callbacks(false);
+}
+
+void LayoutTestController::processWork()
+{
+    // qDebug() << ">>>processWork";
+
+    // if we didn't start a new load, then we finished all the commands, so we're ready to dump state
+    if (!WorkQueue::shared()->processWork() && !shouldWaitUntilDone()) {
+        emit done();
+        m_isLoading = false;
+    }
+}
+
+// Called on loadFinished on mainFrame.
+void LayoutTestController::maybeDump(bool success)
+{
+    Q_ASSERT(sender() == m_topLoadingFrame);
+
+    // as the function is called on loadFinished, the test might
+    // already have dumped and thus no longer be active, thus
+    // bail out here.
+    if (!m_isLoading)
+        return;
+
+    m_topLoadingFrame = 0;
+    WorkQueue::shared()->setFrozen(true); // first complete load freezes the queue for the rest of this test
+
+    if (!shouldWaitUntilDone()) {
+        if (WorkQueue::shared()->count())
+            QTimer::singleShot(0, this, SLOT(processWork()));
+        else {
+            if (success)
+                emit done();
+            m_isLoading = false;
+        }
+    }
+}
+
+void LayoutTestController::waitUntilDone()
+{
+    //qDebug() << ">>>>waitForDone";
+    m_waitForDone = true;
+    m_timeoutTimer.start(11000, this);
+}
+
+QString LayoutTestController::counterValueForElementById(const QString& id)
+{
+    return qt_drt_counterValueForElementById(m_drt->webPage()->mainFrame(), id);
+}
+
+void LayoutTestController::keepWebHistory()
+{
+    // FIXME: implement
+}
+
+void LayoutTestController::notifyDone()
+{
+    qDebug() << ">>>>notifyDone";
+    if (!m_timeoutTimer.isActive())
+        return;
+    m_timeoutTimer.stop();
+    emit done();
+    m_isLoading = false;
+    m_waitForDone = false;
+    m_waitForPolicy = false;
+}
+
+int LayoutTestController::windowCount()
+{
+    return m_drt->windowCount();
+}
+
+void LayoutTestController::clearBackForwardList()
+{
+    m_drt->webPage()->history()->clear();
+}
+
+void LayoutTestController::dumpEditingCallbacks()
+{
+    qDebug() << ">>>dumpEditingCallbacks";
+    qt_dump_editing_callbacks(true);
+}
+
+void LayoutTestController::dumpResourceLoadCallbacks()
+{
+    qt_dump_resource_load_callbacks(true);
+}
+
+void LayoutTestController::queueBackNavigation(int howFarBackward)
+{
+    //qDebug() << ">>>queueBackNavigation" << howFarBackward;
+    WorkQueue::shared()->queue(new BackItem(howFarBackward, m_drt->webPage()));
+}
+
+void LayoutTestController::queueForwardNavigation(int howFarForward)
+{
+    //qDebug() << ">>>queueForwardNavigation" << howFarForward;
+    WorkQueue::shared()->queue(new ForwardItem(howFarForward, m_drt->webPage()));
+}
+
+void LayoutTestController::queueLoad(const QString& url, const QString& target)
+{
+    //qDebug() << ">>>queueLoad" << url << target;
+    QUrl mainResourceUrl = m_drt->webPage()->mainFrame()->url();
+    QString absoluteUrl = mainResourceUrl.resolved(QUrl(url)).toEncoded();
+    WorkQueue::shared()->queue(new LoadItem(absoluteUrl, target, m_drt->webPage()));
+}
+
+void LayoutTestController::queueReload()
+{
+    //qDebug() << ">>>queueReload";
+    WorkQueue::shared()->queue(new ReloadItem(m_drt->webPage()));
+}
+
+void LayoutTestController::queueScript(const QString &url)
+{
+    //qDebug() << ">>>queueScript" << url;
+    WorkQueue::shared()->queue(new ScriptItem(url, m_drt->webPage()));
+}
+
+void LayoutTestController::provisionalLoad()
+{
+    QWebFrame* frame = qobject_cast<QWebFrame*>(sender());
+    if (!m_topLoadingFrame && m_isLoading)
+        m_topLoadingFrame = frame;
+}
+
+void LayoutTestController::timerEvent(QTimerEvent *ev)
+{
+    if (ev->timerId() == m_timeoutTimer.timerId()) {
+        //qDebug() << ">>>>>>>>>>>>> timeout";
+        notifyDone();
+    } else
+        QObject::timerEvent(ev);
+}
+
+QString LayoutTestController::encodeHostName(const QString& host)
+{
+    QString encoded = QString::fromLatin1(QUrl::toAce(host + QLatin1String(".no")));
+    encoded.truncate(encoded.length() - 3); // strip .no
+    return encoded;
+}
+
+QString LayoutTestController::decodeHostName(const QString& host)
+{
+    QString decoded = QUrl::fromAce(host.toLatin1() + QByteArray(".no"));
+    decoded.truncate(decoded.length() - 3);
+    return decoded;
+}
+
+void LayoutTestController::setJavaScriptProfilingEnabled(bool enable)
+{
+    m_topLoadingFrame->page()->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
+    qt_drt_setJavaScriptProfilingEnabled(m_topLoadingFrame, enable);
+}
+
+void LayoutTestController::setFixedContentsSize(int width, int height)
+{
+    m_topLoadingFrame->page()->setPreferredContentsSize(QSize(width, height));
+}
+
+void LayoutTestController::setPrivateBrowsingEnabled(bool enable)
+{
+    m_drt->webPage()->settings()->setAttribute(QWebSettings::PrivateBrowsingEnabled, enable);
+}
+
+void LayoutTestController::setPopupBlockingEnabled(bool enable)
+{
+    m_drt->webPage()->settings()->setAttribute(QWebSettings::JavascriptCanOpenWindows, !enable);
+}
+
+void LayoutTestController::setPOSIXLocale(const QString& locale)
+{
+    QLocale qlocale(locale);
+    QLocale::setDefault(qlocale);
+} 
+
+bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(const QString& animationName,
+                                                               double time,
+                                                               const QString& elementId)
+{
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
+    Q_ASSERT(frame);
+    return qt_drt_pauseAnimation(frame, animationName, time, elementId);
+}
+
+bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(const QString& propertyName,
+                                                                double time,
+                                                                const QString& elementId)
+{
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
+    Q_ASSERT(frame);
+    return qt_drt_pauseTransitionOfProperty(frame, propertyName, time, elementId);
+}
+
+unsigned LayoutTestController::numberOfActiveAnimations() const
+{
+    QWebFrame* frame = m_drt->webPage()->mainFrame();
+    Q_ASSERT(frame);
+    return qt_drt_numberOfActiveAnimations(frame);
+}
+
+void LayoutTestController::disableImageLoading()
+{
+    // FIXME: Implement for testing fix for https://bugs.webkit.org/show_bug.cgi?id=27896
+    // Also need to make sure image loading is re-enabled for each new test.
+}
+
+void LayoutTestController::dispatchPendingLoadRequests()
+{
+    // FIXME: Implement for testing fix for 6727495
+}
+
+void LayoutTestController::setDatabaseQuota(int size)
+{
+    if (!m_topLoadingFrame)
+        return;
+    m_topLoadingFrame->securityOrigin().setDatabaseQuota(size);
+}
+
+void LayoutTestController::clearAllDatabases()
+{
+    QWebDatabase::removeAllDatabases();
+}
+
+void LayoutTestController::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
+{
+    qt_drt_whiteListAccessFromOrigin(sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains);
+}
+
+void LayoutTestController::waitForPolicyDelegate()
+{
+    m_waitForPolicy = true;
+    waitUntilDone();
+}
+
+void LayoutTestController::overridePreference(const QString& name, const QVariant& value)
+{
+    QWebSettings* settings = m_topLoadingFrame->page()->settings();
+
+    if (name == "WebKitJavaScriptEnabled")
+        settings->setAttribute(QWebSettings::JavascriptEnabled, value.toBool());
+    else if (name == "WebKitTabToLinksPreferenceKey")
+        settings->setAttribute(QWebSettings::LinksIncludedInFocusChain, value.toBool());
+    else if (name == "WebKitOfflineWebApplicationCacheEnabled")
+        settings->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, value.toBool());
+    else if (name == "WebKitDefaultFontSize")
+        settings->setFontSize(QWebSettings::DefaultFontSize, value.toInt());
+}
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
new file mode 100644
index 0000000..cab014c
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayoutTestControllerQt_h
+#define LayoutTestControllerQt_h
+
+#include <QBasicTimer>
+#include <QObject>
+#include <QSize>
+#include <QString>
+#include <QtDebug>
+#include <QTimer>
+#include <QTimerEvent>
+#include <QVariant>
+
+#include <qwebdatabase.h>
+#include <qwebframe.h>
+#include <qwebhistory.h>
+#include <qwebpage.h>
+#include <qwebsecurityorigin.h>
+
+class QWebFrame;
+namespace WebCore {
+    class DumpRenderTree;
+}
+class LayoutTestController : public QObject {
+    Q_OBJECT
+public:
+    LayoutTestController(WebCore::DumpRenderTree* drt);
+
+    bool isLoading() const { return m_isLoading; }
+    void setLoading(bool loading) { m_isLoading = loading; }
+
+    bool shouldDumpAsText() const { return m_textDump; }
+    bool shouldDumpBackForwardList() const { return m_dumpBackForwardList; }
+    bool shouldDumpChildrenAsText() const { return m_dumpChildrenAsText; }
+    bool shouldDumpDatabaseCallbacks() const { return m_dumpDatabaseCallbacks; }
+    bool shouldDumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
+    bool shouldWaitUntilDone() const { return m_waitForDone; }
+    bool canOpenWindows() const { return m_canOpenWindows; }
+    bool shouldDumpTitleChanges() const { return m_dumpTitleChanges; }
+    bool waitForPolicy() const { return m_waitForPolicy; }
+
+    void reset();
+
+protected:
+    void timerEvent(QTimerEvent*);
+
+signals:
+    void done();
+
+public slots:
+    void maybeDump(bool ok);
+    void dumpAsText() { m_textDump = true; }
+    void dumpChildFramesAsText() { m_dumpChildrenAsText = true; }
+    void dumpDatabaseCallbacks() { m_dumpDatabaseCallbacks = true; }
+    void dumpStatusCallbacks() { m_dumpStatusCallbacks = true; }
+    void setCanOpenWindows() { m_canOpenWindows = true; }
+    void waitUntilDone();
+    QString counterValueForElementById(const QString& id);
+    void keepWebHistory();
+    void notifyDone();
+    void dumpBackForwardList() { m_dumpBackForwardList = true; }
+    void dumpEditingCallbacks();
+    void dumpResourceLoadCallbacks();
+    void queueBackNavigation(int howFarBackward);
+    void queueForwardNavigation(int howFarForward);
+    void queueLoad(const QString& url, const QString& target = QString());
+    void queueReload();
+    void queueScript(const QString& url);
+    void provisionalLoad();
+    void setCloseRemainingWindowsWhenComplete(bool = false) {}
+    int windowCount();
+    void display() {}
+    void clearBackForwardList();
+    void dumpTitleChanges() { m_dumpTitleChanges = true; }
+    QString encodeHostName(const QString& host);
+    QString decodeHostName(const QString& host);
+    void dumpSelectionRect() const {}
+    void setJavaScriptProfilingEnabled(bool enable);
+    void setFixedContentsSize(int width, int height);
+    void setPrivateBrowsingEnabled(bool enable);
+    void setPopupBlockingEnabled(bool enable);
+    void setPOSIXLocale(const QString& locale);
+
+    bool pauseAnimationAtTimeOnElementWithId(const QString& animationName, double time, const QString& elementId);
+    bool pauseTransitionAtTimeOnElementWithId(const QString& propertyName, double time, const QString& elementId);
+    unsigned numberOfActiveAnimations() const;
+
+    void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
+
+    void dispatchPendingLoadRequests();
+    void disableImageLoading();
+
+    void setDatabaseQuota(int size);
+    void clearAllDatabases();
+
+    void waitForPolicyDelegate();
+    void overridePreference(const QString& name, const QVariant& value);
+
+private slots:
+    void processWork();
+
+private:
+    bool m_isLoading;
+    bool m_textDump;
+    bool m_dumpBackForwardList;
+    bool m_dumpChildrenAsText;
+    bool m_canOpenWindows;
+    bool m_waitForDone;
+    bool m_dumpTitleChanges;
+    bool m_dumpDatabaseCallbacks;
+    bool m_dumpStatusCallbacks;
+    bool m_waitForPolicy;
+
+    QBasicTimer m_timeoutTimer;
+    QWebFrame* m_topLoadingFrame;
+    WebCore::DumpRenderTree* m_drt;
+};
+
+#endif // LayoutTestControllerQt_h
diff --git a/WebKitTools/DumpRenderTree/qt/TextInputControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/TextInputControllerQt.cpp
new file mode 100644
index 0000000..7b8f120
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/TextInputControllerQt.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "TextInputControllerQt.h"
+
+#include <QApplication>
+#include <QKeyEvent>
+
+TextInputController::TextInputController(QWebPage* parent)
+    : QObject(parent)
+{
+}
+
+void TextInputController::doCommand(const QString& command)
+{
+    Qt::KeyboardModifiers modifiers = Qt::NoModifier;
+    int keycode = 0;
+    if (command == "moveBackwardAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Left;
+    } else if (command =="moveDown:") {
+        keycode = Qt::Key_Down;
+    } else if (command =="moveDownAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Down;
+    } else if (command =="moveForward:") {
+        keycode = Qt::Key_Right;
+    } else if (command =="moveForwardAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Right;
+    } else if (command =="moveLeft:") {
+        keycode = Qt::Key_Left;
+    } else if (command =="moveLeftAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Left;
+    } else if (command =="moveRight:") {
+        keycode = Qt::Key_Right;
+    } else if (command =="moveRightAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Right;
+    } else if (command =="moveToBeginningOfDocument:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Home;
+    } else if (command =="moveToBeginningOfLine:") {
+        keycode = Qt::Key_Home;
+//     } else if (command =="moveToBeginningOfParagraph:") {
+    } else if (command =="moveToEndOfDocument:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_End;
+    } else if (command =="moveToEndOfLine:") {
+        keycode = Qt::Key_End;
+//     } else if (command =="moveToEndOfParagraph:") {
+    } else if (command =="moveUp:") {
+        keycode = Qt::Key_Up;
+    } else if (command =="moveUpAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Up;
+    } else if (command =="moveWordBackward:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Up;
+    } else if (command =="moveWordBackwardAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Left;
+    } else if (command =="moveWordForward:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Right;
+    } else if (command =="moveWordForwardAndModifySelection:") {
+        modifiers |= Qt::ControlModifier;
+        modifiers |= Qt::ShiftModifier;
+        keycode = Qt::Key_Right;
+    } else if (command =="moveWordLeft:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Left;
+    } else if (command =="moveWordRight:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Left;
+    } else if (command =="moveWordRightAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Right;
+    } else if (command =="moveWordLeftAndModifySelection:") {
+        modifiers |= Qt::ShiftModifier;
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Left;
+    } else if (command =="pageDown:") {
+        keycode = Qt::Key_PageDown;
+    } else if (command =="pageUp:") {
+        keycode = Qt::Key_PageUp;
+    } else if (command == "deleteWordBackward:") {
+        modifiers |= Qt::ControlModifier;
+        keycode = Qt::Key_Backspace;
+    } else if (command == "deleteBackward:") {
+        keycode = Qt::Key_Backspace;
+    } else if (command == "deleteForward:") {
+        keycode = Qt::Key_Delete;
+    }
+
+    QKeyEvent event(QEvent::KeyPress, keycode, modifiers);
+    QApplication::sendEvent(parent(), &event);
+    QKeyEvent event2(QEvent::KeyRelease, keycode, modifiers);
+    QApplication::sendEvent(parent(), &event2);
+}
diff --git a/WebKitTools/DumpRenderTree/qt/TextInputControllerQt.h b/WebKitTools/DumpRenderTree/qt/TextInputControllerQt.h
new file mode 100644
index 0000000..7c7433e
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/TextInputControllerQt.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef TextInputControllerQt_h
+#define TextInputControllerQt_h
+
+#include <QList>
+#include <QObject>
+#include <QString>
+#include "qwebpage.h"
+
+class TextInputController : public QObject {
+    Q_OBJECT
+public:
+    TextInputController(QWebPage* parent);
+
+public slots:
+    void doCommand(const QString& command);
+//     void setMarkedText(const QString& str, int from, int length);
+//     bool hasMarkedText();
+//     void unmarkText();
+//     QList<int> markedRange();
+//     QList<int> selectedRange();
+//     void validAttributesForMarkedText();
+//     void inserText(const QString&);
+//     void firstRectForCharacterRange();
+//     void characterIndexForPoint(int, int);
+//     void substringFromRange(int, int);
+//     void conversationIdentifier();
+};
+#endif // TextInputControllerQt_h
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp b/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp
index ae24e0d..f8448e4 100644
--- a/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp
+++ b/WebKitTools/DumpRenderTree/qt/WorkQueue.cpp
@@ -30,8 +30,6 @@
 #include "config.h"
 #include "WorkQueue.h"
 
-#include "WorkQueueItem.h"
-
 static const unsigned queueLength = 1024;
 
 static WorkQueueItem* theQueue[queueLength];
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueue.h b/WebKitTools/DumpRenderTree/qt/WorkQueue.h
index 8adbfcd..902ba0d 100644
--- a/WebKitTools/DumpRenderTree/qt/WorkQueue.h
+++ b/WebKitTools/DumpRenderTree/qt/WorkQueue.h
@@ -30,7 +30,7 @@
 #ifndef WorkQueue_h
 #define WorkQueue_h
 
-class WorkQueueItem;
+#include "WorkQueueItem.h"
 
 class WorkQueue {
 public:
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h b/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h
index 0e10f62..9819ec0 100644
--- a/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h
+++ b/WebKitTools/DumpRenderTree/qt/WorkQueueItem.h
@@ -30,8 +30,9 @@
 #ifndef WorkQueueItem_h
 #define WorkQueueItem_h
 
-#include <qstring.h>
-#include <qpointer.h>
+#include <QPointer>
+#include <QString>
+#include <qwebframe.h>
 #include <qwebpage.h>
 
 class WorkQueueItem {
diff --git a/WebKitTools/DumpRenderTree/qt/WorkQueueItemQt.cpp b/WebKitTools/DumpRenderTree/qt/WorkQueueItemQt.cpp
new file mode 100644
index 0000000..807a6a4
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/WorkQueueItemQt.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "WorkQueueItem.h"
+
+QWebFrame* findFrameNamed(const QString& frameName, QWebFrame* frame)
+{
+    if (frame->frameName() == frameName)
+        return frame;
+
+    foreach (QWebFrame* childFrame, frame->childFrames())
+        if (QWebFrame* f = findFrameNamed(frameName, childFrame))
+            return f;
+
+    return 0;
+}
+
+bool LoadItem::invoke() const
+{
+    //qDebug() << ">>>LoadItem::invoke";
+    Q_ASSERT(m_webPage);
+
+    QWebFrame* frame = 0;
+    const QString t = target();
+    if (t.isEmpty())
+        frame = m_webPage->mainFrame();
+    else
+        frame = findFrameNamed(t, m_webPage->mainFrame());
+
+    if (!frame)
+        return false;
+
+    frame->load(url());
+    return true;
+}
+
+bool ReloadItem::invoke() const
+{
+    //qDebug() << ">>>ReloadItem::invoke";
+    Q_ASSERT(m_webPage);
+    m_webPage->triggerAction(QWebPage::Reload);
+    return true;
+}
+
+bool ScriptItem::invoke() const
+{
+    //qDebug() << ">>>ScriptItem::invoke";
+    Q_ASSERT(m_webPage);
+    m_webPage->mainFrame()->evaluateJavaScript(script());
+    return true;
+}
+
+bool BackForwardItem::invoke() const
+{
+    //qDebug() << ">>>BackForwardItem::invoke";
+    Q_ASSERT(m_webPage);
+    if (!m_howFar)
+        return false;
+
+    if (m_howFar > 0) {
+        for (int i = 0; i != m_howFar; ++i)
+            m_webPage->triggerAction(QWebPage::Forward);
+    } else {
+        for (int i = 0; i != m_howFar; --i)
+            m_webPage->triggerAction(QWebPage::Back);
+    }
+    return true;
+}
diff --git a/WebKitTools/DumpRenderTree/qt/jsobjects.cpp b/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
index b2d8528..e747aeb 100644
--- a/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
+++ b/WebKitTools/DumpRenderTree/qt/jsobjects.cpp
@@ -27,672 +27,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <jsobjects.h>
-
-#include "DumpRenderTree.h"
-#include "WorkQueue.h"
-#include "WorkQueueItem.h"
-
-#include <qapplication.h>
-#include <qevent.h>
-#include <qtimer.h>
-#include <qwebdatabase.h>
-#include <qwebframe.h>
-#include <qwebhistory.h>
 #include <qwebpage.h>
-#include <qwebsecurityorigin.h>
-
-extern void qt_dump_editing_callbacks(bool b);
-extern void qt_dump_resource_load_callbacks(bool b);
-extern void qt_drt_setJavaScriptProfilingEnabled(QWebFrame*, bool enabled);
-extern bool qt_drt_pauseAnimation(QWebFrame*, const QString &name, double time, const QString &elementId);
-extern bool qt_drt_pauseTransitionOfProperty(QWebFrame*, const QString &name, double time, const QString &elementId);
-extern int qt_drt_numberOfActiveAnimations(QWebFrame*);
-
-QWebFrame* findFrameNamed(const QString &frameName, QWebFrame* frame)
-{
-    if (frame->frameName() == frameName)
-        return frame;
-
-    foreach (QWebFrame *childFrame, frame->childFrames())
-        if (QWebFrame *f = findFrameNamed(frameName, childFrame))
-            return f;
-
-    return 0;
-}
-
-bool LoadItem::invoke() const
-{
-    //qDebug() << ">>>LoadItem::invoke";
-    Q_ASSERT(m_webPage);
-
-    QWebFrame* frame = 0;
-    const QString t = target();
-    if (t.isEmpty())
-        frame = m_webPage->mainFrame();
-    else
-        frame = findFrameNamed(t, m_webPage->mainFrame());
-
-    if (!frame)
-        return false;
-
-    frame->load(url());
-    return true;
-}
-
-bool ReloadItem::invoke() const
-{
-    //qDebug() << ">>>ReloadItem::invoke";
-    Q_ASSERT(m_webPage);
-    m_webPage->triggerAction(QWebPage::Reload);
-    return true;
-}
-
-bool ScriptItem::invoke() const
-{
-    //qDebug() << ">>>ScriptItem::invoke";
-    Q_ASSERT(m_webPage);
-    m_webPage->mainFrame()->evaluateJavaScript(script());
-    return true;
-}
-
-bool BackForwardItem::invoke() const
-{
-    //qDebug() << ">>>BackForwardItem::invoke";
-    Q_ASSERT(m_webPage);
-    if (!m_howFar)
-        return false;
-
-    if (m_howFar > 0) {
-        for (int i = 0; i != m_howFar; ++i)
-            m_webPage->triggerAction(QWebPage::Forward);
-    } else {
-        for (int i = 0; i != m_howFar; --i)
-            m_webPage->triggerAction(QWebPage::Back);
-    }
-    return true;
-}
-
-LayoutTestController::LayoutTestController(WebCore::DumpRenderTree *drt)
-    : QObject()
-    , m_drt(drt)
-{
-    reset();
-}
-
-void LayoutTestController::reset()
-{
-    m_isLoading = true;
-    m_textDump = false;
-    m_dumpBackForwardList = false;
-    m_dumpChildrenAsText = false;
-    m_canOpenWindows = false;
-    m_waitForDone = false;
-    m_dumpTitleChanges = false;
-    m_dumpDatabaseCallbacks = false;
-    m_dumpStatusCallbacks = false;
-    m_timeoutTimer.stop();
-    m_topLoadingFrame = 0;
-    m_waitForPolicy = false;
-    qt_dump_editing_callbacks(false);
-    qt_dump_resource_load_callbacks(false);
-}
-
-void LayoutTestController::processWork()
-{
-    qDebug() << ">>>processWork";
-
-    // if we didn't start a new load, then we finished all the commands, so we're ready to dump state
-    if (!WorkQueue::shared()->processWork() && !shouldWaitUntilDone()) {
-        emit done();
-        m_isLoading = false;
-    }
-}
-
-// Called on loadFinished on mainFrame.
-void LayoutTestController::maybeDump(bool success)
-{
-    Q_ASSERT(sender() == m_topLoadingFrame);
-
-    // as the function is called on loadFinished, the test might
-    // already have dumped and thus no longer be active, thus
-    // bail out here.
-    if (!m_isLoading)
-        return;
-
-    m_topLoadingFrame = 0;
-    WorkQueue::shared()->setFrozen(true); // first complete load freezes the queue for the rest of this test
-
-    if (!shouldWaitUntilDone()) {
-        if (WorkQueue::shared()->count())
-            QTimer::singleShot(0, this, SLOT(processWork()));
-        else {
-            if (success)
-                emit done();
-            m_isLoading = false;
-        }
-    }
-}
-
-void LayoutTestController::waitUntilDone()
-{
-    //qDebug() << ">>>>waitForDone";
-    m_waitForDone = true;
-    m_timeoutTimer.start(11000, this);
-}
-
-void LayoutTestController::notifyDone()
-{
-    //qDebug() << ">>>>notifyDone";
-    if (!m_timeoutTimer.isActive())
-        return;
-    m_timeoutTimer.stop();
-    emit done();
-    m_isLoading = false;
-    m_waitForDone = false;
-    m_waitForPolicy = false;
-}
-
-int LayoutTestController::windowCount()
-{
-    return m_drt->windowCount();
-}
-
-void LayoutTestController::clearBackForwardList()
-{
-    m_drt->webPage()->history()->clear();
-}
-
-void LayoutTestController::dumpEditingCallbacks()
-{
-    qDebug() << ">>>dumpEditingCallbacks";
-    qt_dump_editing_callbacks(true);
-}
-
-void LayoutTestController::dumpResourceLoadCallbacks()
-{
-    qt_dump_resource_load_callbacks(true);
-}
-
-void LayoutTestController::queueBackNavigation(int howFarBackward)
-{
-    //qDebug() << ">>>queueBackNavigation" << howFarBackward;
-    WorkQueue::shared()->queue(new BackItem(howFarBackward, m_drt->webPage()));
-}
-
-void LayoutTestController::queueForwardNavigation(int howFarForward)
-{
-    //qDebug() << ">>>queueForwardNavigation" << howFarForward;
-    WorkQueue::shared()->queue(new ForwardItem(howFarForward, m_drt->webPage()));
-}
-
-void LayoutTestController::queueLoad(const QString &url, const QString &target)
-{
-    //qDebug() << ">>>queueLoad" << url << target;
-    QUrl mainResourceUrl = m_drt->webPage()->mainFrame()->url();
-    QString absoluteUrl = mainResourceUrl.resolved(QUrl(url)).toEncoded();
-    WorkQueue::shared()->queue(new LoadItem(absoluteUrl, target, m_drt->webPage()));
-}
-
-void LayoutTestController::queueReload()
-{
-    //qDebug() << ">>>queueReload";
-    WorkQueue::shared()->queue(new ReloadItem(m_drt->webPage()));
-}
-
-void LayoutTestController::queueScript(const QString &url)
-{
-    //qDebug() << ">>>queueScript" << url;
-    WorkQueue::shared()->queue(new ScriptItem(url, m_drt->webPage()));
-}
-
-void LayoutTestController::provisionalLoad()
-{
-    QWebFrame* frame = qobject_cast<QWebFrame*>(sender());
-    if (!m_topLoadingFrame && m_isLoading)
-        m_topLoadingFrame = frame;
-}
-
-void LayoutTestController::timerEvent(QTimerEvent *ev)
-{
-    if (ev->timerId() == m_timeoutTimer.timerId()) {
-        qDebug() << ">>>>>>>>>>>>> timeout";
-        notifyDone();
-    } else
-        QObject::timerEvent(ev);
-}
-
-QString LayoutTestController::encodeHostName(const QString &host)
-{
-    QString encoded = QString::fromLatin1(QUrl::toAce(host + QLatin1String(".no")));
-    encoded.truncate(encoded.length() - 3); // strip .no
-    return encoded;
-}
-
-QString LayoutTestController::decodeHostName(const QString &host)
-{
-    QString decoded = QUrl::fromAce(host.toLatin1() + QByteArray(".no"));
-    decoded.truncate(decoded.length() - 3);
-    return decoded;
-}
-
-void LayoutTestController::setJavaScriptProfilingEnabled(bool enable)
-{
-    m_topLoadingFrame->page()->settings()->setAttribute(QWebSettings::DeveloperExtrasEnabled, true);
-    qt_drt_setJavaScriptProfilingEnabled(m_topLoadingFrame, enable);
-}
-
-void LayoutTestController::setFixedContentsSize(int width, int height)
-{
-    m_topLoadingFrame->page()->setFixedContentsSize(QSize(width, height));
-}
-
-void LayoutTestController::setPrivateBrowsingEnabled(bool enable)
-{
-    m_drt->webPage()->settings()->setAttribute(QWebSettings::PrivateBrowsingEnabled, enable);
-}
-
-void LayoutTestController::setPopupBlockingEnabled(bool enable)
-{
-    m_drt->webPage()->settings()->setAttribute(QWebSettings::JavascriptCanOpenWindows, !enable);
-}
-
-bool LayoutTestController::pauseAnimationAtTimeOnElementWithId(const QString &animationName,
-                                                               double time,
-                                                               const QString &elementId)
-{
-    QWebFrame* frame = m_drt->webPage()->mainFrame();
-    Q_ASSERT(frame);
-    return qt_drt_pauseAnimation(frame, animationName, time, elementId);
-}
-
-bool LayoutTestController::pauseTransitionAtTimeOnElementWithId(const QString &propertyName,
-                                                                double time,
-                                                                const QString &elementId)
-{
-    QWebFrame* frame = m_drt->webPage()->mainFrame();
-    Q_ASSERT(frame);
-    return qt_drt_pauseTransitionOfProperty(frame, propertyName, time, elementId);
-}
-
-unsigned LayoutTestController::numberOfActiveAnimations() const
-{
-    QWebFrame* frame = m_drt->webPage()->mainFrame();
-    Q_ASSERT(frame);
-    return qt_drt_numberOfActiveAnimations(frame);
-}
-
-void LayoutTestController::disableImageLoading()
-{
-    // FIXME: Implement for testing fix for https://bugs.webkit.org/show_bug.cgi?id=27896
-    // Also need to make sure image loading is re-enabled for each new test.
-}
-
-void LayoutTestController::dispatchPendingLoadRequests()
-{
-    // FIXME: Implement for testing fix for 6727495
-}
-
-void LayoutTestController::setDatabaseQuota(int size)
-{
-    if (!m_topLoadingFrame)
-        return;
-    m_topLoadingFrame->securityOrigin().setDatabaseQuota(size);
-}
-
-void LayoutTestController::clearAllDatabases()
-{
-    QWebDatabase::removeAllDatabases();
-}
-
-void LayoutTestController::whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains)
-{
-    QWebSecurityOrigin::whiteListAccessFromOrigin(sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains);
-}
-
-void LayoutTestController::waitForPolicyDelegate()
-{
-    m_waitForPolicy = true;
-    waitUntilDone();
-}
-
-void LayoutTestController::overridePreference(const QString& name, const QVariant& value)
-{
-    QWebSettings* settings = m_topLoadingFrame->page()->settings();
-
-    if (name == "WebKitJavaScriptEnabled")
-        settings->setAttribute(QWebSettings::JavascriptEnabled, value.toBool());
-    else if (name == "WebKitTabToLinksPreferenceKey")
-        settings->setAttribute(QWebSettings::LinksIncludedInFocusChain, value.toBool());
-    else if (name == "WebKitOfflineWebApplicationCacheEnabled")
-        settings->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, value.toBool());
-    else if (name == "WebKitDefaultFontSize")
-        settings->setFontSize(QWebSettings::DefaultFontSize, value.toInt());
-}
-
-EventSender::EventSender(QWebPage *parent)
-    : QObject(parent)
-{
-    m_page = parent;
-}
-
-void EventSender::mouseDown(int button)
-{
-    Qt::MouseButton mouseButton;
-    switch (button) {
-    case 0:
-        mouseButton = Qt::LeftButton;
-        break;
-    case 1:
-        mouseButton = Qt::MidButton;
-        break;
-    case 2:
-        mouseButton = Qt::RightButton;
-        break;
-    case 3:
-        // fast/events/mouse-click-events expects the 4th button to be treated as the middle button
-        mouseButton = Qt::MidButton;
-        break;
-    default:
-        mouseButton = Qt::LeftButton;
-        break;
-    }
-
-//     qDebug() << "EventSender::mouseDown" << frame;
-    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, mouseButton, mouseButton, Qt::NoModifier);
-    QApplication::sendEvent(m_page, &event);
-}
-
-void EventSender::mouseUp(int button)
-{
-    Qt::MouseButton mouseButton;
-    switch (button) {
-    case 0:
-        mouseButton = Qt::LeftButton;
-        break;
-    case 1:
-        mouseButton = Qt::MidButton;
-        break;
-    case 2:
-        mouseButton = Qt::RightButton;
-        break;
-    case 3:
-        // fast/events/mouse-click-events expects the 4th button to be treated as the middle button
-        mouseButton = Qt::MidButton;
-        break;
-    default:
-        mouseButton = Qt::LeftButton;
-        break;
-    }
-
-//     qDebug() << "EventSender::mouseUp" << frame;
-    QMouseEvent event(QEvent::MouseButtonRelease, m_mousePos, mouseButton, mouseButton, Qt::NoModifier);
-    QApplication::sendEvent(m_page, &event);
-}
-
-void EventSender::mouseMoveTo(int x, int y)
-{
-//     qDebug() << "EventSender::mouseMoveTo" << x << y;
-    m_mousePos = QPoint(x, y);
-    QMouseEvent event(QEvent::MouseMove, m_mousePos, Qt::NoButton, Qt::NoButton, Qt::NoModifier);
-    QApplication::sendEvent(m_page, &event);
-}
-
-void EventSender::leapForward(int ms)
-{
-    m_timeLeap += ms;
-    qDebug() << "EventSender::leapForward" << ms;
-}
-
-void EventSender::keyDown(const QString &string, const QStringList &modifiers)
-{
-    QString s = string;
-    Qt::KeyboardModifiers modifs = 0;
-    for (int i = 0; i < modifiers.size(); ++i) {
-        const QString &m = modifiers.at(i);
-        if (m == "ctrlKey")
-            modifs |= Qt::ControlModifier;
-        else if (m == "shiftKey")
-            modifs |= Qt::ShiftModifier;
-        else if (m == "altKey")
-            modifs |= Qt::AltModifier;
-        else if (m == "metaKey")
-            modifs |= Qt::MetaModifier;
-    }
-    int code = 0;
-    if (string.length() == 1) {
-        code = string.unicode()->unicode();
-        qDebug() << ">>>>>>>>> keyDown" << code << (char)code;
-        // map special keycodes used by the tests to something that works for Qt/X11
-        if (code == '\t') {
-            code = Qt::Key_Tab;
-            if (modifs == Qt::ShiftModifier)
-                code = Qt::Key_Backtab;
-            s = QString();
-        } else if (code == 127) {
-            code = Qt::Key_Backspace;
-            if (modifs == Qt::AltModifier)
-                modifs = Qt::ControlModifier;
-            s = QString();
-        } else if (code == 'o' && modifs == Qt::ControlModifier) {
-            s = QLatin1String("\n");
-            code = '\n';
-            modifs = 0;
-        } else if (code == 'y' && modifs == Qt::ControlModifier) {
-            s = QLatin1String("c");
-            code = 'c';
-        } else if (code == 'k' && modifs == Qt::ControlModifier) {
-            s = QLatin1String("x");
-            code = 'x';
-        } else if (code == 'a' && modifs == Qt::ControlModifier) {
-            s = QString();
-            code = Qt::Key_Home;
-            modifs = 0;
-        } else if (code == 0xf702) {
-            s = QString();
-            code = Qt::Key_Left;
-            if (modifs & Qt::MetaModifier) {
-                code = Qt::Key_Home;
-                modifs &= ~Qt::MetaModifier;
-            }
-        } else if (code == 0xf703) {
-            s = QString();
-            code = Qt::Key_Right;
-            if (modifs & Qt::MetaModifier) {
-                code = Qt::Key_End;
-                modifs &= ~Qt::MetaModifier;
-            }
-        } else if (code == 0xf700) {
-            s = QString();
-            code = Qt::Key_Up;
-            if (modifs & Qt::MetaModifier) {
-                code = Qt::Key_PageUp;
-                modifs &= ~Qt::MetaModifier;
-            }
-        } else if (code == 0xf701) {
-            s = QString();
-            code = Qt::Key_Down;
-            if (modifs & Qt::MetaModifier) {
-                code = Qt::Key_PageDown;
-                modifs &= ~Qt::MetaModifier;
-            }
-        } else if (code == 'a' && modifs == Qt::ControlModifier) {
-            s = QString();
-            code = Qt::Key_Home;
-            modifs = 0;
-        } else
-            code = string.unicode()->toUpper().unicode();
-    } else {
-        qDebug() << ">>>>>>>>> keyDown" << string;
-
-        if (string.startsWith(QLatin1Char('F')) && string.count() <= 3) {
-            s = s.mid(1);
-            int functionKey = s.toInt();
-            Q_ASSERT(functionKey >= 1 && functionKey <= 35);
-            code = Qt::Key_F1 + (functionKey - 1);
-        // map special keycode strings used by the tests to something that works for Qt/X11
-        } else if (string == QLatin1String("leftArrow")) {
-            s = QString();
-            code = Qt::Key_Left;
-        } else if (string == QLatin1String("rightArrow")) {
-            s = QString();
-            code = Qt::Key_Right;
-        } else if (string == QLatin1String("upArrow")) {
-            s = QString();
-            code = Qt::Key_Up;
-        } else if (string == QLatin1String("downArrow")) {
-            s = QString();
-            code = Qt::Key_Down;
-        } else if (string == QLatin1String("pageUp")) {
-            s = QString();
-            code = Qt::Key_PageUp;
-        } else if (string == QLatin1String("pageDown")) {
-            s = QString();
-            code = Qt::Key_PageDown;
-        } else if (string == QLatin1String("home")) {
-            s = QString();
-            code = Qt::Key_Home;
-        } else if (string == QLatin1String("end")) {
-            s = QString();
-            code = Qt::Key_End;
-        } else if (string == QLatin1String("delete")) {
-            s = QString();
-            code = Qt::Key_Delete;
-        }
-    }
-    QKeyEvent event(QEvent::KeyPress, code, modifs, s);
-    QApplication::sendEvent(m_page, &event);
-    QKeyEvent event2(QEvent::KeyRelease, code, modifs, s);
-    QApplication::sendEvent(m_page, &event2);
-}
-
-void EventSender::contextClick()
-{
-    QMouseEvent event(QEvent::MouseButtonPress, m_mousePos, Qt::RightButton, Qt::RightButton, Qt::NoModifier);
-    QApplication::sendEvent(m_page, &event);
-    QMouseEvent event2(QEvent::MouseButtonRelease, m_mousePos, Qt::RightButton, Qt::RightButton, Qt::NoModifier);
-    QApplication::sendEvent(m_page, &event2);
-}
-
-void EventSender::scheduleAsynchronousClick()
-{
-    QMouseEvent* event = new QMouseEvent(QEvent::MouseButtonPress, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
-    QApplication::postEvent(m_page, event);
-    QMouseEvent* event2 = new QMouseEvent(QEvent::MouseButtonRelease, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
-    QApplication::postEvent(m_page, event2);
-}
-
-QWebFrame* EventSender::frameUnderMouse() const
-{
-    QWebFrame* frame = m_page->mainFrame();
-
-redo:
-    QList<QWebFrame*> children = frame->childFrames();
-    for (int i = 0; i < children.size(); ++i) {
-        if (children.at(i)->geometry().contains(m_mousePos)) {
-            frame = children.at(i);
-            goto redo;
-        }
-    }
-    if (frame->geometry().contains(m_mousePos))
-        return frame;
-    return 0;
-}
-
-
-TextInputController::TextInputController(QWebPage *parent)
-    : QObject(parent)
-{
-}
-
-void TextInputController::doCommand(const QString &command)
-{
-    Qt::KeyboardModifiers modifiers = Qt::NoModifier;
-    int keycode = 0;
-    if (command == "moveBackwardAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Left;
-    } else if (command =="moveDown:") {
-        keycode = Qt::Key_Down;
-    } else if (command =="moveDownAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Down;
-    } else if (command =="moveForward:") {
-        keycode = Qt::Key_Right;
-    } else if (command =="moveForwardAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Right;
-    } else if (command =="moveLeft:") {
-        keycode = Qt::Key_Left;
-    } else if (command =="moveLeftAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Left;
-    } else if (command =="moveRight:") {
-        keycode = Qt::Key_Right;
-    } else if (command =="moveRightAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Right;
-    } else if (command =="moveToBeginningOfDocument:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Home;
-    } else if (command =="moveToBeginningOfLine:") {
-        keycode = Qt::Key_Home;
-//     } else if (command =="moveToBeginningOfParagraph:") {
-    } else if (command =="moveToEndOfDocument:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_End;
-    } else if (command =="moveToEndOfLine:") {
-        keycode = Qt::Key_End;
-//     } else if (command =="moveToEndOfParagraph:") {
-    } else if (command =="moveUp:") {
-        keycode = Qt::Key_Up;
-    } else if (command =="moveUpAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Up;
-    } else if (command =="moveWordBackward:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Up;
-    } else if (command =="moveWordBackwardAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Left;
-    } else if (command =="moveWordForward:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Right;
-    } else if (command =="moveWordForwardAndModifySelection:") {
-        modifiers |= Qt::ControlModifier;
-        modifiers |= Qt::ShiftModifier;
-        keycode = Qt::Key_Right;
-    } else if (command =="moveWordLeft:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Left;
-    } else if (command =="moveWordRight:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Left;
-    } else if (command =="moveWordRightAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Right;
-    } else if (command =="moveWordLeftAndModifySelection:") {
-        modifiers |= Qt::ShiftModifier;
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Left;
-    } else if (command =="pageDown:") {
-        keycode = Qt::Key_PageDown;
-    } else if (command =="pageUp:") {
-        keycode = Qt::Key_PageUp;
-    } else if (command == "deleteWordBackward:") {
-        modifiers |= Qt::ControlModifier;
-        keycode = Qt::Key_Backspace;
-    } else if (command == "deleteBackward:") {
-        keycode = Qt::Key_Backspace;
-    } else if (command == "deleteForward:") {
-        keycode = Qt::Key_Delete;
-    }
-    QKeyEvent event(QEvent::KeyPress, keycode, modifiers);
-    QApplication::sendEvent(parent(), &event);
-    QKeyEvent event2(QEvent::KeyRelease, keycode, modifiers);
-    QApplication::sendEvent(parent(), &event2);
-}
 
 GCController::GCController(QWebPage* parent)
     : QObject(parent)
diff --git a/WebKitTools/DumpRenderTree/qt/jsobjects.h b/WebKitTools/DumpRenderTree/qt/jsobjects.h
index c076bb9..3ee566b 100644
--- a/WebKitTools/DumpRenderTree/qt/jsobjects.h
+++ b/WebKitTools/DumpRenderTree/qt/jsobjects.h
@@ -29,156 +29,9 @@
 #ifndef JSOBJECTS_H
 #define JSOBJECTS_H
 
-#include <qobject.h>
-#include <qdebug.h>
-#include <qpoint.h>
-#include <qstringlist.h>
-#include <qsize.h>
-#include <qbasictimer.h>
-
-class QWebFrame;
-namespace WebCore {
-    class DumpRenderTree;
-}
-class LayoutTestController : public QObject
-{
-    Q_OBJECT
-public:
-    LayoutTestController(WebCore::DumpRenderTree *drt);
-
-    bool isLoading() const { return m_isLoading; }
-    void setLoading(bool loading) { m_isLoading = loading; }
-
-    bool shouldDumpAsText() const { return m_textDump; }
-    bool shouldDumpBackForwardList() const { return m_dumpBackForwardList; }
-    bool shouldDumpChildrenAsText() const { return m_dumpChildrenAsText; }
-    bool shouldDumpDatabaseCallbacks() const { return m_dumpDatabaseCallbacks; }
-    bool shouldDumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
-    bool shouldWaitUntilDone() const { return m_waitForDone; }
-    bool canOpenWindows() const { return m_canOpenWindows; }
-    bool shouldDumpTitleChanges() const { return m_dumpTitleChanges; }
-    bool waitForPolicy() const { return m_waitForPolicy; }
-
-    void reset();
-
-protected:
-    void timerEvent(QTimerEvent *);
-
-signals:
-    void done();
-
-public slots:
-    void maybeDump(bool ok);
-    void dumpAsText() { m_textDump = true; }
-    void dumpChildFramesAsText() { m_dumpChildrenAsText = true; }
-    void dumpDatabaseCallbacks() { m_dumpDatabaseCallbacks = true; }
-    void dumpStatusCallbacks() { m_dumpStatusCallbacks = true; }
-    void setCanOpenWindows() { m_canOpenWindows = true; }
-    void waitUntilDone();
-    void notifyDone();
-    void dumpBackForwardList() { m_dumpBackForwardList = true; }
-    void dumpEditingCallbacks();
-    void dumpResourceLoadCallbacks();
-    void queueBackNavigation(int howFarBackward);
-    void queueForwardNavigation(int howFarForward);
-    void queueLoad(const QString &url, const QString &target = QString());
-    void queueReload();
-    void queueScript(const QString &url);
-    void provisionalLoad();
-    void setCloseRemainingWindowsWhenComplete(bool=false) {}
-    int windowCount();
-    void display() {}
-    void clearBackForwardList();
-    void dumpTitleChanges() { m_dumpTitleChanges = true; }
-    QString encodeHostName(const QString &host);
-    QString decodeHostName(const QString &host);
-    void dumpSelectionRect() const {}
-    void setJavaScriptProfilingEnabled(bool enable);
-    void setFixedContentsSize(int width, int height);
-    void setPrivateBrowsingEnabled(bool enable);
-    void setPopupBlockingEnabled(bool enable);
-
-    bool pauseAnimationAtTimeOnElementWithId(const QString &animationName, double time, const QString &elementId);
-    bool pauseTransitionAtTimeOnElementWithId(const QString &propertyName, double time, const QString &elementId);
-    unsigned numberOfActiveAnimations() const;
-
-    void whiteListAccessFromOrigin(const QString& sourceOrigin, const QString& destinationProtocol, const QString& destinationHost, bool allowDestinationSubdomains);
-
-    void dispatchPendingLoadRequests();
-    void disableImageLoading();
-
-    void setDatabaseQuota(int size);
-    void clearAllDatabases();
-
-    void waitForPolicyDelegate();
-    void overridePreference(const QString& name, const QVariant& value);
-
-private slots:
-    void processWork();
-
-private:
-    bool m_isLoading;
-    bool m_textDump;
-    bool m_dumpBackForwardList;
-    bool m_dumpChildrenAsText;
-    bool m_canOpenWindows;
-    bool m_waitForDone;
-    bool m_dumpTitleChanges;
-    bool m_dumpDatabaseCallbacks;
-    bool m_dumpStatusCallbacks;
-    bool m_waitForPolicy;
-
-    QBasicTimer m_timeoutTimer;
-    QWebFrame *m_topLoadingFrame;
-    WebCore::DumpRenderTree *m_drt;
-};
+#include <QObject>
 
 class QWebPage;
-class QWebFrame;
-
-class EventSender : public QObject
-{
-    Q_OBJECT
-public:
-    EventSender(QWebPage *parent);
-
-public slots:
-    void mouseDown(int button = 0);
-    void mouseUp(int button = 0);
-    void mouseMoveTo(int x, int y);
-    void leapForward(int ms);
-    void keyDown(const QString &string, const QStringList &modifiers=QStringList());
-    void clearKillRing() {}
-    void contextClick();
-    void scheduleAsynchronousClick();
-
-private:
-    QPoint m_mousePos;
-    QWebPage *m_page;
-    int m_timeLeap;
-    QWebFrame *frameUnderMouse() const;
-};
-
-class TextInputController : public QObject
-{
-    Q_OBJECT
-public:
-    TextInputController(QWebPage *parent);
-
-public slots:
-    void doCommand(const QString &command);
-//     void setMarkedText(const QString &str, int from, int length);
-//     bool hasMarkedText();
-//     void unmarkText();
-//     QList<int> markedRange();
-//     QList<int> selectedRange();
-//     void validAttributesForMarkedText();
-//     void inserText(const QString &);
-//     void firstRectForCharacterRange();
-//     void characterIndexForPoint(int, int);
-//     void substringFromRange(int, int);
-//     void conversationIdentifier();
-};
 
 class GCController : public QObject
 {
diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
index 7e013a7..d486d06 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -31,6 +31,7 @@
 
 #include "EditingDelegate.h"
 #include "FrameLoadDelegate.h"
+#include "HistoryDelegate.h"
 #include "LayoutTestController.h"
 #include "PixelDumpSupport.h"
 #include "PolicyDelegate.h"
@@ -97,6 +98,7 @@ COMPtr<FrameLoadDelegate> sharedFrameLoadDelegate;
 COMPtr<UIDelegate> sharedUIDelegate;
 COMPtr<EditingDelegate> sharedEditingDelegate;
 COMPtr<ResourceLoadDelegate> sharedResourceLoadDelegate;
+COMPtr<HistoryDelegate> sharedHistoryDelegate;
 
 IWebFrame* frame;
 HWND webViewWindow;
@@ -199,7 +201,7 @@ static const wstring& fontsPath()
     return path;
 }
 
-#ifdef DEBUG_WEBKIT_HAS_SUFFIX
+#ifdef DEBUG_ALL
 #define WEBKITDLL TEXT("WebKit_debug.dll")
 #else
 #define WEBKITDLL TEXT("WebKit.dll")
@@ -681,6 +683,11 @@ static bool shouldLogFrameLoadDelegates(const char* pathOrURL)
     return strstr(pathOrURL, "/loading/") || strstr(pathOrURL, "\\loading\\");
 }
 
+static bool shouldLogHistoryDelegates(const char* pathOrURL)
+{
+    return strstr(pathOrURL, "/globalhistory/") || strstr(pathOrURL, "\\globalhistory\\");
+}
+
 static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
 {
 #ifdef USE_MAC_FONTS
@@ -737,7 +744,6 @@ static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
         prefsPrivate->setAuthorAndUserStylesEnabled(TRUE);
         prefsPrivate->setDeveloperExtrasEnabled(FALSE);
         prefsPrivate->setExperimentalNotificationsEnabled(TRUE);
-        prefsPrivate->setExperimentalWebSocketsEnabled(FALSE);
         prefsPrivate->setShouldPaintNativeControls(FALSE); // FIXME - need to make DRT pass with Windows native controls <http://bugs.webkit.org/show_bug.cgi?id=25592>
         prefsPrivate->setXSSAuditorEnabled(FALSE);
         prefsPrivate->setOfflineWebApplicationCacheEnabled(TRUE);
@@ -836,6 +842,17 @@ static void runTest(const string& testPathOrURL)
     if (shouldLogFrameLoadDelegates(pathOrURL.c_str()))
         gLayoutTestController->setDumpFrameLoadCallbacks(true);
 
+    COMPtr<IWebView> webView;
+    if (SUCCEEDED(frame->webView(&webView))) {
+        COMPtr<IWebViewPrivate> viewPrivate;
+        if (SUCCEEDED(webView->QueryInterface(&viewPrivate))) {
+            if (shouldLogHistoryDelegates(pathOrURL.c_str())) {
+                gLayoutTestController->setDumpHistoryDelegateCallbacks(true);            
+                viewPrivate->setHistoryDelegate(sharedHistoryDelegate.get());
+            } else
+                viewPrivate->setHistoryDelegate(0);
+        }
+    }
     COMPtr<IWebHistory> history;
     if (SUCCEEDED(WebKitCreateInstance(CLSID_WebHistory, 0, __uuidof(history), reinterpret_cast<void**>(&history))))
         history->setOptionalSharedHistory(0);
@@ -843,8 +860,7 @@ static void runTest(const string& testPathOrURL)
     resetWebViewToConsistentStateBeforeTesting();
 
     prevTestBFItem = 0;
-    COMPtr<IWebView> webView;
-    if (SUCCEEDED(frame->webView(&webView))) {
+    if (webView) {
         COMPtr<IWebBackForwardList> bfList;
         if (SUCCEEDED(webView->backForwardList(&bfList)))
             bfList->currentItem(&prevTestBFItem);
@@ -1095,9 +1111,11 @@ IWebView* createWebViewAndOffscreenWindow(HWND* webViewWindow)
 #if USE(CFNETWORK)
 RetainPtr<CFURLCacheRef> sharedCFURLCache()
 {
+#ifndef DEBUG_ALL
+    HMODULE module = GetModuleHandle(TEXT("CFNetwork.dll"));
+#else
     HMODULE module = GetModuleHandle(TEXT("CFNetwork_debug.dll"));
-    if (!module)
-        module = GetModuleHandle(TEXT("CFNetwork.dll"));
+#endif
     if (!module)
         return 0;
 
@@ -1153,6 +1171,7 @@ int main(int argc, char* argv[])
     sharedUIDelegate.adoptRef(new UIDelegate);
     sharedEditingDelegate.adoptRef(new EditingDelegate);
     sharedResourceLoadDelegate.adoptRef(new ResourceLoadDelegate);
+    sharedHistoryDelegate.adoptRef(new HistoryDelegate);
 
     // FIXME - need to make DRT pass with Windows native controls <http://bugs.webkit.org/show_bug.cgi?id=25592>
     COMPtr<IWebPreferences> tmpPreferences;
diff --git a/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj b/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
index dea2467..ba3640c 100644
--- a/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
+++ b/WebKitTools/DumpRenderTree/win/DumpRenderTree.vcproj
@@ -185,7 +185,7 @@
 			<Tool

 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(ProjectDir)\.&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)\..\cg&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\DumpRenderTree\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

-				PreprocessorDefinitions="_CONSOLE;DEBUG_WEBKIT_HAS_SUFFIX"

+				PreprocessorDefinitions="_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="DumpRenderTreePrefix.h"

 			/>

@@ -376,6 +376,77 @@
 				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\DumpRenderTree\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\.&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)\..\cg&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\DumpRenderTree\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_CONSOLE"

+				DisableSpecificWarnings="4146"

+				ForcedIncludeFiles="DumpRenderTreePrefix.h"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib CFNetwork$(LibraryConfigSuffix).lib pthreadVC2$(LibraryConfigSuffix).lib gdi32.lib ole32.lib oleaut32.lib user32.lib shlwapi.lib oleacc.lib comsuppw.lib"

+				AdditionalLibraryDirectories=""

+				DelayLoadDLLs=""

+				SubSystem="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CFNetwork$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CFNetwork.resources&quot; &quot;$(WebKitOutputDir)\bin\CFNetwork.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CharacterSets&quot; &quot;$(WebKitOutputDir)\bin\CharacterSets&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\dnssd.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40.dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icudt40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuin40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\icuuc40$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxml2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\libxslt$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\pthreadVC2$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\SQLite3$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\zlib1$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

@@ -456,6 +527,14 @@
 				>

 			</File>

 			<File

+				RelativePath=".\HistoryDelegate.cpp"

+				>

+			</File>

+			<File

+				RelativePath=".\HistoryDelegate.h"

+				>

+			</File>

+			<File

 				RelativePath=".\PolicyDelegate.cpp"

 				>

 			</File>

@@ -555,6 +634,14 @@
 					Name="VCCLCompilerTool"

 				/>

 			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_All|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCCLCompilerTool"

+				/>

+			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\cairo\PixelDumpSupportCairo.h"

@@ -583,6 +670,14 @@
 					Name="VCCustomBuildTool"

 				/>

 			</FileConfiguration>

+			<FileConfiguration

+				Name="Debug_All|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCCustomBuildTool"

+				/>

+			</FileConfiguration>

 		</File>

 		<File

 			RelativePath="..\cg\PixelDumpSupportCG.cpp"

diff --git a/WebKitTools/DumpRenderTree/win/EventSender.cpp b/WebKitTools/DumpRenderTree/win/EventSender.cpp
index 721b238..dd5bf9d 100644
--- a/WebKitTools/DumpRenderTree/win/EventSender.cpp
+++ b/WebKitTools/DumpRenderTree/win/EventSender.cpp
@@ -194,7 +194,7 @@ static inline POINTL pointl(const POINT& point)
     return result;
 }
 
-static void doMouseUp(MSG msg)
+static void doMouseUp(MSG msg, HRESULT* oleDragAndDropReturnValue = 0)
 {
     COMPtr<IWebFramePrivate> framePrivate;
     if (SUCCEEDED(frame->QueryInterface(&framePrivate)))
@@ -215,6 +215,8 @@ static void doMouseUp(MSG msg)
                 didDragEnter = true;
             }
             HRESULT hr = draggingInfo->dropSource()->QueryContinueDrag(0, 0);
+            if (oleDragAndDropReturnValue)
+                *oleDragAndDropReturnValue = hr;
             webViewDropTarget->DragOver(0, pointl(screenPoint), &effect);
             if (hr == DRAGDROP_S_DROP && effect != DROPEFFECT_NONE) {
                 DWORD effect = 0;
@@ -314,7 +316,7 @@ static JSValueRef mouseMoveToCallback(JSContextRef context, JSObjectRef function
     return JSValueMakeUndefined(context);
 }
 
-void replaySavedEvents()
+void replaySavedEvents(HRESULT* oleDragAndDropReturnValue)
 {
     replayingSavedEvents = true;
   
@@ -326,7 +328,7 @@ void replaySavedEvents()
             case WM_LBUTTONUP:
             case WM_RBUTTONUP:
             case WM_MBUTTONUP:
-                doMouseUp(msg);
+                doMouseUp(msg, oleDragAndDropReturnValue);
                 break;
             case WM_MOUSEMOVE:
                 doMouseMove(msg);
@@ -370,7 +372,7 @@ void replaySavedEvents()
             case WM_LBUTTONUP:
             case WM_RBUTTONUP:
             case WM_MBUTTONUP:
-                doMouseUp(msg);
+                doMouseUp(msg, oleDragAndDropReturnValue);
                 break;
             case WM_MOUSEMOVE:
                 doMouseMove(msg);
diff --git a/WebKitTools/DumpRenderTree/win/EventSender.h b/WebKitTools/DumpRenderTree/win/EventSender.h
index 9ae0aec..79d7dab 100644
--- a/WebKitTools/DumpRenderTree/win/EventSender.h
+++ b/WebKitTools/DumpRenderTree/win/EventSender.h
@@ -31,11 +31,12 @@
 
 class DraggingInfo;
 
+typedef long HRESULT;
 typedef const struct OpaqueJSContext* JSContextRef;
 typedef struct OpaqueJSValue* JSObjectRef;
 
 JSObjectRef makeEventSender(JSContextRef context);
-void replaySavedEvents();
+void replaySavedEvents(HRESULT* oleDragAndDropReturnValue = 0);
 
 extern DraggingInfo* draggingInfo;
 
diff --git a/WebKitTools/DumpRenderTree/win/HistoryDelegate.cpp b/WebKitTools/DumpRenderTree/win/HistoryDelegate.cpp
new file mode 100644
index 0000000..8a41fac
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/win/HistoryDelegate.cpp
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HistoryDelegate.h"
+
+#include "DumpRenderTree.h"
+#include "DumpRenderTreeWin.h"
+#include "LayoutTestController.h"
+#include <string>
+#include <WebKit/WebKit.h>
+
+using std::wstring;
+
+static inline wstring wstringFromBSTR(BSTR str)
+{
+    return wstring(str, ::SysStringLen(str));
+}
+
+HistoryDelegate::HistoryDelegate()
+    : m_refCount(1)
+{
+}
+
+HistoryDelegate::~HistoryDelegate()
+{
+}
+
+    // IUnknown
+HRESULT HistoryDelegate::QueryInterface(REFIID riid, void** ppvObject)
+{
+    *ppvObject = 0;
+    if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IWebHistoryDelegate*>(this);
+    else if (IsEqualGUID(riid, IID_IWebHistoryDelegate))
+        *ppvObject = static_cast<IWebHistoryDelegate*>(this);
+    else
+        return E_NOINTERFACE;
+
+    AddRef();
+    return S_OK;
+}
+
+ULONG HistoryDelegate::AddRef(void)
+{
+    return ++m_refCount;
+}
+
+ULONG HistoryDelegate::Release(void)
+{
+    ULONG newRef = --m_refCount;
+    if (!newRef)
+        delete(this);
+
+    return newRef;
+}
+
+// IWebHistoryDelegate
+HRESULT HistoryDelegate::didNavigateWithNavigationData(IWebView* webView, IWebNavigationData* navigationData, IWebFrame* webFrame)
+{
+    if (!gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return S_OK;
+
+    BSTR urlBSTR;
+    if (FAILED(navigationData->url(&urlBSTR)))
+        return E_FAIL;
+    wstring url;
+    if (urlBSTR)
+        url = urlSuitableForTestResult(wstringFromBSTR(urlBSTR));
+    SysFreeString(urlBSTR);
+
+    BSTR titleBSTR;
+    if (FAILED(navigationData->title(&titleBSTR)))
+        return E_FAIL;
+    wstring title;
+    if (titleBSTR)
+        title = wstringFromBSTR(titleBSTR);
+    SysFreeString(titleBSTR);
+
+    COMPtr<IWebURLRequest> request;
+    if (FAILED(navigationData->originalRequest(&request)))
+        return E_FAIL;
+
+    BSTR httpMethodBSTR;
+    if (FAILED(request->HTTPMethod(&httpMethodBSTR)))
+        return E_FAIL;
+    wstring httpMethod;
+    if (httpMethodBSTR)
+        httpMethod = wstringFromBSTR(httpMethodBSTR);
+    SysFreeString(httpMethodBSTR);
+
+    COMPtr<IWebURLResponse> response;
+    if (FAILED(navigationData->response(&response)))
+        return E_FAIL;
+
+    COMPtr<IWebHTTPURLResponse> httpResponse;
+    if (FAILED(response->QueryInterface(&httpResponse)))
+        return E_FAIL;
+
+    int statusCode = 0;
+    if (FAILED(httpResponse->statusCode(&statusCode)))
+        return E_FAIL;
+
+    BOOL hasSubstituteData;
+    if (FAILED(navigationData->hasSubstituteData(&hasSubstituteData)))
+        return E_FAIL;
+
+    BSTR clientRedirectSourceBSTR;
+    if (FAILED(navigationData->clientRedirectSource(&clientRedirectSourceBSTR)))
+        return E_FAIL;
+    bool hasClientRedirect = clientRedirectSourceBSTR && SysStringLen(clientRedirectSourceBSTR);
+    wstring redirectSource;
+    if (clientRedirectSourceBSTR)
+        redirectSource = urlSuitableForTestResult(wstringFromBSTR(clientRedirectSourceBSTR));
+    SysFreeString(clientRedirectSourceBSTR);
+
+    bool wasFailure = hasSubstituteData || (httpResponse && statusCode >= 400);
+        
+    printf("WebView navigated to url \"%S\" with title \"%S\" with HTTP equivalent method \"%S\".  The navigation was %s and was %s%S.\n", 
+        url.c_str(), 
+        title.c_str(), 
+        httpMethod.c_str(),
+        wasFailure ? "a failure" : "successful", 
+        hasClientRedirect ? "a client redirect from " : "not a client redirect", 
+        redirectSource.c_str());
+
+    return S_OK;
+}
+
+HRESULT HistoryDelegate::didPerformClientRedirectFromURL(IWebView*, BSTR sourceURL, BSTR destinationURL, IWebFrame*)
+{
+    if (!gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return S_OK;
+
+    wstring source;
+    if (sourceURL)
+        source = urlSuitableForTestResult(wstringFromBSTR(sourceURL));
+    
+    wstring destination;
+    if (destinationURL)
+        destination = urlSuitableForTestResult(wstringFromBSTR(destinationURL));
+
+    printf("WebView performed a client redirect from \"%S\" to \"%S\".\n", source.c_str(), destination.c_str());
+    return S_OK;
+}
+    
+HRESULT HistoryDelegate::didPerformServerRedirectFromURL(IWebView* webView, BSTR sourceURL, BSTR destinationURL, IWebFrame* webFrame)
+{
+    if (!gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return S_OK;
+
+    wstring source;
+    if (sourceURL)
+        source = urlSuitableForTestResult(wstringFromBSTR(sourceURL));
+    
+    wstring destination;
+    if (destinationURL)
+        destination = urlSuitableForTestResult(wstringFromBSTR(destinationURL));
+
+    printf("WebView performed a server redirect from \"%S\" to \"%S\".\n", source.c_str(), destination.c_str());
+    return S_OK;
+}
+
+HRESULT HistoryDelegate::updateHistoryTitle(IWebView* webView, BSTR titleBSTR, BSTR urlBSTR)
+{
+    if (!gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return S_OK;
+    
+    wstring url;
+    if (urlBSTR)
+        url = urlSuitableForTestResult(wstringFromBSTR(urlBSTR));
+
+    wstring title;
+    if (titleBSTR)
+        title = wstringFromBSTR(titleBSTR);
+
+    printf("WebView updated the title for history URL \"%S\" to \"%S\".\n", url.c_str(), title.c_str());
+    return S_OK;
+}
+    
+HRESULT HistoryDelegate::populateVisitedLinksForWebView(IWebView* webView)
+{
+    if (!gLayoutTestController->dumpHistoryDelegateCallbacks())
+        return S_OK;
+
+    BSTR urlBSTR;
+    if (FAILED(webView->mainFrameURL(&urlBSTR)))
+        return E_FAIL;
+
+    wstring url;
+    if (urlBSTR)
+        url = urlSuitableForTestResult(wstringFromBSTR(urlBSTR));
+    SysFreeString(urlBSTR);
+
+    if (gLayoutTestController->dumpVisitedLinksCallback())
+        printf("Asked to populate visited links for WebView \"%S\"\n", url.c_str());
+
+    return S_OK;
+}
diff --git a/WebKitTools/DumpRenderTree/win/HistoryDelegate.h b/WebKitTools/DumpRenderTree/win/HistoryDelegate.h
new file mode 100644
index 0000000..41be670
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/win/HistoryDelegate.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HistoryDelegate_h
+#define HistoryDelegate_h
+
+#include <WebKit/WebKit.h>
+#include <wtf/OwnPtr.h>
+
+class HistoryDelegate : public IWebHistoryDelegate {
+public:
+    HistoryDelegate();
+    virtual ~HistoryDelegate();
+
+    // IUnknown
+    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);
+    virtual ULONG STDMETHODCALLTYPE AddRef(void);
+    virtual ULONG STDMETHODCALLTYPE Release(void);
+
+    // IWebHistoryDelegate
+    virtual HRESULT STDMETHODCALLTYPE didNavigateWithNavigationData(
+        /* [in] */ IWebView* webView, 
+        /* [in] */ IWebNavigationData* navigationData, 
+        /* [in] */ IWebFrame* webFrame);
+
+    virtual HRESULT STDMETHODCALLTYPE didPerformClientRedirectFromURL(
+        /* [in] */ IWebView* webView, 
+        /* [in] */ BSTR sourceURL, 
+        /* [in] */ BSTR destinationURL, 
+        /* [in] */ IWebFrame* webFrame);
+    
+    virtual HRESULT STDMETHODCALLTYPE didPerformServerRedirectFromURL(
+        /* [in] */ IWebView* webView, 
+        /* [in] */ BSTR sourceURL, 
+        /* [in] */ BSTR destinationURL, 
+        /* [in] */ IWebFrame* webFrame);
+    
+    virtual HRESULT STDMETHODCALLTYPE updateHistoryTitle(
+        /* [in] */ IWebView* webView, 
+        /* [in] */ BSTR title, 
+        /* [in] */ BSTR url);
+    
+    virtual HRESULT STDMETHODCALLTYPE populateVisitedLinksForWebView(
+        /* [in] */ IWebView* webView);
+
+private:
+    ULONG m_refCount;
+};
+
+#endif // HistoryDelegate_h
diff --git a/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj b/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
index 37bddeb..d9f5225 100644
--- a/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
+++ b/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
@@ -216,6 +216,73 @@
 				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="2"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"

+				AdditionalLibraryDirectories=""

+				SubSystem="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index cf3ac85..d3cac7a 100644
--- a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -876,34 +876,68 @@ void LayoutTestController::addUserStyleSheet(JSStringRef source)
 
 void LayoutTestController::showWebInspector()
 {
-    COMPtr<IWebViewPrivate> webView;
-    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebPreferences> preferences;
+    if (FAILED(webView->preferences(&preferences)))
+        return;
+
+    COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
+    if (!prefsPrivate)
+        return;
+
+    prefsPrivate->setDeveloperExtrasEnabled(true);
+
+    COMPtr<IWebViewPrivate> viewPrivate(Query, webView);
+    if (!viewPrivate)
         return;
 
     COMPtr<IWebInspector> inspector;
-    if (SUCCEEDED(webView->inspector(&inspector)))
+    if (SUCCEEDED(viewPrivate->inspector(&inspector)))
         inspector->show();
 }
 
 void LayoutTestController::closeWebInspector()
 {
-    COMPtr<IWebViewPrivate> webView;
-    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebViewPrivate> viewPrivate(Query, webView);
+    if (!viewPrivate)
         return;
 
     COMPtr<IWebInspector> inspector;
-    if (SUCCEEDED(webView->inspector(&inspector)))
-        inspector->close();
+    if (FAILED(viewPrivate->inspector(&inspector)))
+        return;
+
+    inspector->close();
+
+    COMPtr<IWebPreferences> preferences;
+    if (FAILED(webView->preferences(&preferences)))
+        return;
+
+    COMPtr<IWebPreferencesPrivate> prefsPrivate(Query, preferences);
+    if (!prefsPrivate)
+        return;
+
+    prefsPrivate->setDeveloperExtrasEnabled(false);
 }
 
 void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef script)
 {
-    COMPtr<IWebViewPrivate> webView;
-    if (FAILED(WebKitCreateInstance(__uuidof(WebView), 0, __uuidof(webView), reinterpret_cast<void**>(&webView))))
+    COMPtr<IWebView> webView;
+    if (FAILED(frame->webView(&webView)))
+        return;
+
+    COMPtr<IWebViewPrivate> viewPrivate(Query, webView);
+    if (!viewPrivate)
         return;
 
     COMPtr<IWebInspector> inspector;
-    if (FAILED(webView->inspector(&inspector)))
+    if (FAILED(viewPrivate->inspector(&inspector)))
         return;
 
     COMPtr<IWebInspectorPrivate> inspectorPrivate(Query, inspector);
@@ -912,3 +946,52 @@ void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef scrip
 
     inspectorPrivate->evaluateInFrontend(callId, bstrT(script).GetBSTR());
 }
+
+void LayoutTestController::evaluateScriptInIsolatedWorld(unsigned worldId, JSObjectRef globalObject, JSStringRef script)
+{
+    COMPtr<IWebFramePrivate> framePrivate(Query, frame);
+    if (!framePrivate)
+        return;
+
+    BSTR result;
+    if (FAILED(framePrivate->stringByEvaluatingJavaScriptInIsolatedWorld(worldId, reinterpret_cast<OLE_HANDLE>(globalObject), bstrT(script).GetBSTR(), &result)))
+        return;
+    SysFreeString(result);
+}
+
+void LayoutTestController::removeAllVisitedLinks()
+{
+    COMPtr<IWebHistory> history;
+    if (FAILED(WebKitCreateInstance(CLSID_WebHistory, 0, __uuidof(history), reinterpret_cast<void**>(&history))))
+        return;
+
+    COMPtr<IWebHistory> sharedHistory;
+    if (FAILED(history->optionalSharedHistory(&sharedHistory)) || !sharedHistory)
+        return;
+
+    COMPtr<IWebHistoryPrivate> sharedHistoryPrivate;
+    if (FAILED(sharedHistory->QueryInterface(&sharedHistoryPrivate)))
+        return;
+
+    sharedHistoryPrivate->removeAllVisitedLinks();
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::counterValueForElementById(JSStringRef id)
+{
+    COMPtr<IWebFramePrivate> framePrivate(Query, frame);
+    if (!framePrivate)
+        return 0;
+
+    wstring idWstring = jsStringRefToWString(id);
+    BSTR idBSTR = SysAllocStringLen((OLECHAR*)idWstring.c_str(), idWstring.length());
+    BSTR counterValueBSTR;
+    if (FAILED(framePrivate->counterValueForElementById(idBSTR, &counterValueBSTR)))
+        return 0;
+
+    wstring counterValue(counterValueBSTR, SysStringLen(counterValueBSTR));
+    SysFreeString(idBSTR);
+    SysFreeString(counterValueBSTR);
+    JSRetainPtr<JSStringRef> counterValueJS(Adopt, JSStringCreateWithCharacters(counterValue.data(), counterValue.length()));
+    return counterValueJS;
+}
+
diff --git a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.rc b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.rc
index cccc69c..a8fbbcd 100644
--- a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.rc
+++ b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.rc
@@ -7,7 +7,7 @@
 //

 // Generated from the TEXTINCLUDE 2 resource.

 //

-#include "afxres.h"

+#include "windows.h"

 

 /////////////////////////////////////////////////////////////////////////////

 #undef APSTUDIO_READONLY_SYMBOLS

@@ -34,7 +34,7 @@ END
 

 2 TEXTINCLUDE 

 BEGIN

-    "#include ""afxres.h""\r\n"

+    "#include ""windows.h""\r\n"

     "\0"

 END

 

diff --git a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj
index 0e0918d..b1f2073 100644
--- a/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj
+++ b/WebKitTools/DumpRenderTree/win/TestNetscapePlugin/TestNetscapePlugin.vcproj
@@ -157,7 +157,7 @@
 		<Configuration

 			Name="Debug_Internal|Win32"

 			ConfigurationType="2"

-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

 			CharacterSet="1"

 			>

 			<Tool

@@ -293,6 +293,76 @@
 				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(ProjectDir)..\..\TestNetscapePlugin.subproj&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;TESTNETSCAPEPLUGIN_EXPORTS;snprintf=_snprintf"

+				RuntimeLibrary="3"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix)\np$(ProjectName)$(WebKitConfigSuffix).dll"

+				ModuleDefinitionFile="TestNetscapePlugin$(WebKitConfigSuffix).def"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/WebKitTools/DumpRenderTree/win/UIDelegate.cpp b/WebKitTools/DumpRenderTree/win/UIDelegate.cpp
index b78fd3e..16724d7 100755
--- a/WebKitTools/DumpRenderTree/win/UIDelegate.cpp
+++ b/WebKitTools/DumpRenderTree/win/UIDelegate.cpp
@@ -502,13 +502,14 @@ HRESULT STDMETHODCALLTYPE UIDelegate::doDragDrop(
     *performedEffect = 0;
 
     draggingInfo = new DraggingInfo(object, source);
-    replaySavedEvents();
+    HRESULT oleDragAndDropReturnValue = DRAGDROP_S_CANCEL;
+    replaySavedEvents(&oleDragAndDropReturnValue);
     if (draggingInfo) {
         *performedEffect = draggingInfo->performedDropEffect();
         delete draggingInfo;
         draggingInfo = 0;
     }
-    return S_OK;
+    return oleDragAndDropReturnValue;
 }
 
 HRESULT STDMETHODCALLTYPE UIDelegate::webViewGetDlgCode( 
diff --git a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index bfe1d99..72f85ae 100644
--- a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -313,3 +313,8 @@ void LayoutTestController::evaluateInWebInspector(long callId, JSStringRef scrip
 {
     // FIXME: Implement this.
 }
+
+void LayoutTestController::removeAllVisitedLinks()
+{
+    // FIXME: Implement this.
+}
diff --git a/WebKitTools/FindSafari/FindSafari.rc b/WebKitTools/FindSafari/FindSafari.rc
index 20c2da2..7d4abac 100644
--- a/WebKitTools/FindSafari/FindSafari.rc
+++ b/WebKitTools/FindSafari/FindSafari.rc
@@ -7,7 +7,7 @@
 //
 // Generated from the TEXTINCLUDE 2 resource.
 //
-#include "afxres.h"
+#include "windows.h"
 
 /////////////////////////////////////////////////////////////////////////////
 #undef APSTUDIO_READONLY_SYMBOLS
@@ -34,7 +34,7 @@ END
 
 2 TEXTINCLUDE 
 BEGIN
-    "#include ""afxres.h""\r\n"
+    "#include ""windows.h""\r\n"
     "\0"
 END
 
diff --git a/WebKitTools/FindSafari/FindSafari.vcproj b/WebKitTools/FindSafari/FindSafari.vcproj
index 48ea3df..083fa4d 100644
--- a/WebKitTools/FindSafari/FindSafari.vcproj
+++ b/WebKitTools/FindSafari/FindSafari.vcproj
@@ -15,7 +15,7 @@
 	</ToolFiles>

 	<Configurations>

 		<Configuration

-			Name="Release|Win32"

+			Name="all|Win32"

 			ConfigurationType="1"

 			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

 			CharacterSet="1"

diff --git a/WebKitTools/GtkLauncher/main.c b/WebKitTools/GtkLauncher/main.c
index 6994674..2f9350d 100644
--- a/WebKitTools/GtkLauncher/main.c
+++ b/WebKitTools/GtkLauncher/main.c
@@ -65,11 +65,11 @@ link_hover_cb (WebKitWebView* page, const gchar* title, const gchar* link, gpoin
 }
 
 static void
-title_change_cb (WebKitWebView* web_view, WebKitWebFrame* web_frame, const gchar* title, gpointer data)
+notify_title_cb (WebKitWebView* web_view, GParamSpec* pspec, gpointer data)
 {
     if (main_title)
         g_free (main_title);
-    main_title = g_strdup (title);
+    main_title = g_strdup (webkit_web_view_get_title(web_view));
     update_title (GTK_WINDOW (main_window));
 }
 
@@ -118,7 +118,7 @@ create_browser ()
     web_view = WEBKIT_WEB_VIEW (webkit_web_view_new ());
     gtk_container_add (GTK_CONTAINER (scrolled_window), GTK_WIDGET (web_view));
 
-    g_signal_connect (web_view, "title-changed", G_CALLBACK (title_change_cb), web_view);
+    g_signal_connect (web_view, "notify::title", G_CALLBACK (notify_title_cb), web_view);
     g_signal_connect (web_view, "notify::load-status", G_CALLBACK (notify_load_status_cb), web_view);
     g_signal_connect (web_view, "notify::progress", G_CALLBACK (notify_progress_cb), web_view);
     g_signal_connect (web_view, "hovering-over-link", G_CALLBACK (link_hover_cb), web_view);
diff --git a/WebKitTools/Scripts/VCSUtils.pm b/WebKitTools/Scripts/VCSUtils.pm
index 6ec12c9..e1e0bc2 100644
--- a/WebKitTools/Scripts/VCSUtils.pm
+++ b/WebKitTools/Scripts/VCSUtils.pm
@@ -40,10 +40,13 @@ BEGIN {
     $VERSION     = 1.00;
     @ISA         = qw(Exporter);
     @EXPORT      = qw(
+        &canonicalizePath
         &chdirReturningRelativePath
         &determineSVNRoot
         &determineVCSRoot
+        &fixChangeLogPatch
         &gitBranch
+        &gitdiff2svndiff
         &isGit
         &isGitBranchBuild
         &isGitDirectory
@@ -51,8 +54,10 @@ BEGIN {
         &isSVNDirectory
         &isSVNVersion16OrNewer
         &makeFilePathRelative
+        &normalizePath
         &pathRelativeToSVNRepositoryRootForPath
         &svnRevisionForDirectory
+        &svnStatus
     );
     %EXPORT_TAGS = ( );
     @EXPORT_OK   = ();
@@ -70,7 +75,7 @@ my $svnVersion;
 sub isGitDirectory($)
 {
     my ($dir) = @_;
-    return system("cd $dir && git rev-parse > /dev/null 2>&1") == 0;
+    return system("cd $dir && git rev-parse > " . File::Spec->devnull() . " 2>&1") == 0;
 }
 
 sub isGit()
@@ -159,7 +164,6 @@ sub determineGitRoot()
 
 sub determineSVNRoot()
 {
-    my $devNull = File::Spec->devnull();
     my $last = '';
     my $path = '.';
     my $parent = '..';
@@ -169,7 +173,7 @@ sub determineSVNRoot()
         my $thisRoot;
         my $thisUUID;
         # Ignore error messages in case we've run past the root of the checkout.
-        open INFO, "svn info '$path' 2> $devNull |" or die;
+        open INFO, "svn info '$path' 2> " . File::Spec->devnull() . " |" or die;
         while (<INFO>) {
             if (/^Repository Root: (.+)/) {
                 $thisRoot = $1;
@@ -268,4 +272,131 @@ sub makeFilePathRelative($)
     return $gitRoot . $path;
 }
 
+sub normalizePath($)
+{
+    my ($path) = @_;
+    $path =~ s/\\/\//g;
+    return $path;
+}
+
+sub canonicalizePath($)
+{
+    my ($file) = @_;
+
+    # Remove extra slashes and '.' directories in path
+    $file = File::Spec->canonpath($file);
+
+    # Remove '..' directories in path
+    my @dirs = ();
+    foreach my $dir (File::Spec->splitdir($file)) {
+        if ($dir eq '..' && $#dirs >= 0 && $dirs[$#dirs] ne '..') {
+            pop(@dirs);
+        } else {
+            push(@dirs, $dir);
+        }
+    }
+    return ($#dirs >= 0) ? File::Spec->catdir(@dirs) : ".";
+}
+
+sub svnStatus($)
+{
+    my ($fullPath) = @_;
+    my $svnStatus;
+    open SVN, "svn status --non-interactive --non-recursive '$fullPath' |" or die;
+    if (-d $fullPath) {
+        # When running "svn stat" on a directory, we can't assume that only one
+        # status will be returned (since any files with a status below the
+        # directory will be returned), and we can't assume that the directory will
+        # be first (since any files with unknown status will be listed first).
+        my $normalizedFullPath = File::Spec->catdir(File::Spec->splitdir($fullPath));
+        while (<SVN>) {
+            # Input may use a different EOL sequence than $/, so avoid chomp.
+            $_ = removeEOL($_);
+            my $normalizedStatPath = File::Spec->catdir(File::Spec->splitdir(substr($_, 7)));
+            if ($normalizedFullPath eq $normalizedStatPath) {
+                $svnStatus = "$_\n";
+                last;
+            }
+        }
+        # Read the rest of the svn command output to avoid a broken pipe warning.
+        local $/ = undef;
+        <SVN>;
+    }
+    else {
+        # Files will have only one status returned.
+        $svnStatus = removeEOL(<SVN>) . "\n";
+    }
+    close SVN;
+    return $svnStatus;
+}
+
+sub gitdiff2svndiff($)
+{
+    $_ = shift @_;
+    if (m#^diff --git a/(.+) b/(.+)#) {
+        return "Index: $1";
+    } elsif (m/^new file.*/) {
+        return "";
+    } elsif (m#^index [0-9a-f]{7}\.\.[0-9a-f]{7} [0-9]{6}#) {
+        return "===================================================================";
+    } elsif (m#^--- a/(.+)#) {
+        return "--- $1";
+    } elsif (m#^\+\+\+ b/(.+)#) {
+        return "+++ $1";
+    }
+    return $_;
+}
+
+sub fixChangeLogPatch($)
+{
+    my $patch = shift;
+    my $contextLineCount = 3;
+
+    return $patch if $patch !~ /\n@@ -1,(\d+) \+1,(\d+) @@\n( .*\n)+(\+.*\n)+( .*\n){$contextLineCount}$/m;
+    my ($oldLineCount, $newLineCount) = ($1, $2);
+    return $patch if $oldLineCount <= $contextLineCount;
+
+    # The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
+    # have lines of context at the top of a patch when the existing entry has the same
+    # date and author as the new entry.  This nifty loop alters a ChangeLog patch so
+    # that the added lines ("+") in the patch always start at the beginning of the
+    # patch and there are no initial lines of context.
+    my $newPatch;
+    my $lineCountInState = 0;
+    my $oldContentLineCountReduction = $oldLineCount - $contextLineCount;
+    my $newContentLineCountWithoutContext = $newLineCount - $oldLineCount - $oldContentLineCountReduction;
+    my ($stateHeader, $statePreContext, $stateNewChanges, $statePostContext) = (1..4);
+    my $state = $stateHeader;
+    foreach my $line (split(/\n/, $patch)) {
+        $lineCountInState++;
+        if ($state == $stateHeader && $line =~ /^@@ -1,$oldLineCount \+1,$newLineCount @\@$/) {
+            $line = "@@ -1,$contextLineCount +1," . ($newLineCount - $oldContentLineCountReduction) . " @@";
+            $lineCountInState = 0;
+            $state = $statePreContext;
+        } elsif ($state == $statePreContext && substr($line, 0, 1) eq " ") {
+            $line = "+" . substr($line, 1);
+            if ($lineCountInState == $oldContentLineCountReduction) {
+                $lineCountInState = 0;
+                $state = $stateNewChanges;
+            }
+        } elsif ($state == $stateNewChanges && substr($line, 0, 1) eq "+") {
+            # No changes to these lines
+            if ($lineCountInState == $newContentLineCountWithoutContext) {
+                $lineCountInState = 0;
+                $state = $statePostContext;
+            }
+        } elsif ($state == $statePostContext) {
+            if (substr($line, 0, 1) eq "+" && $lineCountInState <= $oldContentLineCountReduction) {
+                $line = " " . substr($line, 1);
+            } elsif ($lineCountInState > $contextLineCount && substr($line, 0, 1) eq " ") {
+                next; # Discard
+            }
+        }
+        $newPatch .= $line . "\n";
+    }
+
+    return $newPatch;
+}
+
+
 1;
diff --git a/WebKitTools/Scripts/bisect-builds b/WebKitTools/Scripts/bisect-builds
index 93e9223..55bf238 100755
--- a/WebKitTools/Scripts/bisect-builds
+++ b/WebKitTools/Scripts/bisect-builds
@@ -368,7 +368,7 @@ sub mountAndRunNightly($$$$)
     while (-e $mountPath) {
         $i++;
         usleep 100 if $i > 1;
-        `hdiutil detach '$mountPath' 2> /dev/null`;
+        exec "hdiutil", "detach '$mountPath' 2> " . File::Spec->devnull();
         die "Could not unmount $diskImage at $mountPath" if $i > 100;
     }
     die "Can't mount $diskImage: $mountPath already exists!" if -e $mountPath;
@@ -393,7 +393,7 @@ sub mountAndRunNightly($$$$)
     $tempFile ||= "";
     `DYLD_FRAMEWORK_PATH=$frameworkPath WEBKIT_UNSET_DYLD_FRAMEWORK_PATH=YES $safari $tempFile`;
 
-    `hdiutil detach '$mountPath' 2> /dev/null`;
+    exec "hdiutil", "detach '$mountPath' 2> " . File::Spec->devnull();
 }
 
 sub parseRevisions($$;$)
diff --git a/WebKitTools/Scripts/bugzilla-tool b/WebKitTools/Scripts/bugzilla-tool
index ec5aa0d..8e899b5 100755
--- a/WebKitTools/Scripts/bugzilla-tool
+++ b/WebKitTools/Scripts/bugzilla-tool
@@ -73,7 +73,7 @@ def commit_message_for_this_commit(scm):
         log("Parsing ChangeLog: %s" % changelog_path)
         changelog_entry = ChangeLog(changelog_path).latest_entry()
         if not changelog_entry:
-            error("Failed to parse ChangeLog: " + os.path.abspath(changelog_path))
+            raise ScriptError(message="Failed to parse ChangeLog: " + os.path.abspath(changelog_path))
         changelog_messages.append(changelog_entry)
 
     # FIXME: We should sort and label the ChangeLog messages like commit-log-editor does.
@@ -325,6 +325,11 @@ class LandPatchesFromBugs(Command):
         options += WebKitLandingScripts.land_options()
         Command.__init__(self, 'Lands all patches on a bug optionally testing them first', 'BUGID', options=options)
 
+    @staticmethod
+    def handled_error(error):
+        log(error)
+        exit(2) # Exit 2 insted of 1 to indicate to the commit-queue to indicate we handled the error, and that the queue should keep looping.
+
     @classmethod
     def land_patches(cls, bug_id, patches, options, tool):
         try:
@@ -344,11 +349,11 @@ class LandPatchesFromBugs(Command):
         except CheckoutNeedsUpdate, e:
             log("Commit was rejected because the checkout is out of date.  Please update and try again.")
             log("You can pass --no-build to skip building/testing after update if you believe the new commits did not affect the results.")
-            error(e)
+            cls.handled_error(e)
         except ScriptError, e:
             # Mark the patch as commit-queue- and comment in the bug.
             tool.bugs.reject_patch_from_commit_queue(patch['id'], e.message_with_output())
-            error(e)
+            cls.handled_error(e)
 
     @staticmethod
     def _fetch_list_of_patches_to_land(options, args, tool):
@@ -420,6 +425,7 @@ class PostDiffAsPatchToBug(Command):
         return [
             make_option("--no-obsolete", action="store_false", dest="obsolete_patches", default=True, help="Do not obsolete old patches before posting this one."),
             make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
+            make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review."),
         ]
 
     @staticmethod
@@ -443,7 +449,7 @@ class PostDiffAsPatchToBug(Command):
         diff_file = StringIO.StringIO(diff) # add_patch_to_bug expects a file-like object
 
         description = options.description or "Patch v1"
-        tool.bugs.add_patch_to_bug(bug_id, diff_file, description, mark_for_review=options.review)
+        tool.bugs.add_patch_to_bug(bug_id, diff_file, description, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
 
 
 class PostCommitsAsPatchesToBug(Command):
@@ -493,7 +499,7 @@ class PostCommitsAsPatchesToBug(Command):
             diff_file = self._diff_file_for_commit(tool, commit_id)
             description = options.description or commit_message.description(lstrip=True, strip_url=True)
             comment_text = self._comment_text_for_commit(options, commit_message, tool, commit_id)
-            tool.bugs.add_patch_to_bug(bug_id, diff_file, description, comment_text, mark_for_review=options.review)
+            tool.bugs.add_patch_to_bug(bug_id, diff_file, description, comment_text, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
 
 
 class RolloutCommit(Command):
@@ -560,6 +566,7 @@ class CreateBug(Command):
             make_option("--component", action="store", type="string", dest="component", help="Component for the new bug."),
             make_option("--no-prompt", action="store_false", dest="prompt", default=True, help="Do not prompt for bug title and comment; use commit log instead."),
             make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review."),
+            make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review."),
         ]
         Command.__init__(self, 'Create a bug from local changes or local commits.', '[COMMITISH]', options=options)
 
@@ -583,7 +590,7 @@ class CreateBug(Command):
 
         diff = tool.scm().create_patch_from_local_commit(commit_id)
         diff_file = StringIO.StringIO(diff) # create_bug_with_patch expects a file-like object
-        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch v1", cc=options.cc, mark_for_review=options.review)
+        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch v1", cc=options.cc, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
 
         if bug_id and len(commit_ids) > 1:
             options.bug_id = bug_id
@@ -603,7 +610,7 @@ class CreateBug(Command):
 
         diff = tool.scm().create_patch()
         diff_file = StringIO.StringIO(diff) # create_bug_with_patch expects a file-like object
-        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch v1", cc=options.cc, mark_for_review=options.review)
+        bug_id = tool.bugs.create_bug_with_patch(bug_title, comment_text, options.component, diff_file, "Patch v1", cc=options.cc, mark_for_review=options.review, mark_for_commit_queue=options.request_commit)
 
     def prompt_for_bug_title_and_comment(self):
         bug_title = raw_input("Bug title: ")
@@ -644,6 +651,7 @@ class CheckTreeStatus(Command):
 class LandPatchesFromCommitQueue(Command):
     def __init__(self):
         options = [
+            make_option("--is-relaunch", action="store_true", dest="is_relaunch", default=False, help="Internal: Used by the queue to indicate that it's relaunching itself."),
             make_option("--no-confirm", action="store_false", dest="confirm", default=True, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
             make_option("--status-host", action="store", type="string", dest="status_host", default=StatusBot.default_host, help="Do not ask the user for confirmation before running the queue.  Dangerous!"),
         ]
@@ -675,16 +683,25 @@ class LandPatchesFromCommitQueue(Command):
         wake_time = datetime.now() + timedelta(seconds=cls.seconds_to_sleep)
         return "%s Sleeping until %s (%s)." % (message, wake_time.strftime(cls.log_date_format), cls.sleep_duration_text)
 
-    @classmethod
-    def _sleep(cls, message):
-        log(cls._sleep_message(message))
-        time.sleep(cls.seconds_to_sleep)
+    def _sleep(self, message):
+        log(self._sleep_message(message))
+        time.sleep(self.seconds_to_sleep)
+        self._next_patch()
 
     def _update_status_and_sleep(self, message):
         status_message = self._sleep_message(message)
         self.status_bot.update_status(status_message)
         log(status_message)
         time.sleep(self.seconds_to_sleep)
+        self._next_patch()
+
+    def _next_patch(self):
+        # Re-exec this script to catch any updates to the script.
+        # Make sure that the re-execed commit-queue does not wait for the user.
+        args = sys.argv[:]
+        if args.count("--is-relaunch") == 0:
+            args.append("--is-relaunch")
+        os.execvp(sys.argv[0], args)
 
     @staticmethod
     def _open_log_file(log_path):
@@ -705,50 +722,55 @@ class LandPatchesFromCommitQueue(Command):
         log_file.close()
 
     def execute(self, options, args, tool):
-        log("CAUTION: commit-queue will discard all local changes in %s" % tool.scm().checkout_root)
-        if options.confirm:
-            response = raw_input("Are you sure?  Type 'yes' to continue: ")
-            if (response != 'yes'):
-                error("User declined.")
+        if not options.is_relaunch:
+            log("CAUTION: commit-queue will discard all local changes in %s" % tool.scm().checkout_root)
+            if options.confirm:
+                response = raw_input("Are you sure?  Type 'yes' to continue: ")
+                if (response != 'yes'):
+                    error("User declined.")
 
         queue_log = self._add_log_to_output_tee(self.queue_log_path)
-        log("Running WebKit Commit Queue. %s" % datetime.now().strftime(self.log_date_format))
+        if not options.is_relaunch:
+            log("Running WebKit Commit Queue. %s" % datetime.now().strftime(self.log_date_format))
 
         self.status_bot = StatusBot(host=options.status_host)
 
-        while (True):
-            # Either of these calls could throw URLError which shouldn't stop the queue.
-            # We catch all exceptions just in case.
-            try:
-                # Fetch patches instead of just bug ids to that we validate reviewer/committer flags on every patch.
-                patches = tool.bugs.fetch_patches_from_commit_queue(reject_invalid_patches=True)
-                if not len(patches):
-                    self._update_status_and_sleep("Empty queue.")
-                    continue
-                patch_ids = map(lambda patch: patch['id'], patches)
-                first_bug_id = patches[0]['bug_id']
-                log("%s in commit queue [%s]" % (pluralize('patch', len(patches)), ", ".join(patch_ids)))
-
-                if not tool.buildbot.core_builders_are_green():
-                    self._update_status_and_sleep("Builders (http://build.webkit.org) are red.")
-                    continue
-
-                self.status_bot.update_status("Landing patches from bug %s." % first_bug_id, bug_id=first_bug_id)
-            except Exception, e:
-                # Don't try tell the status bot, in case telling it causes an exception.
-                self._sleep("Exception while checking queue and bots: %s." % e)
-                continue
-
-            # Try to land patches on the first bug in the queue before looping
-            bug_log_path = os.path.join(self.bug_logs_directory, "%s.log" % first_bug_id)
-            bug_log = self._add_log_to_output_tee(bug_log_path)
-            bugzilla_tool_path = __file__ # re-execute this script
-            bugzilla_tool_args = [bugzilla_tool_path, 'land-patches', '--force-clean', '--commit-queue', '--quiet', first_bug_id]
-            WebKitLandingScripts.run_command_with_teed_output(bugzilla_tool_args, sys.stdout)
-            self._remove_log_from_output_tee(bug_log)
-
-        log("Finished WebKit Commit Queue. %s" % datetime.now().strftime(self.log_date_format))
-        self._remove_log_from_output_tee(queue_log)
+        # Either of these calls could throw URLError which shouldn't stop the queue.
+        # We catch all exceptions just in case.
+        try:
+            # Fetch patches instead of just bug ids to that we validate reviewer/committer flags on every patch.
+            patches = tool.bugs.fetch_patches_from_commit_queue(reject_invalid_patches=True)
+            if not len(patches):
+                self._update_status_and_sleep("Empty queue.")
+            patch_ids = map(lambda patch: patch['id'], patches)
+            first_bug_id = patches[0]['bug_id']
+            log("%s in commit queue [%s]" % (pluralize('patch', len(patches)), ", ".join(patch_ids)))
+
+            red_builders_names = tool.buildbot.red_core_builders_names()
+            if red_builders_names:
+                red_builders_names = map(lambda name: '"%s"' % name, red_builders_names) # Add quotes around the names.
+                self._update_status_and_sleep("Builders [%s] are red. See http://build.webkit.org." % ", ".join(red_builders_names))
+
+            self.status_bot.update_status("Landing patches from bug %s." % first_bug_id, bug_id=first_bug_id)
+        except Exception, e:
+            # Don't try tell the status bot, in case telling it causes an exception.
+            self._sleep("Exception while checking queue and bots: %s." % e)
+
+        # Try to land patches on the first bug in the queue before looping
+        bug_log_path = os.path.join(self.bug_logs_directory, "%s.log" % first_bug_id)
+        bug_log = self._add_log_to_output_tee(bug_log_path)
+        bugzilla_tool_path = __file__ # re-execute this script
+        bugzilla_tool_args = [bugzilla_tool_path, 'land-patches', '--force-clean', '--commit-queue', '--quiet', first_bug_id]
+        try:
+            WebKitLandingScripts.run_and_throw_if_fail(bugzilla_tool_args)
+        except ScriptError, e:
+            # Unexpected failure!  Mark the patch as commit-queue- and comment in the bug.
+            # exit(2) is a special exit code we use to indicate that the error was already handled by land-patches and we should keep looping anyway.
+            if e.exit_code != 2:
+                tool.bugs.reject_patch_from_commit_queue(patch['id'], "Unexpected failure when landing patch!  Please file a bug against bugzilla-tool.\n%s" % e.message_with_output())
+        self._remove_log_from_output_tee(bug_log)
+        # self._remove_log_from_output_tee(queue_log) # implicit in the exec()
+        self._next_patch()
 
 
 class NonWrappingEpilogIndentedHelpFormatter(IndentedHelpFormatter):
diff --git a/WebKitTools/Scripts/modules/bugzilla.py b/WebKitTools/Scripts/modules/bugzilla.py
index daf3f19..fe81b48 100644
--- a/WebKitTools/Scripts/modules/bugzilla.py
+++ b/WebKitTools/Scripts/modules/bugzilla.py
@@ -294,7 +294,18 @@ class Bugzilla:
 
         self.authenticated = True
 
-    def add_patch_to_bug(self, bug_id, patch_file_object, description, comment_text=None, mark_for_review=False):
+    def _fill_attachment_form(self, description, patch_file_object, comment_text=None, mark_for_review=False, mark_for_commit_queue=False, bug_id=None):
+        self.browser['description'] = description
+        self.browser['ispatch'] = ("1",)
+        self.browser['flag_type-1'] = ('?',) if mark_for_review else ('X',)
+        self.browser['flag_type-3'] = ('?',) if mark_for_commit_queue else ('X',)
+        if bug_id:
+            patch_name = "bug-%s-%s.patch" % (bug_id, timestamp())
+        else:
+            patch_name ="%s.patch" % timestamp()
+        self.browser.add_file(patch_file_object, "text/plain", patch_name, 'data')
+
+    def add_patch_to_bug(self, bug_id, patch_file_object, description, comment_text=None, mark_for_review=False, mark_for_commit_queue=False):
         self.authenticate()
         
         log('Adding patch "%s" to bug %s' % (description, bug_id))
@@ -304,13 +315,10 @@ class Bugzilla:
         
         self.browser.open("%sattachment.cgi?action=enter&bugid=%s" % (self.bug_server_url, bug_id))
         self.browser.select_form(name="entryform")
-        self.browser['description'] = description
-        self.browser['ispatch'] = ("1",)
+        self._fill_attachment_form(description, patch_file_object, mark_for_review=mark_for_review, mark_for_commit_queue=mark_for_commit_queue, bug_id=bug_id)
         if comment_text:
             log(comment_text)
             self.browser['comment'] = comment_text
-        self.browser['flag_type-1'] = ('?',) if mark_for_review else ('X',)
-        self.browser.add_file(patch_file_object, "text/plain", "bug-%s-%s.patch" % (bug_id, timestamp()))
         self.browser.submit()
 
     def prompt_for_component(self, components):
@@ -334,7 +342,7 @@ class Bugzilla:
             error_message = "\n" + '\n'.join(["  " + line.strip() for line in text_lines if line.strip()])
         raise BugzillaError("Bug not created: %s" % error_message)
 
-    def create_bug_with_patch(self, bug_title, bug_description, component, patch_file_object, patch_description, cc, mark_for_review=False):
+    def create_bug_with_patch(self, bug_title, bug_description, component, patch_file_object, patch_description, cc, mark_for_review=False, mark_for_commit_queue=False):
         self.authenticate()
 
         log('Creating bug with patch description "%s"' % patch_description)
@@ -355,10 +363,8 @@ class Bugzilla:
         if bug_description:
             log(bug_description)
             self.browser['comment'] = bug_description
-        self.browser['description'] = patch_description
-        self.browser['ispatch'] = ("1",)
-        self.browser['flag_type-1'] = ('?',) if mark_for_review else ('X',)
-        self.browser.add_file(patch_file_object, "text/plain", "%s.patch" % timestamp(), 'data')
+
+        self._fill_attachment_form(patch_description, patch_file_object, mark_for_review=mark_for_review, mark_for_commit_queue=mark_for_commit_queue)
         response = self.browser.submit()
 
         bug_id = self._check_create_bug_response(response.read())
diff --git a/WebKitTools/Scripts/modules/buildbot.py b/WebKitTools/Scripts/modules/buildbot.py
index 4478429..e948d8c 100644
--- a/WebKitTools/Scripts/modules/buildbot.py
+++ b/WebKitTools/Scripts/modules/buildbot.py
@@ -83,11 +83,19 @@ class BuildBot:
                     builders.append(builder)
         return builders
 
-    def core_builders_are_green(self):
+    def red_core_builders(self):
+        red_builders = []
         for builder in self._builder_statuses_with_names_matching_regexps(self.builder_statuses(), self.core_builder_names_regexps):
             if not builder['is_green']:
-                return False
-        return True
+                red_builders.append(builder)
+        return red_builders
+
+    def red_core_builders_names(self):
+        red_builders = self.red_core_builders()
+        return map(lambda builder: builder['name'], red_builders)
+
+    def core_builders_are_green(self):
+        return not self.red_core_builders()
 
     def builder_statuses(self):
         build_status_url = self.buildbot_server_url + 'one_box_per_builder'
diff --git a/WebKitTools/Scripts/modules/buildbot_unittest.py b/WebKitTools/Scripts/modules/buildbot_unittest.py
index 461e5a2..a85f2ea 100644
--- a/WebKitTools/Scripts/modules/buildbot_unittest.py
+++ b/WebKitTools/Scripts/modules/buildbot_unittest.py
@@ -91,6 +91,22 @@ class BuildBotTest(unittest.TestCase):
             for key, expected_value in expected_parsing.items():
                 self.assertEquals(builder[key], expected_value, ("Builder %d parse failure for key: %s: Actual='%s' Expected='%s'" % (x, key, builder[key], expected_value)))
 
+    def test_core_builder_methods(self):
+        buildbot = BuildBot()
+
+        # Override builder_statuses function to not touch the network.
+        def example_builder_statuses(): # We could use instancemethod() to bind 'self' but we don't need to.
+            return BuildBotTest._expected_example_one_box_parsings
+        buildbot.builder_statuses = example_builder_statuses
+
+        buildbot.core_builder_names_regexps = [ 'Leopard', "Windows.*Build" ]
+        self.assertEquals(buildbot.red_core_builders_names(), [])
+        self.assertTrue(buildbot.core_builders_are_green())
+
+        buildbot.core_builder_names_regexps = [ 'SnowLeopard', 'Qt' ]
+        self.assertEquals(buildbot.red_core_builders_names(), [ u'SnowLeopard Intel Release', u'Qt Linux Release' ])
+        self.assertFalse(buildbot.core_builders_are_green())
+
     def test_builder_name_regexps(self):
         buildbot = BuildBot()
 
diff --git a/WebKitTools/Scripts/modules/committers.py b/WebKitTools/Scripts/modules/committers.py
index e157fb4..fc263eb 100644
--- a/WebKitTools/Scripts/modules/committers.py
+++ b/WebKitTools/Scripts/modules/committers.py
@@ -42,22 +42,28 @@ class Reviewer(Committer):
         Committer.__init__(self, name, email)
         self.can_review = True
 
-# All reviewers are committers, so this list is only of committers
-# who are not reviewers.
+# This is intended as a cannonical, machine-readable list of all non-reviewer committers for WebKit.
+# If your name is missing here and you are a committer, please add it.  No review needed.
+# All reviewers are committers, so this list is only of committers who are not reviewers.
 committers_unable_to_review = [
     Committer("Aaron Boodman", "aa@chromium.org"),
     Committer("Adam Langley", "agl@chromium.org"),
     Committer("Albert J. Wong", "ajwong@chromium.org"),
+    Committer("Anton Muhin", "antonm@chromium.org"),
     Committer("Antonio Gomes", "tonikitoo@webkit.org"),
     Committer("Anthony Ricaud", "rik@webkit.org"),
     Committer("Ben Murdoch", "benm@google.com"),
+    Committer("Chris Fleizach", "cfleizach@apple.com"),
     Committer("Brent Fulgham", "bfulgham@webkit.org"),
     Committer("Brian Weinstein", "bweinstein@apple.com"),
     Committer("Cameron McCormack", "cam@webkit.org"),
+    Committer("Collin Jackson", "collinj@webkit.org"),
+    Committer("Csaba Osztrogonac", "ossy@webkit.org"),
     Committer("Daniel Bates", "dbates@webkit.org"),
     Committer("Drew Wilson", "atwilson@chromium.org"),
     Committer("Dirk Schulze", "krit@webkit.org"),
     Committer("Dmitry Titov", "dimich@chromium.org"),
+    Committer("Dumitru Daniliuc", "dumi@chromium.org"),
     Committer("Eli Fidler", "eli@staikos.net"),
     Committer("Eric Roman", "eroman@chromium.org"),
     Committer("Fumitoshi Ukai", "ukai@chromium.org"),
@@ -69,38 +75,53 @@ committers_unable_to_review = [
     Committer("Joseph Pecoraro", "joepeck@webkit.org"),
     Committer("Julie Parent", "jparent@google.com"),
     Committer("Kenneth Rohde Christiansen", "kenneth@webkit.org"),
+    Committer("Kent Tamura", "tkent@chromium.org"),
     Committer("Laszlo Gombos", "laszlo.1.gombos@nokia.com"),
+    Committer("Mads Ager", "ager@chromium.org"),
+    Committer("Mike Belshe", "mike@belshe.com"),
     Committer("Nate Chapin", "japhet@chromium.org"),
     Committer("Ojan Vafai", "ojan@chromium.org"),
     Committer("Pam Greene", "pam@chromium.org"),
     Committer("Peter Kasting", "pkasting@google.com"),
     Committer("Pierre d'Herbemont", "pdherbemont@free.fr"),
+    Committer("Roland Steiner", "rolandsteiner@chromium.org"),
     Committer("Ryosuke Niwa", "rniwa@webkit.org"),
     Committer("Scott Violet", "sky@chromium.org"),
     Committer("Shinichiro Hamaji", "hamaji@chromium.org"),
+    Committer("Steve Block", "steveblock@google.com"),
     Committer("Tony Chang", "tony@chromium.org"),
     Committer("Yael Aharon", "yael.aharon@nokia.com"),
     Committer("Yong Li", "yong.li@torchmobile.com"),
+    Committer("Yury Semikhatsky", "yurys@chromium.org"),
     Committer("Zoltan Horvath", "zoltan@webkit.org"),
 ]
 
+# This is intended as a cannonical, machine-readable list of all reviewers for WebKit.
+# If your name is missing here and you are a reviewer, please add it.  No review needed.
 reviewers_list = [
     Reviewer("Adam Barth", "abarth@webkit.org"),
+    Reviewer("Ada Chan", "adachan@apple.com"),
     Reviewer("Adam Roben", "aroben@apple.com"),
     Reviewer("Adam Treat", "treat@kde.org"),
     Reviewer("Adele Peterson", "adele@apple.com"),
     Reviewer("Alexey Proskuryakov", "ap@webkit.org"),
+    Reviewer("Alice Liu", "alice.liu@apple.com"),
+    Reviewer("Alp Toker", "alp@nuanti.com"),
     Reviewer("Anders Carlsson", "andersca@apple.com"),
     Reviewer("Antti Koivisto", "koivisto@iki.fi"),
     Reviewer("Ariya Hidayat", "ariya.hidayat@trolltech.com"),
     Reviewer("Brady Eidson", "beidson@apple.com"),
+    Reviewer("Cameron Zwarich", "zwarich@apple.com"),
     Reviewer("Dan Bernstein", "mitz@webkit.org"),
     Reviewer("Darin Adler", "darin@apple.com"),
     Reviewer("Darin Fisher", "fishd@chromium.org"),
+    Reviewer("David Harrison", "harrison@apple.com"),
     Reviewer("David Hyatt", "hyatt@apple.com"),
     Reviewer("David Kilzer", "ddkilzer@webkit.org"),
     Reviewer("David Levin", "levin@chromium.org"),
     Reviewer("Dimitri Glazkov", "dglazkov@chromium.org"),
+    Reviewer("Don Melton", "gramps@apple.com"),
+    Reviewer("Dmitri Titov", "dimich@chromium.org"),
     Reviewer("Eric Carlson", "eric.carlson@apple.com"),
     Reviewer("Eric Seidel", "eric@webkit.org"),
     Reviewer("Gavin Barraclough", "barraclough@apple.com"),
@@ -110,16 +131,22 @@ reviewers_list = [
     Reviewer("Holger Freyther", "zecke@selfish.org"),
     Reviewer("Jan Alonzo", "jmalonzo@gmail.com"),
     Reviewer("John Sullivan", "sullivan@apple.com"),
+    Reviewer("Jon Honeycutt", "jhoneycutt@apple.com"),
     Reviewer("Justin Garcia", "justin.garcia@apple.com"),
+    Reviewer("Kevin Decker", "kdecker@apple.com"),
     Reviewer("Kevin McCullough", "kmccullough@apple.com"),
     Reviewer("Kevin Ollivier", "kevino@theolliviers.com"),
+    Reviewer("Lars Knoll", "lars@trolltech.com"),
     Reviewer("Maciej Stachowiak", "mjs@apple.com"),
     Reviewer("Mark Rowe", "mrowe@apple.com"),
     Reviewer("Nikolas Zimmermann", "zimmermann@kde.org"),
     Reviewer("Oliver Hunt", "oliver@apple.com"),
+    Reviewer("Pavel Feldman", "pfeldman@chromium.org"),
+    Reviewer("Rob Buis", "rwlbuis@gmail.com"),
     Reviewer("Sam Weinig", "sam@webkit.org"),
     Reviewer("Simon Fraser", "simon.fraser@apple.com"),
     Reviewer("Simon Hausmann", "hausmann@webkit.org"),
+    Reviewer("Stephanie Lewis", "slewis@apple.com"),
     Reviewer("Steve Falkenburg", "sfalken@apple.com"),
     Reviewer("Timothy Hatcher", "timothy@hatcher.name"),
     Reviewer(u'Tor Arne Vestb\xf8', "vestbo@webkit.org"),
diff --git a/WebKitTools/Scripts/modules/cpp_style.py b/WebKitTools/Scripts/modules/cpp_style.py
index 0c9dfa0..485b07c 100644
--- a/WebKitTools/Scripts/modules/cpp_style.py
+++ b/WebKitTools/Scripts/modules/cpp_style.py
@@ -1533,16 +1533,15 @@ def check_spacing(filename, clean_lines, line_number, error):
 
     # Don't try to do spacing checks for operator methods
     line = re.sub(r'operator(==|!=|<|<<|<=|>=|>>|>)\(', 'operator\(', line)
-
-    # We allow no-spaces around = within an if: "if ( (a=Foo()) == 0 )".
-    # Otherwise not.  Note we only check for non-spaces on *both* sides;
-    # sometimes people put non-spaces on one side when aligning ='s among
-    # many lines (not that this is behavior that I approve of...)
-    if search(r'[\w.]=[\w.]', line) and not search(r'\b(if|while) ', line):
+    # Don't try to do spacing checks for #include statements at minimum it
+    # messes up checks for spacing around /
+    if match(r'\s*#\s*include', line):
+        return
+    if search(r'[\w.]=[\w.]', line):
         error(filename, line_number, 'whitespace/operators', 4,
               'Missing spaces around =')
 
-    # FIXME: It's not ok to have spaces around binary operators like + - * / .
+    # FIXME: It's not ok to have spaces around binary operators like .
 
     # You should always have whitespace around binary operators.
     # Alas, we can't test < or > because they're legitimately used sans spaces
@@ -1559,12 +1558,6 @@ def check_spacing(filename, clean_lines, line_number, error):
     if matched:
         error(filename, line_number, 'whitespace/operators', 3,
               'Missing spaces around %s' % matched.group(1))
-    # We allow no-spaces around << and >> when used like this: 10<<20, but
-    # not otherwise (particularly, not when used as streams)
-    matched = search(r'[^0-9\s](<<|>>)[^0-9\s=]', line)
-    if matched:
-        error(filename, line_number, 'whitespace/operators', 3,
-              'Missing spaces around %s' % matched.group(1))
 
     # There shouldn't be space around unary operators
     matched = search(r'(!\s|~\s|[\s]--[\s;]|[\s]\+\+[\s;])', line)
@@ -1699,50 +1692,32 @@ def check_namespace_indentation(filename, clean_lines, line_number, file_extensi
     if not namespace_match:
         return
 
-    namespace_indentation = namespace_match.group('namespace_indentation')
-
-    is_header_file = file_extension == 'h'
-    is_implementation_file = not is_header_file
+    current_indentation_level = len(namespace_match.group('namespace_indentation'))
+    if current_indentation_level > 0:
+        error(filename, line_number, 'whitespace/indent', 4,
+              'namespace should never be indented.')
+        return
+    looking_for_semicolon = False;
     line_offset = 0
-
-    if is_header_file:
-        inner_indentation = namespace_indentation + ' ' * 4
-
-        for current_line in clean_lines.raw_lines[line_number + 1:]:
-            line_offset += 1
-
-            # Skip not only empty lines but also those with preprocessor directives.
-            # Goto labels don't occur in header files, so no need to check for those.
-            if current_line.strip() == '' or current_line.startswith('#'):
-                continue
-
-            if not current_line.startswith(inner_indentation):
-                # If something unindented was discovered, make sure it's a closing brace.
-                if not current_line.startswith(namespace_indentation + '}'):
+    in_preprocessor_directive = False;
+    for current_line in clean_lines.elided[line_number + 1:]:
+        line_offset += 1
+        if not current_line.strip():
+            continue
+        if not current_indentation_level:
+            if not (in_preprocessor_directive or looking_for_semicolon):
+                if not match(r'\S', current_line):
                     error(filename, line_number + line_offset, 'whitespace/indent', 4,
-                          'In a header, code inside a namespace should be indented.')
-                break
-
-    if is_implementation_file:
-        for current_line in clean_lines.raw_lines[line_number + 1:]:
-            line_offset += 1
-
-            # Skip not only empty lines but also those with (goto) labels.
-            # The goto label regexp accepts spaces or the beginning of a
-            # comment (if anything) after the initial colon.
-            if current_line.strip() == '' or match(r'\w+\s*:([\s\/].*)?$', current_line):
-                continue
-
-            remaining_line = current_line[len(namespace_indentation):]
-            if not match(r'\S', remaining_line):
-                error(filename, line_number + line_offset, 'whitespace/indent', 4,
-                      'In an implementation file, code inside a namespace should not be indented.')
-
-            # Just check the first non-empty line in any case, because
-            # otherwise we would need to count opened and closed braces,
-            # which is obviously a lot more complicated.
-            break
-
+                          'Code inside a namespace should not be indented.')
+            if in_preprocessor_directive or (current_line.strip()[0] == '#'): # This takes care of preprocessor directive syntax.
+                in_preprocessor_directive = current_line[-1] == '\\'
+            else:
+                looking_for_semicolon = ((current_line.find(';') == -1) and (current_line.strip()[-1] != '}')) or (current_line[-1] == '\\')
+        else:
+            looking_for_semicolon = False; # If we have a brace we may not need a semicolon.
+        current_indentation_level += current_line.count('{') - current_line.count('}')
+        if current_indentation_level < 0:
+            break;
 
 def check_using_std(filename, clean_lines, line_number, error):
     """Looks for 'using std::foo;' statements which should be replaced with 'using namespace std;'.
diff --git a/WebKitTools/Scripts/modules/cpp_style_unittest.py b/WebKitTools/Scripts/modules/cpp_style_unittest.py
index 322356e..d5637f4 100644
--- a/WebKitTools/Scripts/modules/cpp_style_unittest.py
+++ b/WebKitTools/Scripts/modules/cpp_style_unittest.py
@@ -1265,6 +1265,12 @@ class CppStyleTest(CppStyleTestBase):
         self.assert_lint('a<Foo&> t <<= &b | &c;', '')
         self.assert_lint('a<Foo*> t <<= &b & &c;  // Test', '')
         self.assert_lint('a<Foo*> t <<= *b / &c;  // Test', '')
+        self.assert_lint('if (a=b == 1)', 'Missing spaces around =  [whitespace/operators] [4]')
+        self.assert_lint('a = 1<<20', 'Missing spaces around <<  [whitespace/operators] [3]')
+        self.assert_lint('if (a = b == 1)', '')
+        self.assert_lint('a = 1 << 20', '')
+        self.assert_multi_line_lint('#include "config.h"\n#include <sys/io.h>\n',
+                                    '')
 
     def test_spacing_before_last_semicolon(self):
         self.assert_lint('call_function() ;',
@@ -2806,40 +2812,39 @@ class WebKitStyleTest(CppStyleTestBase):
             'Weird number of spaces at line-start.  Are you using a 4-space indent?  [whitespace/indent] [3]')
         # FIXME: No tests for 8-spaces.
 
-        # 3. In a header, code inside a namespace should be indented.
+        # 3. In a header, code inside a namespace should not be indented.
         self.assert_multi_line_lint(
             'namespace WebCore {\n\n'
-            '    class Document {\n'
-            '        int myVariable;\n'
-            '    };\n'
+            'class Document {\n'
+            '    int myVariable;\n'
+            '};\n'
             '}',
             '',
             'foo.h')
         self.assert_multi_line_lint(
             'namespace OuterNamespace {\n'
             '    namespace InnerNamespace {\n'
-            '        class Document {\n'
-            '        };\n'
-            '    };\n'
+            '    class Document {\n'
+            '};\n'
+            '};\n'
             '}',
-            '',
+            ['Code inside a namespace should not be indented.  [whitespace/indent] [4]', 'namespace should never be indented.  [whitespace/indent] [4]'],
             'foo.h')
         self.assert_multi_line_lint(
             'namespace WebCore {\n'
             '#if 0\n'
             '    class Document {\n'
-            '    };\n'
+            '};\n'
             '#endif\n'
             '}',
-            '',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
             'foo.h')
         self.assert_multi_line_lint(
             'namespace WebCore {\n'
             'class Document {\n'
             '};\n'
             '}',
-            'In a header, code inside a namespace should be indented.'
-            '  [whitespace/indent] [4]',
+            '',
             'foo.h')
 
         # 4. In an implementation file (files with the extension .cpp, .c
@@ -2858,14 +2863,52 @@ class WebKitStyleTest(CppStyleTestBase):
             'namespace OuterNamespace {\n'
             'namespace InnerNamespace {\n'
             'Document::Foo() { }\n'
-            '}',
-            '',
+            '    void* p;\n'
+            '}\n'
+            '}\n',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
             'foo.cpp')
         self.assert_multi_line_lint(
-            '    namespace WebCore {\n\n'
-            'start:  // Pointless code, but tests the label regexp.\n'
-            '    goto start;\n'
-            '    }',
+            'namespace OuterNamespace {\n'
+            'namespace InnerNamespace {\n'
+            'Document::Foo() { }\n'
+            '}\n'
+            '    void* p;\n'
+            '}\n',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
+            'foo.cpp')
+        self.assert_multi_line_lint(
+            'namespace WebCore {\n\n'
+            '    const char* foo = "start:;"\n'
+            '        "dfsfsfs";\n'
+            '}\n',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
+            'foo.cpp')
+        self.assert_multi_line_lint(
+            'namespace WebCore {\n\n'
+            'const char* foo(void* a = ";",  // ;\n'
+            '    void* b);\n'
+            '    void* p;\n'
+            '}\n',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
+            'foo.cpp')
+        self.assert_multi_line_lint(
+            'namespace WebCore {\n\n'
+            'const char* foo[] = {\n'
+            '    "void* b);",  // ;\n'
+            '    "asfdf",\n'
+            '    }\n'
+            '    void* p;\n'
+            '}\n',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
+            'foo.cpp')
+        self.assert_multi_line_lint(
+            'namespace WebCore {\n\n'
+            'const char* foo[] = {\n'
+            '    "void* b);",  // }\n'
+            '    "asfdf",\n'
+            '    }\n'
+            '}\n',
             '',
             'foo.cpp')
         self.assert_multi_line_lint(
@@ -2875,15 +2918,30 @@ class WebKitStyleTest(CppStyleTestBase):
             'start:  // infinite loops are fun!\n'
             '        goto start;\n'
             '    }',
-            '',
+            'namespace should never be indented.  [whitespace/indent] [4]',
             'foo.cpp')
         self.assert_multi_line_lint(
             'namespace WebCore {\n'
             '    Document::Foo() { }\n'
             '}',
-            'In an implementation file, code inside a namespace should not be indented.'
+            'Code inside a namespace should not be indented.'
             '  [whitespace/indent] [4]',
             'foo.cpp')
+        self.assert_multi_line_lint(
+            'namespace WebCore {\n'
+            '#define abc(x) x; \\\n'
+            '    x\n'
+            '}',
+            '',
+            'foo.cpp')
+        self.assert_multi_line_lint(
+            'namespace WebCore {\n'
+            '#define abc(x) x; \\\n'
+            '    x\n'
+            '    void* x;'
+            '}',
+            'Code inside a namespace should not be indented.  [whitespace/indent] [4]',
+            'foo.cpp')
 
         # 5. A case label should line up with its switch statement. The
         #    case statement is indented.
@@ -3246,7 +3304,7 @@ class WebKitStyleTest(CppStyleTestBase):
             '')
         self.assert_multi_line_lint(
             'namespace WebCore {\n'
-            '    int foo;\n'
+            'int foo;\n'
             '};\n',
             '')
         self.assert_multi_line_lint(
diff --git a/WebKitTools/Scripts/modules/scm.py b/WebKitTools/Scripts/modules/scm.py
index 3daecbc..3ffa23b 100644
--- a/WebKitTools/Scripts/modules/scm.py
+++ b/WebKitTools/Scripts/modules/scm.py
@@ -124,9 +124,14 @@ class SCM:
 
     @staticmethod
     def run_command(args, cwd=None, input=None, error_handler=default_error_handler, return_exit_code=False):
-        stdin = subprocess.PIPE if input else None
+        if hasattr(input, 'read'): # Check if the input is a file.
+            stdin = input
+            string_to_communicate = None
+        else:
+            stdin = subprocess.PIPE if input else None
+            string_to_communicate = input
         process = subprocess.Popen(args, stdin=stdin, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=cwd)
-        output = process.communicate(input)[0].rstrip()
+        output = process.communicate(string_to_communicate)[0].rstrip()
         exit_code = process.wait()
         if exit_code:
             script_error = ScriptError(script_args=args, exit_code=exit_code, output=output, cwd=cwd)
@@ -166,11 +171,8 @@ class SCM:
         args = [self.script_path('svn-apply'), '--reviewer', patch['reviewer']]
         if force:
             args.append('--force')
-        patch_apply_process = subprocess.Popen(args, stdin=curl_process.stdout)
 
-        return_code = patch_apply_process.wait()
-        if return_code:
-            raise ScriptError(message="Patch %s from bug %s failed to download and apply." % (patch['url'], patch['bug_id']))
+        self.run_command(args, input=curl_process.stdout)
 
     def run_status_and_extract_filenames(self, status_command, status_regexp):
         filenames = []
@@ -392,7 +394,7 @@ class Git(SCM):
 
     @classmethod
     def in_working_directory(cls, path):
-        return cls.run_command(['git', 'rev-parse', '--is-inside-work-tree'], cwd=path) == "true"
+        return cls.run_command(['git', 'rev-parse', '--is-inside-work-tree'], cwd=path, error_handler=ignore_error) == "true"
 
     @classmethod
     def find_checkout_root(cls, path):
diff --git a/WebKitTools/Scripts/modules/scm_unittest.py b/WebKitTools/Scripts/modules/scm_unittest.py
index 58494a0..784303f 100644
--- a/WebKitTools/Scripts/modules/scm_unittest.py
+++ b/WebKitTools/Scripts/modules/scm_unittest.py
@@ -95,8 +95,6 @@ class SVNTestRepository:
 
     @classmethod
     def setup(cls, test_object):
-        test_object.original_path = os.path.abspath('.')
-
         # Create an test SVN repository
         test_object.svn_repo_path = tempfile.mkdtemp(suffix="svn_test_repo")
         test_object.svn_repo_url = "file://%s" % test_object.svn_repo_path # Not sure this will work on windows
@@ -115,23 +113,30 @@ class SVNTestRepository:
         run(['rm', '-rf', test_object.svn_repo_path])
         run(['rm', '-rf', test_object.svn_checkout_path])
 
+# For testing the SCM baseclass directly.
+class SCMClassTests(unittest.TestCase):
+    def setUp(self):
+        self.dev_null = open(os.devnull, "w") # Used to make our Popen calls quiet.
 
-class SCMTest(unittest.TestCase):
-    def _create_patch(self, patch_contents):
-        patch_path = os.path.join(self.svn_checkout_path, 'patch.diff')
-        write_into_file_at_path(patch_path, patch_contents)
-        patch = {}
-        patch['reviewer'] = 'Joe Cool'
-        patch['bug_id'] = '12345'
-        patch['url'] = 'file://%s' % urllib.pathname2url(patch_path)
-        return patch
+    def tearDown(self):
+        self.dev_null.close()
 
-    def _setup_webkittools_scripts_symlink(self, local_scm):
-        webkit_scm = detect_scm_system(self.original_path)
-        webkit_scripts_directory = webkit_scm.scripts_directory()
-        local_scripts_directory = local_scm.scripts_directory()
-        os.mkdir(os.path.dirname(local_scripts_directory))
-        os.symlink(webkit_scripts_directory, local_scripts_directory)
+    def test_run_command_with_pipe(self):
+        input_process = subprocess.Popen(['/bin/echo', 'foo\nbar'], stdout=subprocess.PIPE, stderr=self.dev_null)
+        self.assertEqual(SCM.run_command(['/usr/bin/grep', 'bar'], input=input_process.stdout), "bar")
+
+        # Test the non-pipe case too:
+        self.assertEqual(SCM.run_command(['/usr/bin/grep', 'bar'], input="foo\nbar"), "bar")
+
+        command_returns_non_zero = ['/bin/sh', '--invalid-option']
+        # Test when the input pipe process fails.
+        input_process = subprocess.Popen(command_returns_non_zero, stdout=subprocess.PIPE, stderr=self.dev_null)
+        self.assertTrue(input_process.poll() != 0)
+        self.assertRaises(ScriptError, SCM.run_command, ['/usr/bin/grep', 'bar'], input=input_process.stdout)
+
+        # Test when the run_command process fails.
+        input_process = subprocess.Popen(['/bin/echo', 'foo\nbar'], stdout=subprocess.PIPE, stderr=self.dev_null) # grep shows usage and calls exit(2) when called w/o arguments.
+        self.assertRaises(ScriptError, SCM.run_command, command_returns_non_zero, input=input_process.stdout)
 
     def test_error_handlers(self):
         git_failure_message="Merge conflict during commit: Your file or directory 'WebCore/ChangeLog' is probably out-of-date: resource out of date; try updating at /usr/local/libexec/git-core//git-svn line 469"
@@ -152,6 +157,24 @@ svn: resource out of date; try updating
         self.assertRaises(ScriptError, commit_error_handler, ScriptError(output='blah blah blah'))
 
 
+# GitTest and SVNTest inherit from this so any test_ methods here will be run once for this class and then once for each subclass.
+class SCMTest(unittest.TestCase):
+    def _create_patch(self, patch_contents):
+        patch_path = os.path.join(self.svn_checkout_path, 'patch.diff')
+        write_into_file_at_path(patch_path, patch_contents)
+        patch = {}
+        patch['reviewer'] = 'Joe Cool'
+        patch['bug_id'] = '12345'
+        patch['url'] = 'file://%s' % urllib.pathname2url(patch_path)
+        return patch
+
+    def _setup_webkittools_scripts_symlink(self, local_scm):
+        webkit_scm = detect_scm_system(os.path.dirname(os.path.abspath(__file__)))
+        webkit_scripts_directory = webkit_scm.scripts_directory()
+        local_scripts_directory = local_scm.scripts_directory()
+        os.mkdir(os.path.dirname(local_scripts_directory))
+        os.symlink(webkit_scripts_directory, local_scripts_directory)
+
     # Tests which both GitTest and SVNTest should run.
     # FIXME: There must be a simpler way to add these w/o adding a wrapper method to both subclasses
     def _shared_test_commit_with_message(self):
@@ -188,7 +211,6 @@ class SVNTest(SCMTest):
 
     def tearDown(self):
         SVNTestRepository.tear_down(self)
-        os.chdir(self.original_path)
 
     def test_create_patch_is_full_patch(self):
         test_dir_path = os.path.join(self.svn_checkout_path, 'test_dir')
@@ -284,7 +306,6 @@ class GitTest(SCMTest):
     def tearDown(self):
         SVNTestRepository.tear_down(self)
         self._tear_down_git_clone_of_svn_repository()
-        os.chdir(self.original_path)
 
     def test_detection(self):
         scm = detect_scm_system(self.git_checkout_path)
diff --git a/WebKitTools/Scripts/pdevenv b/WebKitTools/Scripts/pdevenv
index 818e4ee..cab8b16 100755
--- a/WebKitTools/Scripts/pdevenv
+++ b/WebKitTools/Scripts/pdevenv
@@ -6,6 +6,9 @@ use warnings;
 use File::Temp qw/tempfile/;
 use FindBin;
 
+use lib $FindBin::Bin;
+use webkitdirs;
+
 my ($fh, $path) = tempfile(UNLINK => 0, SUFFIX => '.cmd') or die;
 
 chomp(my $vcBin = `cygpath -w "$FindBin::Bin/../vcbin"`);
@@ -28,8 +31,15 @@ if ($ENV{'VS80COMNTOOLS'}) {
 print $fh "\@echo off\n\n";
 print $fh "call \"\%" . $vsToolsVar . "\%\\vsvars32.bat\"\n\n";
 print $fh "set PATH=$vcBin;$scriptsPath;\%PATH\%\n\n";
-print $fh "IF EXIST \"\%VSINSTALLDIR\%\\Common7\\IDE\\devenv.com\" (devenv.com /useenv " . join(" ", @ARGV) . ") ELSE ";
-print $fh "VCExpress.exe /useenv " . join(" ", @ARGV) . "\n";
+
+my $useenv = "/useenv ";
+if (isChromium()) {
+    $useenv = "";
+}
+
+print $fh "IF EXIST \"\%VSINSTALLDIR\%\\Common7\\IDE\\devenv.com\" (devenv.com " . $useenv . join(" ", @ARGV) . ") ELSE ";
+print $fh "VCExpress.exe " . $useenv . join(" ", @ARGV) . "\n";
+
 
 close $fh;
 
diff --git a/WebKitTools/Scripts/prepare-ChangeLog b/WebKitTools/Scripts/prepare-ChangeLog
index ed31005..dd864df 100755
--- a/WebKitTools/Scripts/prepare-ChangeLog
+++ b/WebKitTools/Scripts/prepare-ChangeLog
@@ -85,7 +85,6 @@ sub isConflictStatus($);
 sub statusDescription($$$$);
 sub propertyChangeDescription($);
 sub extractLineRange($);
-sub canonicalizePath($);
 sub testListForChangeLog(@);
 sub get_function_line_ranges($$);
 sub get_function_line_ranges_for_c($$);
@@ -95,7 +94,6 @@ sub method_decl_to_selector($);
 sub processPaths(\@);
 sub reviewerAndDescriptionForGitCommit($);
 sub normalizeLineEndings($$);
-sub normalizePath($);
 sub decodeEntities($);
 
 # Project time zone for Cupertino, CA, US
@@ -429,24 +427,6 @@ if ($openChangeLogs && @logs) {
 # Done.
 exit;
 
-sub canonicalizePath($)
-{
-    my ($file) = @_;
-
-    # Remove extra slashes and '.' directories in path
-    $file = File::Spec->canonpath($file);
-
-    # Remove '..' directories in path
-    my @dirs = ();
-    foreach my $dir (File::Spec->splitdir($file)) {
-        if ($dir eq '..' && $#dirs >= 0 && $dirs[$#dirs] ne '..') {
-            pop(@dirs);
-        } else {
-            push(@dirs, $dir);
-        }
-    }
-    return ($#dirs >= 0) ? File::Spec->catdir(@dirs) : ".";
-}
 
 sub changeLogDate($)
 {
@@ -1717,13 +1697,6 @@ sub normalizeLineEndings($$)
     return $string;
 }
 
-sub normalizePath($)
-{
-    my ($path) = @_;
-    $path =~ s/\\/\//g;
-    return $path;
-}
-
 sub decodeEntities($)
 {
     my ($text) = @_;
diff --git a/WebKitTools/Scripts/resolve-ChangeLogs b/WebKitTools/Scripts/resolve-ChangeLogs
index db497f9..1a2d2af 100755
--- a/WebKitTools/Scripts/resolve-ChangeLogs
+++ b/WebKitTools/Scripts/resolve-ChangeLogs
@@ -44,7 +44,6 @@ sub canonicalRelativePath($);
 sub conflictFiles($);
 sub findChangeLog($);
 sub findUnmergedChangeLogs();
-sub fixChangeLogPatch($);
 sub fixMergedChangeLogs($;@);
 sub fixOneMergedChangeLog($);
 sub hasGitUnmergedFiles();
@@ -56,7 +55,6 @@ sub resolveChangeLog($);
 sub resolveConflict($);
 sub showStatus($;$);
 sub usageAndExit();
-sub normalizePath($);
 
 my $isGit = isGit();
 my $isSVN = isSVN();
@@ -281,57 +279,6 @@ sub findUnmergedChangeLogs()
     return @results;
 }
 
-sub fixChangeLogPatch($)
-{
-    my $patch = shift;
-    my $contextLineCount = 3;
-
-    return $patch if $patch !~ /\n@@ -1,(\d+) \+1,(\d+) @@\n( .*\n)+(\+.*\n)+( .*\n){$contextLineCount}$/m;
-    my ($oldLineCount, $newLineCount) = ($1, $2);
-    return $patch if $oldLineCount <= $contextLineCount;
-
-    # The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
-    # have lines of context at the top of a patch when the existing entry has the same
-    # date and author as the new entry.  This nifty loop alters a ChangeLog patch so
-    # that the added lines ("+") in the patch always start at the beginning of the
-    # patch and there are no initial lines of context.
-    my $newPatch;
-    my $lineCountInState = 0;
-    my $oldContentLineCountReduction = $oldLineCount - $contextLineCount;
-    my $newContentLineCountWithoutContext = $newLineCount - $oldLineCount - $oldContentLineCountReduction;
-    my ($stateHeader, $statePreContext, $stateNewChanges, $statePostContext) = (1..4);
-    my $state = $stateHeader;
-    foreach my $line (split(/\n/, $patch)) {
-        $lineCountInState++;
-        if ($state == $stateHeader && $line =~ /^@@ -1,$oldLineCount \+1,$newLineCount @\@$/) {
-            $line = "@@ -1,$contextLineCount +1," . ($newLineCount - $oldContentLineCountReduction) . " @@";
-            $lineCountInState = 0;
-            $state = $statePreContext;
-        } elsif ($state == $statePreContext && substr($line, 0, 1) eq " ") {
-            $line = "+" . substr($line, 1);
-            if ($lineCountInState == $oldContentLineCountReduction) {
-                $lineCountInState = 0;
-                $state = $stateNewChanges;
-            }
-        } elsif ($state == $stateNewChanges && substr($line, 0, 1) eq "+") {
-            # No changes to these lines
-            if ($lineCountInState == $newContentLineCountWithoutContext) {
-                $lineCountInState = 0;
-                $state = $statePostContext;
-            }
-        } elsif ($state == $statePostContext) {
-            if (substr($line, 0, 1) eq "+" && $lineCountInState <= $oldContentLineCountReduction) {
-                $line = " " . substr($line, 1);
-            } elsif ($lineCountInState > $contextLineCount && substr($line, 0, 1) eq " ") {
-                next; # Discard
-            }
-        }
-        $newPatch .= $line . "\n";
-    }
-
-    return $newPatch;
-}
-
 sub fixMergedChangeLogs($;@)
 {
     my $revisionRange = shift;
@@ -408,7 +355,7 @@ sub fixOneMergedChangeLog($)
         close FILE;
 
         # Apply the new patch
-        open(PATCH, "| patch -p1 $file > /dev/null") or die $!;
+        open(PATCH, "| patch -p1 $file > " . File::Spec->devnull()) or die $!;
         print PATCH $newPatch;
         close(PATCH) or die $!;
 
@@ -460,7 +407,7 @@ sub mergeChanges($$$)
     unlink("${fileNewer}.orig");
     unlink("${fileNewer}.rej");
 
-    open(PATCH, "| patch --fuzz=3 --binary $fileNewer > /dev/null") or die $!;
+    open(PATCH, "| patch --fuzz=3 --binary $fileNewer > " . File::Spec->devnull()) or die $!;
     print PATCH fixChangeLogPatch($patch);
     close(PATCH);
 
@@ -571,9 +518,3 @@ sub showStatus($;$)
     }
 }
 
-sub normalizePath($)
-{
-    my ($path) = @_;
-    $path =~ s/\\/\//g;
-    return $path;
-}
diff --git a/WebKitTools/Scripts/run-iexploder-tests b/WebKitTools/Scripts/run-iexploder-tests
index f5e8a6c..ed5ecd6 100755
--- a/WebKitTools/Scripts/run-iexploder-tests
+++ b/WebKitTools/Scripts/run-iexploder-tests
@@ -32,6 +32,7 @@ use strict;
 use warnings;
 
 use Cwd;
+use File::Spec;
 use FindBin;
 use Getopt::Long;
 use IPC::Open2;
@@ -149,7 +150,7 @@ sub openHTTPDIfNeeded()
         "-c", "User \"#$<\"");
 
     my $retryCount = 20;
-    while (system("/usr/bin/curl -q --silent --stderr - --output /dev/null $listen") && $retryCount) {
+    while (system("/usr/bin/curl -q --silent --stderr - --output " . File::Spec->devnull() . " $listen") && $retryCount) {
         sleep 1;
         --$retryCount;
     }
diff --git a/WebKitTools/Scripts/run-javascriptcore-tests b/WebKitTools/Scripts/run-javascriptcore-tests
index 865ae1d..fb4c388 100755
--- a/WebKitTools/Scripts/run-javascriptcore-tests
+++ b/WebKitTools/Scripts/run-javascriptcore-tests
@@ -100,21 +100,10 @@ if (!defined($root) && !$skipBuild) {
 }
 
 
-my $productDir = productDir();
-
-$productDir .= "/JavaScriptCore" if isQt();
-$productDir .= "/Programs" if isGtk();
+my $productDir = jscProductDir();
 $ENV{DYLD_FRAMEWORK_PATH} = $productDir;
 setPathForRunningWebKitApp(\%ENV) if isCygwin();
 
-sub jscPath($)
-{
-    my ($productDir) = @_;
-    my $jscName = "jsc";
-    $jscName .= "_debug"  if (isCygwin() && ($configuration eq "Debug"));
-    return "$productDir/$jscName";
-}
-
 sub testapiPath($)
 {
     my ($productDir) = @_;
diff --git a/WebKitTools/Scripts/run-jsc b/WebKitTools/Scripts/run-jsc
index 20dc5e8..e5341c1 100755
--- a/WebKitTools/Scripts/run-jsc
+++ b/WebKitTools/Scripts/run-jsc
@@ -30,6 +30,7 @@
 
 use strict;
 use warnings;
+use File::Spec;
 use FindBin;
 use lib $FindBin::Bin;
 use Getopt::Long;
@@ -43,10 +44,10 @@ GetOptions("count|c=i" => \$count,
            "verbose|v" => \$verbose);
 die "$usage\n" if (@ARGV < 1);
 
-my $jsc = productDir() . "/jsc @ARGV";
-$jsc .= " 2> /dev/null" unless $verbose;
+my $jsc = jscProductDir() . "/jsc @ARGV";
+$jsc .= " 2> " . File::Spec->devnull() unless $verbose;
 
-my $dyld = productDir();
+my $dyld = jscProductDir();
 
 $ENV{"DYLD_FRAMEWORK_PATH"} = $dyld;
 print STDERR "Running $count time(s): DYLD_FRAMEWORK_PATH=$dyld $jsc\n";
diff --git a/WebKitTools/Scripts/run-launcher b/WebKitTools/Scripts/run-launcher
index ee462ba..e12a64a 100755
--- a/WebKitTools/Scripts/run-launcher
+++ b/WebKitTools/Scripts/run-launcher
@@ -49,6 +49,8 @@ if (isQt()) {
     my $libDir = catdir(productDir(), 'lib');
     $launcherPath = catdir($launcherPath, "bin", "QtLauncher");
 
+    $ENV{QTWEBKIT_PLUGIN_PATH} = catdir($libDir, 'plugins');
+
     print "Starting webkit launcher, running against the built WebKit in $libDir...\n";
     if (isDarwin()) {
         $ENV{DYLD_LIBRARY_PATH} = $ENV{DYLD_LIBRARY_PATH} ? "$libDir:$ENV{DYLD_LIBRARY_PATH}" : $libDir;
diff --git a/WebKitTools/Scripts/run-mangleme-tests b/WebKitTools/Scripts/run-mangleme-tests
index 93b7894..43ac74b 100755
--- a/WebKitTools/Scripts/run-mangleme-tests
+++ b/WebKitTools/Scripts/run-mangleme-tests
@@ -32,6 +32,7 @@ use strict;
 use warnings;
 
 use Cwd;
+use File::Spec;
 use FindBin;
 use Getopt::Long;
 use IPC::Open2;
@@ -152,7 +153,7 @@ sub openHTTPDIfNeeded()
         "-c", "User \"#$<\"");
 
     my $retryCount = 20;
-    while (system("/usr/bin/curl -q --silent --stderr - --output /dev/null $listen") && $retryCount) {
+    while (system("/usr/bin/curl -q --silent --stderr - --output " . File::Spec->devnull() . " $listen") && $retryCount) {
         sleep 1;
         --$retryCount;
     }
diff --git a/WebKitTools/Scripts/run-sunspider b/WebKitTools/Scripts/run-sunspider
index 367fd06..e63f5d1 100755
--- a/WebKitTools/Scripts/run-sunspider
+++ b/WebKitTools/Scripts/run-sunspider
@@ -103,23 +103,12 @@ sub setupEnvironmentForExecution($)
     # FIXME: Other platforms may wish to augment this method to use LD_LIBRARY_PATH, etc.
 }
 
-sub jscPath($)
-{
-    my ($productDir) = @_;
-    my $jscName = "jsc";
-    $jscName .= "_debug"  if (isCygwin() && ($configuration eq "Debug"));
-    return "$productDir/$jscName";
-}
-
 buildJSC();
 
 chdirWebKit();
 chdir("SunSpider");
 
-my $productDir = productDir();
-# FIXME: This hack should be pushed down into productDir()
-$productDir .= "/JavaScriptCore" if isQt();
-$productDir .= "/Programs" if isGtk();
+my $productDir = jscProductDir();
 
 setupEnvironmentForExecution($productDir);
 my @args = ("--shell", jscPath($productDir), "--runs", $testRuns);
diff --git a/WebKitTools/Scripts/run-webkit-tests b/WebKitTools/Scripts/run-webkit-tests
index a08a53c..6056035 100755
--- a/WebKitTools/Scripts/run-webkit-tests
+++ b/WebKitTools/Scripts/run-webkit-tests
@@ -321,7 +321,7 @@ if (!defined($root)) {
     local *DEVNULL;
     my ($childIn, $childOut, $childErr);
     if ($quiet) {
-        open(DEVNULL, ">", File::Spec->devnull) or die "Failed to open /dev/null";
+        open(DEVNULL, ">", File::Spec->devnull()) or die "Failed to open /dev/null";
         $childOut = ">&DEVNULL";
         $childErr = ">&DEVNULL";
     } else {
@@ -1351,7 +1351,7 @@ sub openHTTPDIfNeeded()
     open2(\*HTTPDIN, \*HTTPDOUT, $httpdPath, @args);
 
     my $retryCount = 20;
-    while (system("/usr/bin/curl -q --silent --stderr - --output /dev/null $listen") && $retryCount) {
+    while (system("/usr/bin/curl -q --silent --stderr - --output " . File::Spec->devnull() . " $listen") && $retryCount) {
         sleep 1;
         --$retryCount;
     }
diff --git a/WebKitTools/Scripts/sunspider-compare-results b/WebKitTools/Scripts/sunspider-compare-results
index ce87a23..a207d7a 100755
--- a/WebKitTools/Scripts/sunspider-compare-results
+++ b/WebKitTools/Scripts/sunspider-compare-results
@@ -107,9 +107,7 @@ sub pathToJSC()
 
     buildJSC();
 
-    my $productDir = productDir();
-    # FIXME: This hack should be pushed down into productDir()
-    $productDir .= "/JavaScriptCore" if (isQt() or isGtk());
+    my $productDir = jscProductDir();
 
     setupEnvironmentForExecution($productDir);
     return pathToBuiltJSC($productDir);
diff --git a/WebKitTools/Scripts/svn-apply b/WebKitTools/Scripts/svn-apply
index 19c8c56..7d14e3a 100755
--- a/WebKitTools/Scripts/svn-apply
+++ b/WebKitTools/Scripts/svn-apply
@@ -74,15 +74,12 @@ use VCSUtils;
 sub addDirectoriesIfNeeded($);
 sub applyPatch($$;$);
 sub checksum($);
-sub fixChangeLogPatch($);
-sub gitdiff2svndiff($);
 sub handleBinaryChange($$);
 sub isDirectoryEmptyForRemoval($);
 sub patch($);
 sub removeDirectoriesIfNeeded();
 sub setChangeLogDateAndReviewer($$);
 sub removeEOL($);
-sub svnStatus($);
 
 # These should be replaced by an scm class/module:
 sub scmKnowsOfFile($);
@@ -178,8 +175,9 @@ if ($merge) {
     die "--merge is currently only supported for SVN" unless isSVN();
     # How do we handle Git patches applied to an SVN checkout here?
     for my $file (sort keys %versions) {
-        print "Getting version $versions{$file} of $file\n";
-        system "svn", "update", "-r", $versions{$file}, $file;
+        my $version = $versions{$file};
+        print "Getting version $version of $file\n";
+        system("svn", "update", "-r", $version, $file) == 0 or die "Failed to run svn update -r $version $file.";
     }
 }
 
@@ -258,74 +256,6 @@ sub checksum($)
     return $checksum;
 }
 
-sub fixChangeLogPatch($)
-{
-    my $patch = shift;
-    my $contextLineCount = 3;
-
-    return $patch if $patch !~ /\n@@ -1,(\d+) \+1,(\d+) @@\r?\n( .*\r?\n)+(\+.*\r?\n)+( .*\r?\n){$contextLineCount}$/m;
-    my ($oldLineCount, $newLineCount) = ($1, $2);
-    return $patch if $oldLineCount <= $contextLineCount;
-
-    # The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
-    # have lines of context at the top of a patch when the existing entry has the same
-    # date and author as the new entry.  This nifty loop alters a ChangeLog patch so
-    # that the added lines ("+") in the patch always start at the beginning of the
-    # patch and there are no initial lines of context.
-    my $newPatch;
-    my $lineCountInState = 0;
-    my $oldContentLineCountReduction = $oldLineCount - $contextLineCount;
-    my $newContentLineCountWithoutContext = $newLineCount - $oldLineCount - $oldContentLineCountReduction;
-    my ($stateHeader, $statePreContext, $stateNewChanges, $statePostContext) = (1..4);
-    my $state = $stateHeader;
-    foreach my $line (split(/\n/, $patch)) {
-        $lineCountInState++;
-        if ($state == $stateHeader && $line =~ /^@@ -1,$oldLineCount \+1,$newLineCount @\@$/) {
-            $line = "@@ -1,$contextLineCount +1," . ($newLineCount - $oldContentLineCountReduction) . " @@";
-            $lineCountInState = 0;
-            $state = $statePreContext;
-        } elsif ($state == $statePreContext && substr($line, 0, 1) eq " ") {
-            $line = "+" . substr($line, 1);
-            if ($lineCountInState == $oldContentLineCountReduction) {
-                $lineCountInState = 0;
-                $state = $stateNewChanges;
-            }
-        } elsif ($state == $stateNewChanges && substr($line, 0, 1) eq "+") {
-            # No changes to these lines
-            if ($lineCountInState == $newContentLineCountWithoutContext) {
-                $lineCountInState = 0;
-                $state = $statePostContext;
-            }
-        } elsif ($state == $statePostContext) {
-            if (substr($line, 0, 1) eq "+" && $lineCountInState <= $oldContentLineCountReduction) {
-                $line = " " . substr($line, 1);
-            } elsif ($lineCountInState > $contextLineCount && substr($line, 0, 1) eq " ") {
-                next; # Discard
-            }
-        }
-        $newPatch .= $line . "\n";
-    }
-
-    return $newPatch;
-}
-
-sub gitdiff2svndiff($)
-{
-    $_ = shift @_;
-    if (m#^diff --git a/(.+) b/(.+)#) {
-        return "Index: $1";
-    } elsif (m/^new file.*/) {
-        return "";
-    } elsif (m#^index [0-9a-f]{7}\.\.[0-9a-f]{7} [0-9]{6}#) {
-        return "===================================================================";
-    } elsif (m#^--- a/(.+)#) {
-        return "--- $1";
-    } elsif (m#^\+\+\+ b/(.+)#) {
-        return "+++ $1";
-    }
-    return $_;
-}
-
 sub handleBinaryChange($$)
 {
     my ($fullPath, $contents) = @_;
@@ -334,7 +264,7 @@ sub handleBinaryChange($$)
     # The last line is allowed to have up to two '=' characters at the end (to signify padding).
     if ($contents =~ m#((\n[A-Za-z0-9+/]{76})*\n[A-Za-z0-9+/]{2,74}?[A-Za-z0-9+/=]{2}\n)#) {
         # Addition or Modification
-        open FILE, ">", $fullPath or die;
+        open FILE, ">", $fullPath or die "Failed to open $fullPath.";
         print FILE decode_base64($1);
         close FILE;
         if (!scmKnowsOfFile($fullPath)) {
@@ -373,6 +303,7 @@ sub patch($)
     unless ($patch =~ m|^Index: ([^\r\n]+)|) {
         my $separator = '-' x 67;
         warn "Failed to find 'Index:' in:\n$separator\n$patch\n$separator\n";
+        die unless $force;
         return;
     }
     my $fullPath = $1;
@@ -413,7 +344,7 @@ sub patch($)
             unlink("$fullPath.orig") if -e "$fullPath.orig" && checksum($fullPath) eq checksum("$fullPath.orig");
             scmAdd($fullPath);
             # What is this for?
-            system "svn", "stat", "$fullPath.orig" if isSVN() && -e "$fullPath.orig";
+            system("svn", "stat", "$fullPath.orig") if isSVN() && -e "$fullPath.orig";
         }
     }
 }
@@ -455,38 +386,6 @@ sub removeEOL($)
     return $line;
 }
 
-sub svnStatus($)
-{
-    my ($fullPath) = @_;
-    my $svnStatus;
-    open SVN, "svn status --non-interactive --non-recursive '$fullPath' |" or die;
-    if (-d $fullPath) {
-        # When running "svn stat" on a directory, we can't assume that only one
-        # status will be returned (since any files with a status below the
-        # directory will be returned), and we can't assume that the directory will
-        # be first (since any files with unknown status will be listed first).
-        my $normalizedFullPath = File::Spec->catdir(File::Spec->splitdir($fullPath));
-        while (<SVN>) {
-            # Input may use a different EOL sequence than $/, so avoid chomp.
-            $_ = removeEOL($_);
-            my $normalizedStatPath = File::Spec->catdir(File::Spec->splitdir(substr($_, 7)));
-            if ($normalizedFullPath eq $normalizedStatPath) {
-                $svnStatus = "$_\n";
-                last;
-            }
-        }
-        # Read the rest of the svn command output to avoid a broken pipe warning.
-        local $/ = undef;
-        <SVN>;
-    }
-    else {
-        # Files will have only one status returned.
-        $svnStatus = removeEOL(<SVN>) . "\n";
-    }
-    close SVN;
-    return $svnStatus;
-}
-
 # This could be made into a more general "status" call, except svn and git
 # have different ideas about "moving" files which might get confusing.
 sub scmWillDeleteFile($)
@@ -524,10 +423,10 @@ sub scmCopy($$)
 {
     my ($source, $destination) = @_;
     if (isSVN()) {
-        system "svn", "copy", $source, $destination;
+        system("svn", "copy", $source, $destination) == 0 or die "Failed to svn copy $source $destination.";
     } elsif (isGit()) {
-        system "cp", $source, $destination;
-        system "git", "add", $destination;
+        system("cp", $source, $destination) == 0 or die "Failed to copy $source $destination.";
+        system("git", "add", $destination) == 0 or die "Failed to git add $destination.";
     }
 }
 
@@ -535,9 +434,9 @@ sub scmAdd($)
 {
     my ($path) = @_;
     if (isSVN()) {
-        system "svn", "add", $path;
+        system("svn", "add", $path) == 0 or die "Failed to svn add $path.";
     } elsif (isGit()) {
-        system "git", "add", $path;
+        system("git", "add", $path) == 0 or die "Failed to git add $path.";
     }
 }
 
@@ -555,6 +454,6 @@ sub scmRemove($)
         close SVN;
         print $svnOutput if $svnOutput;
     } elsif (isGit()) {
-        system "git", "rm", "--force", $path;
+        system("git", "rm", "--force", $path) == 0 or die  "Failed to git rm --force $path.";
     }
 }
diff --git a/WebKitTools/Scripts/svn-create-patch b/WebKitTools/Scripts/svn-create-patch
index 3f40783..768a8ed 100755
--- a/WebKitTools/Scripts/svn-create-patch
+++ b/WebKitTools/Scripts/svn-create-patch
@@ -56,12 +56,10 @@ use Time::gmtime;
 use VCSUtils;
 
 sub binarycmp($$);
-sub canonicalizePath($);
 sub findBaseUrl($);
 sub findMimeType($;$);
 sub findModificationType($);
 sub findSourceFileAndRevision($);
-sub fixChangeLogPatch($);
 sub generateDiff($$);
 sub generateFileList($\%);
 sub isBinaryMimeType($);
@@ -132,25 +130,6 @@ sub binarycmp($$)
     return $fileDataA->{isBinary} <=> $fileDataB->{isBinary};
 }
 
-sub canonicalizePath($)
-{
-    my ($file) = @_;
-
-    # Remove extra slashes and '.' directories in path
-    $file = File::Spec->canonpath($file);
-
-    # Remove '..' directories in path
-    my @dirs = ();
-    foreach my $dir (File::Spec->splitdir($file)) {
-        if ($dir eq '..' && $#dirs >= 0 && $dirs[$#dirs] ne '..') {
-            pop(@dirs);
-        } else {
-            push(@dirs, $dir);
-        }
-    }
-    return ($#dirs >= 0) ? File::Spec->catdir(@dirs) : ".";
-}
-
 sub findBaseUrl($)
 {
     my ($infoPath) = @_;
@@ -211,57 +190,6 @@ sub findSourceFileAndRevision($)
     return ($sourceFile, $sourceRevision);
 }
 
-sub fixChangeLogPatch($)
-{
-    my $patch = shift;
-    my $contextLineCount = 3;
-
-    return $patch if $patch !~ /\n@@ -1,(\d+) \+1,(\d+) @@\n( .*\n)+(\+.*\n)+( .*\n){$contextLineCount}$/m;
-    my ($oldLineCount, $newLineCount) = ($1, $2);
-    return $patch if $oldLineCount <= $contextLineCount;
-
-    # The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
-    # have lines of context at the top of a patch when the existing entry has the same
-    # date and author as the new entry.  This nifty loop alters a ChangeLog patch so
-    # that the added lines ("+") in the patch always start at the beginning of the
-    # patch and there are no initial lines of context.
-    my $newPatch;
-    my $lineCountInState = 0;
-    my $oldContentLineCountReduction = $oldLineCount - $contextLineCount;
-    my $newContentLineCountWithoutContext = $newLineCount - $oldLineCount - $oldContentLineCountReduction;
-    my ($stateHeader, $statePreContext, $stateNewChanges, $statePostContext) = (1..4);
-    my $state = $stateHeader;
-    foreach my $line (split(/\n/, $patch)) {
-        $lineCountInState++;
-        if ($state == $stateHeader && $line =~ /^@@ -1,$oldLineCount \+1,$newLineCount @\@$/) {
-            $line = "@@ -1,$contextLineCount +1," . ($newLineCount - $oldContentLineCountReduction) . " @@";
-            $lineCountInState = 0;
-            $state = $statePreContext;
-        } elsif ($state == $statePreContext && substr($line, 0, 1) eq " ") {
-            $line = "+" . substr($line, 1);
-            if ($lineCountInState == $oldContentLineCountReduction) {
-                $lineCountInState = 0;
-                $state = $stateNewChanges;
-            }
-        } elsif ($state == $stateNewChanges && substr($line, 0, 1) eq "+") {
-            # No changes to these lines
-            if ($lineCountInState == $newContentLineCountWithoutContext) {
-                $lineCountInState = 0;
-                $state = $statePostContext;
-            }
-        } elsif ($state == $statePostContext) {
-            if (substr($line, 0, 1) eq "+" && $lineCountInState <= $oldContentLineCountReduction) {
-                $line = " " . substr($line, 1);
-            } elsif ($lineCountInState > $contextLineCount && substr($line, 0, 1) eq " ") {
-                next; # Discard
-            }
-        }
-        $newPatch .= $line . "\n";
-    }
-
-    return $newPatch;
-}
-
 sub generateDiff($$)
 {
     my ($fileData, $prefix) = @_;
diff --git a/WebKitTools/Scripts/svn-unapply b/WebKitTools/Scripts/svn-unapply
index a4cec9a..94bb1ce 100755
--- a/WebKitTools/Scripts/svn-unapply
+++ b/WebKitTools/Scripts/svn-unapply
@@ -71,12 +71,9 @@ use lib $FindBin::Bin;
 use VCSUtils;
 
 sub checksum($);
-sub fixChangeLogPatch($);
-sub gitdiff2svndiff($);
 sub patch($);
 sub revertDirectories();
 sub removeEOL($);
-sub svnStatus($);
 sub unapplyPatch($$;$);
 sub unsetChangeLogDate($$);
 
@@ -158,74 +155,6 @@ sub checksum($)
     return $checksum;
 }
 
-sub fixChangeLogPatch($)
-{
-    my $patch = shift;
-    my $contextLineCount = 3;
-
-    return $patch if $patch !~ /\n@@ -1,(\d+) \+1,(\d+) @@\n( .*\n)+(\+.*\n)+( .*\n){$contextLineCount}$/m;
-    my ($oldLineCount, $newLineCount) = ($1, $2);
-    return $patch if $oldLineCount <= $contextLineCount;
-
-    # The diff(1) command is greedy when matching lines, so a new ChangeLog entry will
-    # have lines of context at the top of a patch when the existing entry has the same
-    # date and author as the new entry.  This nifty loop alters a ChangeLog patch so
-    # that the added lines ("+") in the patch always start at the beginning of the
-    # patch and there are no initial lines of context.
-    my $newPatch;
-    my $lineCountInState = 0;
-    my $oldContentLineCountReduction = $oldLineCount - $contextLineCount;
-    my $newContentLineCountWithoutContext = $newLineCount - $oldLineCount - $oldContentLineCountReduction;
-    my ($stateHeader, $statePreContext, $stateNewChanges, $statePostContext) = (1..4);
-    my $state = $stateHeader;
-    foreach my $line (split(/\n/, $patch)) {
-        $lineCountInState++;
-        if ($state == $stateHeader && $line =~ /^@@ -1,$oldLineCount \+1,$newLineCount @\@$/) {
-            $line = "@@ -1,$contextLineCount +1," . ($newLineCount - $oldContentLineCountReduction) . " @@";
-            $lineCountInState = 0;
-            $state = $statePreContext;
-        } elsif ($state == $statePreContext && substr($line, 0, 1) eq " ") {
-            $line = "+" . substr($line, 1);
-            if ($lineCountInState == $oldContentLineCountReduction) {
-                $lineCountInState = 0;
-                $state = $stateNewChanges;
-            }
-        } elsif ($state == $stateNewChanges && substr($line, 0, 1) eq "+") {
-            # No changes to these lines
-            if ($lineCountInState == $newContentLineCountWithoutContext) {
-                $lineCountInState = 0;
-                $state = $statePostContext;
-            }
-        } elsif ($state == $statePostContext) {
-            if (substr($line, 0, 1) eq "+" && $lineCountInState <= $oldContentLineCountReduction) {
-                $line = " " . substr($line, 1);
-            } elsif ($lineCountInState > $contextLineCount && substr($line, 0, 1) eq " ") {
-                next; # Discard
-            }
-        }
-        $newPatch .= $line . "\n";
-    }
-
-    return $newPatch;
-}
-
-sub gitdiff2svndiff($)
-{
-    $_ = shift @_;
-    if (m#^diff --git a/(.+) b/(.+)#) {
-        return "Index: $1";
-    } elsif (m/^new file.*/) {
-        return "";
-    } elsif (m#^index [0-9a-f]{7}\.\.[0-9a-f]{7} [0-9]{6}#) {
-        return "===================================================================";
-    } elsif (m#^--- a/(.+)#) {
-        return "--- $1";
-    } elsif (m#^\+\+\+ b/(.+)#) {
-        return "+++ $1";
-    }
-    return $_;
-}
-
 sub patch($)
 {
     my ($patch) = @_;
@@ -338,38 +267,6 @@ sub removeEOL($)
     return $line;
 }
 
-sub svnStatus($)
-{
-    my ($fullPath) = @_;
-    my $svnStatus;
-    open SVN, "svn status --non-interactive --non-recursive '$fullPath' |" or die;
-    if (-d $fullPath) {
-        # When running "svn stat" on a directory, we can't assume that only one
-        # status will be returned (since any files with a status below the
-        # directory will be returned), and we can't assume that the directory will
-        # be first (since any files with unknown status will be listed first).
-        my $normalizedFullPath = File::Spec->catdir(File::Spec->splitdir($fullPath));
-        while (<SVN>) {
-            # Input may use a different EOL sequence than $/, so avoid chomp.
-            $_ = removeEOL($_);
-            my $normalizedStatPath = File::Spec->catdir(File::Spec->splitdir(substr($_, 7)));
-            if ($normalizedFullPath eq $normalizedStatPath) {
-                $svnStatus = "$_\n";
-                last;
-            }
-        }
-        # Read the rest of the svn command output to avoid a broken pipe warning.
-        local $/ = undef;
-        <SVN>;
-    }
-    else {
-        # Files will have only one status returned.
-        $svnStatus = removeEOL(<SVN>) . "\n";
-    }
-    close SVN;
-    return $svnStatus;
-}
-
 sub unapplyPatch($$;$)
 {
     my ($patch, $fullPath, $options) = @_;
diff --git a/WebKitTools/Scripts/update-webkit b/WebKitTools/Scripts/update-webkit
index e562cc0..b503004 100755
--- a/WebKitTools/Scripts/update-webkit
+++ b/WebKitTools/Scripts/update-webkit
@@ -39,7 +39,6 @@ use VCSUtils;
 use webkitdirs;
 
 sub runSvnUpdate();
-sub normalizePath($);
 
 # Handle options
 my $quiet = '';
@@ -105,10 +104,3 @@ sub runSvnUpdate()
             or die "Could not open resolve-ChangeLogs script: $!.\n";
     }
 }
-
-sub normalizePath($)
-{
-    my ($path) = @_;
-    $path =~ s/\\/\//g;
-    return $path;
-}
diff --git a/WebKitTools/Scripts/webkitdirs.pm b/WebKitTools/Scripts/webkitdirs.pm
index d5177dd..16f9c26 100644
--- a/WebKitTools/Scripts/webkitdirs.pm
+++ b/WebKitTools/Scripts/webkitdirs.pm
@@ -117,7 +117,7 @@ sub determineBaseProductDir
             unlink($personalPlistFile) || die "Could not delete $personalPlistFile: $!";
         }
 
-        open PRODUCT, "defaults read com.apple.Xcode PBXApplicationwideBuildSettings 2> /dev/null |" or die;
+        open PRODUCT, "defaults read com.apple.Xcode PBXApplicationwideBuildSettings 2> " . File::Spec->devnull() . " |" or die;
         $baseProductDir = join '', <PRODUCT>;
         close PRODUCT;
 
@@ -125,7 +125,7 @@ sub determineBaseProductDir
         undef $baseProductDir unless $baseProductDir =~ /^\//;
 
         if (!defined($baseProductDir)) {
-            open PRODUCT, "defaults read com.apple.Xcode PBXProductDirectory 2> /dev/null |" or die;
+            open PRODUCT, "defaults read com.apple.Xcode PBXProductDirectory 2> " . File::Spec->devnull() . " |" or die;
             $baseProductDir = <PRODUCT>;
             close PRODUCT;
             if ($baseProductDir) {
@@ -215,6 +215,14 @@ sub determineArchitecture
     }
 }
 
+sub jscPath($)
+{
+    my ($productDir) = @_;
+    my $jscName = "jsc";
+    $jscName .= "_debug"  if (isCygwin() && ($configuration eq "Debug"));
+    return "$productDir/$jscName";
+}
+
 sub argumentsForConfiguration()
 {
     determineConfiguration();
@@ -300,6 +308,16 @@ sub productDir
     return $configurationProductDir;
 }
 
+sub jscProductDir
+{
+    my $productDir = productDir();
+    $productDir .= "/JavaScriptCore" if isQt();
+    $productDir .= "/$configuration" if (isQt() && isWindows());
+    $productDir .= "/Programs" if isGtk();
+
+    return $productDir;
+}
+
 sub configuration()
 {
     determineConfiguration();
@@ -792,7 +810,7 @@ sub determineIsQt()
     }
 
     # The presence of QTDIR only means Qt if --gtk is not on the command-line
-    if (isGtk()) {
+    if (isGtk() || isWx()) {
         $isQt = 0;
         return;
     }
@@ -1100,7 +1118,12 @@ sub buildVisualStudioProject
         $action = "/clean";
     }
 
-    my @command = ($vcBuildPath, $winProjectPath, $action, $config);
+    my $useenv = "/useenv";
+    if (isChromium()) {
+        $useenv = "";
+    }
+
+    my @command = ($vcBuildPath, $useenv, $winProjectPath, $action, $config);
 
     print join(" ", @command), "\n";
     return system @command;
diff --git a/WebKitTools/WinLauncher/WinLauncher.vcproj b/WebKitTools/WinLauncher/WinLauncher.vcproj
index 5fddb48..9b7c42c 100644
--- a/WebKitTools/WinLauncher/WinLauncher.vcproj
+++ b/WebKitTools/WinLauncher/WinLauncher.vcproj
@@ -39,17 +39,10 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				Optimization="0"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(IntDir)\Include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

 				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_CRT_SECURE_NO_DEPRECATE"

-				MinimalRebuild="true"

-				ExceptionHandling="0"

-				BasicRuntimeChecks="3"

-				RuntimeLibrary="3"

-				RuntimeTypeInfo="false"

 				UsePrecompiledHeader="2"

 				WarningLevel="1"

-				Detect64BitPortabilityProblems="false"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -125,12 +118,8 @@
 				Name="VCCLCompilerTool"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\Include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitOutputDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(IntDir)\include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

 				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_CRT_SECURE_NO_DEPRECATE;_WIN32_WINNT=0x501"

-				ExceptionHandling="0"

-				RuntimeLibrary="2"

-				RuntimeTypeInfo="false"

 				UsePrecompiledHeader="2"

 				WarningLevel="1"

-				Detect64BitPortabilityProblems="false"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -206,17 +195,10 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				Optimization="0"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(IntDir)\Include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

 				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_CRT_SECURE_NO_DEPRECATE"

-				MinimalRebuild="true"

-				ExceptionHandling="0"

-				BasicRuntimeChecks="3"

-				RuntimeLibrary="3"

-				RuntimeTypeInfo="false"

 				UsePrecompiledHeader="2"

 				WarningLevel="1"

-				Detect64BitPortabilityProblems="false"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -289,17 +271,86 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				Optimization="0"

 				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(IntDir)\Include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

 				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_CRT_SECURE_NO_DEPRECATE"

-				MinimalRebuild="true"

-				ExceptionHandling="0"

-				BasicRuntimeChecks="3"

-				RuntimeLibrary="3"

-				RuntimeTypeInfo="false"

 				UsePrecompiledHeader="2"

 				WarningLevel="1"

-				Detect64BitPortabilityProblems="false"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				LinkLibraryDependencies="false"

+				AdditionalDependencies="comctl32.lib shlwapi.lib user32.lib ole32.lib oleaut32.lib WebKitGUID$(WebKitConfigSuffix).lib WebKit$(WebKitDLLConfigSuffix).lib"

+				LinkIncremental="2"

+				AdditionalLibraryDirectories="&quot;$(WebKitOutputDir)\lib&quot;;&quot;$(ProjectDir)\..\..\..\&quot;"

+				GenerateDebugInformation="true"

+				SubSystem="2"

+				TargetMachine="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+				TypeLibraryFile=""

+				ComponentFileName=""

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include\WebKit&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\WebCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(ProjectDir)&quot;;&quot;$(IntDir)\Include&quot;;&quot;$(WebKitOutputDir)\obj\WebKit\DerivedSources&quot;"

+				PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_CRT_SECURE_NO_DEPRECATE"

+				UsePrecompiledHeader="2"

+				WarningLevel="1"

 			/>

 			<Tool

 				Name="VCManagedResourceCompilerTool"

@@ -392,6 +443,14 @@
 						UsePrecompiledHeader="1"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+						UsePrecompiledHeader="1"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath=".\WinLauncher.cpp"

diff --git a/WebKitTools/pywebsocket/COPYING b/WebKitTools/pywebsocket/COPYING
new file mode 100644
index 0000000..ab9d52d
--- /dev/null
+++ b/WebKitTools/pywebsocket/COPYING
@@ -0,0 +1,28 @@
+Copyright 2009, Google Inc.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+    * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/WebKitTools/pywebsocket/MANIFEST.in b/WebKitTools/pywebsocket/MANIFEST.in
new file mode 100644
index 0000000..1925688
--- /dev/null
+++ b/WebKitTools/pywebsocket/MANIFEST.in
@@ -0,0 +1,6 @@
+include COPYING
+include MANIFEST.in
+include README
+recursive-include example *.py
+recursive-include mod_pywebsocket *.py
+recursive-include test *.py
diff --git a/WebKitTools/pywebsocket/README b/WebKitTools/pywebsocket/README
new file mode 100644
index 0000000..1f9f05f
--- /dev/null
+++ b/WebKitTools/pywebsocket/README
@@ -0,0 +1,6 @@
+Install this package by:
+$ python setup.py build
+$ sudo python setup.py install
+
+Then read document by:
+$ pydoc mod_pywebsocket
diff --git a/WebKitTools/pywebsocket/example/echo_client.py b/WebKitTools/pywebsocket/example/echo_client.py
new file mode 100644
index 0000000..61b129c
--- /dev/null
+++ b/WebKitTools/pywebsocket/example/echo_client.py
@@ -0,0 +1,195 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Web Socket Echo client.
+
+This is an example Web Socket client that talks with echo_wsh.py.
+This may be useful for checking mod_pywebsocket installation.
+
+Note:
+This code is far from robust, e.g., we cut corners in handshake.
+"""
+
+
+import codecs
+from optparse import OptionParser
+import socket
+import sys
+
+
+_DEFAULT_PORT = 80
+_DEFAULT_SECURE_PORT = 443
+_UNDEFINED_PORT = -1
+
+_UPGRADE_HEADER = 'Upgrade: WebSocket\r\n'
+_CONNECTION_HEADER = 'Connection: Upgrade\r\n'
+_EXPECTED_RESPONSE = (
+        'HTTP/1.1 101 Web Socket Protocol Handshake\r\n' +
+        _UPGRADE_HEADER +
+        _CONNECTION_HEADER)
+
+
+def _method_line(resource):
+    return 'GET %s HTTP/1.1\r\n' % resource
+
+
+def _origin_header(origin):
+    return 'Origin: %s\r\n' % origin
+
+
+class _TLSSocket(object):
+    """Wrapper for a TLS connection."""
+
+    def __init__(self, raw_socket):
+        self._ssl = socket.ssl(raw_socket)
+
+    def send(self, bytes):
+        return self._ssl.write(bytes)
+
+    def recv(self, size=-1):
+        return self._ssl.read(size)
+
+    def close(self):
+        # Nothing to do.
+        pass
+
+
+class EchoClient(object):
+    """Web Socket echo client."""
+
+    def __init__(self, options):
+        self._options = options
+        self._socket = None
+
+    def run(self):
+        """Run the client.
+
+        Shake hands and then repeat sending message and receiving its echo.
+        """
+        self._socket = socket.socket()
+        try:
+            self._socket.connect((self._options.server_host,
+                                  self._options.server_port))
+            if self._options.use_tls:
+                self._socket = _TLSSocket(self._socket)
+            self._handshake()
+            for line in self._options.message.split(','):
+                frame = '\x00' + line.encode('utf-8') + '\xff'
+                self._socket.send(frame)
+                if self._options.verbose:
+                    print 'Send: %s' % line
+                received = self._socket.recv(len(frame))
+                if received != frame:
+                    raise Exception('Incorrect echo: %r' % received)
+                if self._options.verbose:
+                    print 'Recv: %s' % received[1:-1].decode('utf-8')
+        finally:
+            self._socket.close()
+
+    def _handshake(self):
+        self._socket.send(_method_line(self._options.resource))
+        self._socket.send(_UPGRADE_HEADER)
+        self._socket.send(_CONNECTION_HEADER)
+        self._socket.send(self._format_host_header())
+        self._socket.send(_origin_header(self._options.origin))
+        self._socket.send('\r\n')
+
+        for expected_char in _EXPECTED_RESPONSE:
+            received = self._socket.recv(1)[0]
+            if expected_char != received:
+                raise Exception('Handshake failure')
+        # We cut corners and skip other headers.
+        self._skip_headers()
+
+    def _skip_headers(self):
+        terminator = '\r\n\r\n'
+        pos = 0
+        while pos < len(terminator):
+            received = self._socket.recv(1)[0]
+            if received == terminator[pos]:
+                pos += 1
+            elif received == terminator[0]:
+                pos = 1
+            else:
+                pos = 0
+
+    def _format_host_header(self):
+        host = 'Host: ' + self._options.server_host
+        if ((not self._options.use_tls and
+             self._options.server_port != _DEFAULT_PORT) or
+            (self._options.use_tls and
+             self._options.server_port != _DEFAULT_SECURE_PORT)):
+            host += ':' + str(self._options.server_port)
+        host += '\r\n'
+        return host
+
+
+def main():
+    sys.stdout = codecs.getwriter('utf-8')(sys.stdout)
+
+    parser = OptionParser()
+    parser.add_option('-s', '--server_host', dest='server_host', type='string',
+                      default='localhost', help='server host')
+    parser.add_option('-p', '--server_port', dest='server_port', type='int',
+                      default=_UNDEFINED_PORT, help='server port')
+    parser.add_option('-o', '--origin', dest='origin', type='string',
+                      default='http://localhost/', help='origin')
+    parser.add_option('-r', '--resource', dest='resource', type='string',
+                      default='/echo', help='resource path')
+    parser.add_option('-m', '--message', dest='message', type='string',
+                      help='comma-separated messages to send')
+    parser.add_option('-q', '--quiet', dest='verbose', action='store_false',
+                      default=True, help='suppress messages')
+    parser.add_option('-t', '--tls', dest='use_tls', action='store_true',
+                      default=False, help='use TLS (wss://)')
+    (options, unused_args) = parser.parse_args()
+
+    # Default port number depends on whether TLS is used.
+    if options.server_port == _UNDEFINED_PORT:
+        if options.use_tls:
+            options.server_port = _DEFAULT_SECURE_PORT
+        else:
+            options.server_port = _DEFAULT_PORT
+
+    # optparse doesn't seem to handle non-ascii default values.
+    # Set default message here.
+    if not options.message:
+        options.message = u'Hello,\u65e5\u672c'   # "Japan" in Japanese
+
+    EchoClient(options).run()
+
+
+if __name__ == '__main__':
+    main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/example/echo_wsh.py b/WebKitTools/pywebsocket/example/echo_wsh.py
new file mode 100644
index 0000000..f680fa5
--- /dev/null
+++ b/WebKitTools/pywebsocket/example/echo_wsh.py
@@ -0,0 +1,44 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+from mod_pywebsocket import msgutil
+
+
+def web_socket_do_extra_handshake(request):
+    pass  # Always accept.
+
+
+def web_socket_transfer_data(request):
+    while True:
+        line = msgutil.receive_message(request)
+        msgutil.send_message(request, line)
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py b/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py
new file mode 100644
index 0000000..beacc9e
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/__init__.py
@@ -0,0 +1,102 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Web Socket extension for Apache HTTP Server.
+
+mod_pywebsocket is a Web Socket extension for Apache HTTP Server
+intended for testing or experimental purposes. mod_python is required.
+
+Installation:
+
+0. Prepare an Apache HTTP Server for which mod_python is enabled.
+
+1. Specify the following Apache HTTP Server directives to suit your
+   configuration.
+
+   If mod_pywebsocket is not in the Python path, specify the following.
+   <websock_lib> is the directory where mod_pywebsocket is installed.
+
+       PythonPath "sys.path+['<websock_lib>']"
+
+   Always specify the following. <websock_handlers> is the directory where
+   user-written Web Socket handlers are placed.
+
+       PythonOption mod_pywebsocket.handler_root <websock_handlers>
+       PythonHeaderParserHandler mod_pywebsocket.headerparserhandler
+
+   To limit the search for Web Socket handlers to a directory <scan_dir>
+   under <websock_handlers>, configure as follows:
+   
+       PythonOption mod_pywebsocket.handler_scan <scan_dir>
+       
+   <scan_dir> is useful in saving scan time when <websock_handlers>
+   contains many non-Web Socket handler files.
+
+   Example snippet of httpd.conf:
+   (mod_pywebsocket is in /websock_lib, Web Socket handlers are in
+   /websock_handlers, port is 80 for ws, 443 for wss.)
+
+       <IfModule python_module>
+         PythonPath "sys.path+['/websock_lib']"
+         PythonOption mod_pywebsocket.handler_root /websock_handlers
+         PythonHeaderParserHandler mod_pywebsocket.headerparserhandler
+       </IfModule>
+
+Writing Web Socket handlers:
+
+When a Web Socket request comes in, the resource name
+specified in the handshake is considered as if it is a file path under
+<websock_handlers> and the handler defined in
+<websock_handlers>/<resource_name>_wsh.py is invoked.
+
+For example, if the resource name is /example/chat, the handler defined in
+<websock_handlers>/example/chat_wsh.py is invoked.
+
+A Web Socket handler is composed of the following two functions:
+
+    web_socket_do_extra_handshake(request)
+    web_socket_transfer_data(request)
+
+where:
+    request: mod_python request.
+
+web_socket_do_extra_handshake is called during the handshake after the
+headers are successfully parsed and Web Socket properties (ws_location,
+ws_origin, ws_protocol, and ws_resource) are added to request. A handler
+can reject the request by raising an exception.
+
+web_socket_transfer_data is called after the handshake completed
+successfully. A handler can receive/send messages from/to the client
+using request. mod_pywebsocket.msgutil module provides utilities
+for data transfer.
+"""
+
+
+# vi:sts=4 sw=4 et tw=72
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py b/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py
new file mode 100644
index 0000000..84422eb
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/dispatch.py
@@ -0,0 +1,205 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Dispatch Web Socket request.
+"""
+
+
+import os
+import re
+
+import util
+
+
+_SOURCE_PATH_PATTERN = re.compile(r'(?i)_wsh\.py$')
+_SOURCE_SUFFIX = '_wsh.py'
+_DO_EXTRA_HANDSHAKE_HANDLER_NAME = 'web_socket_do_extra_handshake'
+_TRANSFER_DATA_HANDLER_NAME = 'web_socket_transfer_data'
+
+
+class DispatchError(Exception):
+    """Exception in dispatching Web Socket request."""
+
+    pass
+
+
+def _normalize_path(path):
+    """Normalize path.
+
+    Args:
+        path: the path to normalize.
+
+    Path is converted to the absolute path.
+    The input path can use either '\\' or '/' as the separator.
+    The normalized path always uses '/' regardless of the platform.
+    """
+
+    path = path.replace('\\', os.path.sep)
+    path = os.path.abspath(path)
+    path = path.replace('\\', '/')
+    return path
+
+
+def _path_to_resource_converter(base_dir):
+    base_dir = _normalize_path(base_dir)
+    base_len = len(base_dir)
+    suffix_len = len(_SOURCE_SUFFIX)
+    def converter(path):
+        if not path.endswith(_SOURCE_SUFFIX):
+            return None
+        path = _normalize_path(path)
+        if not path.startswith(base_dir):
+            return None
+        return path[base_len:-suffix_len]
+    return converter
+
+
+def _source_file_paths(directory):
+    """Yield Web Socket Handler source file names in the given directory."""
+
+    for root, unused_dirs, files in os.walk(directory):
+        for base in files:
+            path = os.path.join(root, base)
+            if _SOURCE_PATH_PATTERN.search(path):
+                yield path
+
+
+def _source(source_str):
+    """Source a handler definition string."""
+
+    global_dic = {}
+    try:
+        exec source_str in global_dic
+    except Exception:
+        raise DispatchError('Error in sourcing handler:' +
+                            util.get_stack_trace())
+    return (_extract_handler(global_dic, _DO_EXTRA_HANDSHAKE_HANDLER_NAME),
+            _extract_handler(global_dic, _TRANSFER_DATA_HANDLER_NAME))
+
+
+def _extract_handler(dic, name):
+    if name not in dic:
+        raise DispatchError('%s is not defined.' % name)
+    handler = dic[name]
+    if not callable(handler):
+        raise DispatchError('%s is not callable.' % name)
+    return handler
+
+
+class Dispatcher(object):
+    """Dispatches Web Socket requests.
+
+    This class maintains a map from resource name to handlers.
+    """
+
+    def __init__(self, root_dir, scan_dir=None):
+        """Construct an instance.
+
+        Args:
+            root_dir: The directory where handler definition files are
+                      placed.
+            scan_dir: The directory where handler definition files are
+                      searched. scan_dir must be a directory under root_dir,
+                      including root_dir itself.  If scan_dir is None, root_dir
+                      is used as scan_dir. scan_dir can be useful in saving
+                      scan time when root_dir contains many subdirectories.
+        """
+
+        self._handlers = {}
+        self._source_warnings = []
+        if scan_dir is None:
+            scan_dir = root_dir
+        if not os.path.abspath(scan_dir).startswith(os.path.abspath(root_dir)):
+            raise DispatchError('scan_dir:%s must be a directory under '
+                                'root_dir:%s.' % (scan_dir, root_dir))
+        self._source_files_in_dir(root_dir, scan_dir)
+
+    def source_warnings(self):
+        """Return warnings in sourcing handlers."""
+
+        return self._source_warnings
+
+    def do_extra_handshake(self, request):
+        """Do extra checking in Web Socket handshake.
+
+        Select a handler based on request.uri and call its
+        web_socket_do_extra_handshake function.
+
+        Args:
+            request: mod_python request.
+        """
+
+        do_extra_handshake_, unused_transfer_data = self._handler(request)
+        try:
+            do_extra_handshake_(request)
+        except Exception:
+            raise DispatchError('%s raised exception: %s' %
+                    (_DO_EXTRA_HANDSHAKE_HANDLER_NAME, util.get_stack_trace()))
+
+    def transfer_data(self, request):
+        """Let a handler transfer_data with a Web Socket client.
+
+        Select a handler based on request.ws_resource and call its
+        web_socket_transfer_data function.
+
+        Args:
+            request: mod_python request.
+        """
+
+        unused_do_extra_handshake, transfer_data_ = self._handler(request)
+        try:
+            transfer_data_(request)
+        except Exception:
+            raise DispatchError('%s raised exception: %s' %
+                    (_TRANSFER_DATA_HANDLER_NAME, util.get_stack_trace()))
+
+    def _handler(self, request):
+        try:
+            return self._handlers[request.ws_resource]
+        except KeyError:
+            raise DispatchError('No handler for: %r' % request.ws_resource)
+
+    def _source_files_in_dir(self, root_dir, scan_dir):
+        """Source all the handler source files in the scan_dir directory.
+        
+        The resource path is determined relative to root_dir.
+        """
+
+        to_resource = _path_to_resource_converter(root_dir)
+        for path in _source_file_paths(scan_dir):
+            try:
+                handlers = _source(open(path).read())
+            except DispatchError, e:
+                self._source_warnings.append('%s: %s' % (path, e))
+                continue
+            self._handlers[to_resource(path)] = handlers
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/handshake.py b/WebKitTools/pywebsocket/mod_pywebsocket/handshake.py
new file mode 100644
index 0000000..a67aadd
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/handshake.py
@@ -0,0 +1,178 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Web Socket handshaking.
+
+Note: request.connection.write/read are used in this module, even though
+mod_python document says that they should be used only in connection handlers.
+Unfortunately, we have no other options. For example, request.write/read are
+not suitable because they don't allow direct raw bytes writing/reading.
+"""
+
+
+import re
+
+
+_DEFAULT_WEB_SOCKET_PORT = 80
+_DEFAULT_WEB_SOCKET_SECURE_PORT = 443
+_WEB_SOCKET_SCHEME = 'ws'
+_WEB_SOCKET_SECURE_SCHEME = 'wss'
+
+_METHOD_LINE = re.compile(r'^GET ([^ ]+) HTTP/1.1\r\n$')
+
+_MANDATORY_HEADERS = [
+    # key, expected value or None
+    ['Upgrade', 'WebSocket'],
+    ['Connection', 'Upgrade'],
+    ['Host', None],
+    ['Origin', None],
+]
+
+
+def _default_port(is_secure):
+    if is_secure:
+        return _DEFAULT_WEB_SOCKET_SECURE_PORT
+    else:
+        return _DEFAULT_WEB_SOCKET_PORT
+
+
+class HandshakeError(Exception):
+    """Exception in Web Socket Handshake."""
+
+    pass
+
+
+def _validate_protocol(protocol):
+    """Validate WebSocket-Protocol string."""
+
+    if not protocol:
+        raise HandshakeError('Invalid WebSocket-Protocol: empty')
+    for c in protocol:
+        if not 0x21 <= ord(c) <= 0x7e:
+            raise HandshakeError('Illegal character in protocol: %r' % c)
+
+
+class Handshaker(object):
+    """This class performs Web Socket handshake."""
+
+    def __init__(self, request, dispatcher):
+        """Construct an instance.
+
+        Args:
+            request: mod_python request.
+            dispatcher: Dispatcher (dispatch.Dispatcher).
+
+        Handshaker will add attributes such as ws_resource in performing
+        handshake.
+        """
+
+        self._request = request
+        self._dispatcher = dispatcher
+
+    def do_handshake(self):
+        """Perform Web Socket Handshake."""
+
+        self._check_header_lines()
+        self._set_resource()
+        self._set_origin()
+        self._set_location()
+        self._set_protocol()
+        self._dispatcher.do_extra_handshake(self._request)
+        self._send_handshake()
+
+    def _set_resource(self):
+        self._request.ws_resource = self._request.uri
+
+    def _set_origin(self):
+        self._request.ws_origin = self._request.headers_in['Origin']
+
+    def _set_location(self):
+        location_parts = []
+        if self._request.is_https():
+            location_parts.append(_WEB_SOCKET_SECURE_SCHEME)
+        else:
+            location_parts.append(_WEB_SOCKET_SCHEME)
+        location_parts.append('://')
+        host, port = self._parse_host_header()
+        connection_port = self._request.connection.local_addr[1]
+        if port != connection_port:
+            raise HandshakeError('Header/connection port mismatch: %d/%d' %
+                                 (port, connection_port))
+        location_parts.append(host)
+        if (port != _default_port(self._request.is_https())):
+            location_parts.append(':')
+            location_parts.append(str(port))
+        location_parts.append(self._request.uri)
+        self._request.ws_location = ''.join(location_parts)
+
+    def _parse_host_header(self):
+        fields = self._request.headers_in['Host'].split(':', 1)
+        if len(fields) == 1:
+            return fields[0], _default_port(self._request.is_https())
+        try:
+            return fields[0], int(fields[1])
+        except ValueError, e:
+            raise HandshakeError('Invalid port number format: %r' % e)
+
+    def _set_protocol(self):
+        protocol = self._request.headers_in.get('WebSocket-Protocol')
+        if protocol is not None:
+            _validate_protocol(protocol)
+        self._request.ws_protocol = protocol
+
+    def _send_handshake(self):
+        self._request.connection.write(
+                'HTTP/1.1 101 Web Socket Protocol Handshake\r\n')
+        self._request.connection.write('Upgrade: WebSocket\r\n')
+        self._request.connection.write('Connection: Upgrade\r\n')
+        self._request.connection.write('WebSocket-Origin: ')
+        self._request.connection.write(self._request.ws_origin)
+        self._request.connection.write('\r\n')
+        self._request.connection.write('WebSocket-Location: ')
+        self._request.connection.write(self._request.ws_location)
+        self._request.connection.write('\r\n')
+        if self._request.ws_protocol:
+            self._request.connection.write('WebSocket-Protocol: ')
+            self._request.connection.write(self._request.ws_protocol)
+            self._request.connection.write('\r\n')
+        self._request.connection.write('\r\n')
+
+    def _check_header_lines(self):
+        for key, expected_value in _MANDATORY_HEADERS:
+            actual_value = self._request.headers_in.get(key)
+            if not actual_value:
+                raise HandshakeError('Header %s is not defined' % key)
+            if expected_value:
+                if actual_value != expected_value:
+                    raise HandshakeError('Illegal value for header %s: %s' %
+                                         (key, actual_value))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/headerparserhandler.py b/WebKitTools/pywebsocket/mod_pywebsocket/headerparserhandler.py
new file mode 100644
index 0000000..124b9f1
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/headerparserhandler.py
@@ -0,0 +1,99 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""PythonHeaderParserHandler for mod_pywebsocket.
+
+Apache HTTP Server and mod_python must be configured such that this
+function is called to handle Web Socket request.
+"""
+
+
+from mod_python import apache
+
+import dispatch
+import handshake
+import util
+
+
+# PythonOption to specify the handler root directory.
+_PYOPT_HANDLER_ROOT = 'mod_pywebsocket.handler_root'
+
+# PythonOption to specify the handler scan directory.
+# This must be a directory under the root directory.
+# The default is the root directory.
+_PYOPT_HANDLER_SCAN = 'mod_pywebsocket.handler_scan'
+
+
+def _create_dispatcher():
+    _HANDLER_ROOT = apache.main_server.get_options().get(
+            _PYOPT_HANDLER_ROOT, None)
+    if not _HANDLER_ROOT:
+        raise Exception('PythonOption %s is not defined' % _PYOPT_HANDLER_ROOT,
+                        apache.APLOG_ERR)
+    _HANDLER_SCAN = apache.main_server.get_options().get(
+            _PYOPT_HANDLER_SCAN, _HANDLER_ROOT)
+    dispatcher = dispatch.Dispatcher(_HANDLER_ROOT, _HANDLER_SCAN)
+    for warning in dispatcher.source_warnings():
+        apache.log_error('mod_pywebsocket: %s' % warning, apache.APLOG_WARNING)
+    return dispatcher
+
+
+# Initialize
+_dispatcher = _create_dispatcher()
+
+
+def headerparserhandler(request):
+    """Handle request.
+
+    Args:
+        request: mod_python request.
+
+    This function is named headerparserhandler because it is the default name
+    for a PythonHeaderParserHandler.
+    """
+
+    try:
+        handshaker = handshake.Handshaker(request, _dispatcher)
+        handshaker.do_handshake()
+        request.log_error('mod_pywebsocket: resource: %r' % request.ws_resource,
+                          apache.APLOG_DEBUG)
+        _dispatcher.transfer_data(request)
+    except handshake.HandshakeError, e:
+        # Handshake for ws/wss failed.
+        # But the request can be valid http/https request.
+        request.log_error('mod_pywebsocket: %s' % e, apache.APLOG_INFO)
+        return apache.DECLINED
+    except dispatch.DispatchError, e:
+        request.log_error('mod_pywebsocket: %s' % e, apache.APLOG_WARNING)
+        return apache.DECLINED
+    return apache.DONE  # Return DONE such that no other handlers are invoked.
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py b/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py
new file mode 100644
index 0000000..bdb554d
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/msgutil.py
@@ -0,0 +1,223 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Message related utilities.
+
+Note: request.connection.write/read are used in this module, even though
+mod_python document says that they should be used only in connection handlers.
+Unfortunately, we have no other options. For example, request.write/read are
+not suitable because they don't allow direct raw bytes writing/reading.
+"""
+
+
+import Queue
+import threading
+
+
+def send_message(request, message):
+    """Send message.
+
+    Args:
+        request: mod_python request.
+        message: unicode string to send.
+    """
+
+    request.connection.write('\x00' + message.encode('utf-8') + '\xff')
+
+
+def receive_message(request):
+    """Receive a Web Socket frame and return its payload as unicode string.
+
+    Args:
+        request: mod_python request.
+    """
+
+    while True:
+        # Read 1 byte.
+        # mp_conn.read will block if no bytes are available.
+        # Timeout is controlled by TimeOut directive of Apache.
+        frame_type_str = request.connection.read(1)
+        frame_type = ord(frame_type_str[0])
+        if (frame_type & 0x80) == 0x80:
+            # The payload length is specified in the frame.
+            # Read and discard.
+            length = _payload_length(request)
+            _receive_bytes(request, length)
+        else:
+            # The payload is delimited with \xff.
+            bytes = _read_until(request, '\xff')
+            message = bytes.decode('utf-8')
+            if frame_type == 0x00:
+                return message
+            # Discard data of other types.
+
+
+def _payload_length(request):
+    length = 0
+    while True:
+        b_str = request.connection.read(1)
+        b = ord(b_str[0])
+        length = length * 128 + (b & 0x7f)
+        if (b & 0x80) == 0:
+            break
+    return length
+
+
+def _receive_bytes(request, length):
+    bytes = []
+    while length > 0:
+        new_bytes = request.connection.read(length)
+        bytes.append(new_bytes)
+        length -= len(new_bytes)
+    return ''.join(bytes)
+
+
+def _read_until(request, delim_char):
+    bytes = []
+    while True:
+        ch = request.connection.read(1)
+        if ch == delim_char:
+            break
+        bytes.append(ch)
+    return ''.join(bytes)
+
+
+class MessageReceiver(threading.Thread):
+    """This class receives messages from the client.
+
+    This class provides three ways to receive messages: blocking, non-blocking,
+    and via callback. Callback has the highest precedence.
+
+    Note: This class should not be used with the standalone server for wss
+    because pyOpenSSL used by the server raises a fatal error if the socket
+    is accessed from multiple threads.
+    """
+    def __init__(self, request, onmessage=None):
+        """Construct an instance.
+
+        Args:
+            request: mod_python request.
+            onmessage: a function to be called when a message is received.
+                       May be None. If not None, the function is called on
+                       another thread. In that case, MessageReceiver.receive
+                       and MessageReceiver.receive_nowait are useless because
+                       they will never return any messages.
+        """
+        threading.Thread.__init__(self)
+        self._request = request
+        self._queue = Queue.Queue()
+        self._onmessage = onmessage
+        self._stop_requested = False
+        self.setDaemon(True)
+        self.start()
+
+    def run(self):
+        while not self._stop_requested:
+            message = receive_message(self._request)
+            if self._onmessage:
+                self._onmessage(message)
+            else:
+                self._queue.put(message)
+
+    def receive(self):
+        """ Receive a message from the channel, blocking.
+
+        Returns:
+            message as a unicode string.
+        """
+        return self._queue.get()
+
+    def receive_nowait(self):
+        """ Receive a message from the channel, non-blocking.
+
+        Returns:
+            message as a unicode string if available. None otherwise.
+        """
+        try:
+            message = self._queue.get_nowait()
+        except Queue.Empty:
+            message = None
+        return message
+
+    def stop(self):
+        """Request to stop this instance.
+
+        The instance will be stopped after receiving the next message.
+        This method may not be very useful, but there is no clean way
+        in Python to forcefully stop a running thread.
+        """
+        self._stop_requested = True
+
+
+class MessageSender(threading.Thread):
+    """This class sends messages to the client.
+
+    This class provides both synchronous and asynchronous ways to send
+    messages.
+
+    Note: This class should not be used with the standalone server for wss
+    because pyOpenSSL used by the server raises a fatal error if the socket
+    is accessed from multiple threads.
+    """
+    def __init__(self, request):
+        """Construct an instance.
+
+        Args:
+            request: mod_python request.
+        """
+        threading.Thread.__init__(self)
+        self._request = request
+        self._queue = Queue.Queue()
+        self.setDaemon(True)
+        self.start()
+
+    def run(self):
+        while True:
+            message, condition = self._queue.get()
+            condition.acquire()
+            send_message(self._request, message)
+            condition.notify()
+            condition.release()
+
+    def send(self, message):
+        """Send a message, blocking."""
+
+        condition = threading.Condition()
+        condition.acquire()
+        self._queue.put((message, condition))
+        condition.wait()
+
+    def send_nowait(self, message):
+        """Send a message, non-blocking."""
+
+        self._queue.put((message, threading.Condition()))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py b/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py
new file mode 100644
index 0000000..a4c142b
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/standalone.py
@@ -0,0 +1,254 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Standalone Web Socket server.
+
+Use this server to run mod_pywebsocket without Apache HTTP Server.
+
+Usage:
+    python standalone.py [-p <ws_port>] [-w <websock_handlers>]
+                         [-s <scan_dir>]
+                         [-d <document_root>]
+
+<ws_port> is the port number to use for ws:// connection.
+
+<document_root> is the path to the root directory of HTML files.
+
+<websock_handlers> is the path to the root directory of Web Socket handlers.
+See __init__.py for details of <websock_handlers> and how to write Web Socket
+handlers. If this path is relative, <document_root> is used as the base.
+
+<scan_dir> is a path under the root directory. If specified, only the handlers
+under scan_dir are scanned. This is useful in saving scan time.
+
+Note:
+This server is derived from SocketServer.ThreadingMixIn. Hence a thread is
+used for each request.
+"""
+
+import BaseHTTPServer
+import SimpleHTTPServer
+import SocketServer
+import logging
+import optparse
+import os
+import socket
+import sys
+
+_HAS_OPEN_SSL = False
+try:
+    import OpenSSL.SSL
+    _HAS_OPEN_SSL = True
+except ImportError:
+    pass
+
+import dispatch
+import handshake
+
+
+class _StandaloneConnection(object):
+    """Mimic mod_python mp_conn."""
+
+    def __init__(self, request_handler):
+        """Construct an instance.
+
+        Args:
+            request_handler: A WebSocketRequestHandler instance.
+        """
+        self._request_handler = request_handler
+
+    def get_local_addr(self):
+        """Getter to mimic mp_conn.local_addr."""
+        return (self._request_handler.server.server_name,
+                self._request_handler.server.server_port)
+    local_addr = property(get_local_addr)
+
+    def write(self, data):
+        """Mimic mp_conn.write()."""
+        return self._request_handler.wfile.write(data)
+
+    def read(self, length):
+        """Mimic mp_conn.read()."""
+        return self._request_handler.rfile.read(length)
+
+
+class _StandaloneRequest(object):
+    """Mimic mod_python request."""
+
+    def __init__(self, request_handler, use_tls):
+        """Construct an instance.
+
+        Args:
+            request_handler: A WebSocketRequestHandler instance.
+        """
+        self._request_handler = request_handler
+        self.connection = _StandaloneConnection(request_handler)
+        self._use_tls = use_tls
+
+    def get_uri(self):
+        """Getter to mimic request.uri."""
+        return self._request_handler.path
+    uri = property(get_uri)
+
+    def get_headers_in(self):
+        """Getter to mimic request.headers_in."""
+        return self._request_handler.headers
+    headers_in = property(get_headers_in)
+
+    def is_https(self):
+        """Mimic request.is_https()."""
+        return self._use_tls
+
+
+class WebSocketServer(SocketServer.ThreadingMixIn, BaseHTTPServer.HTTPServer):
+    """HTTPServer specialized for Web Socket."""
+
+    SocketServer.ThreadingMixIn.daemon_threads = True
+
+    def __init__(self, server_address, RequestHandlerClass):
+        """Override SocketServer.BaseServer.__init__."""
+
+        SocketServer.BaseServer.__init__(
+                self, server_address, RequestHandlerClass)
+        self.socket = self._create_socket()
+        self.server_bind()
+        self.server_activate()
+
+    def _create_socket(self):
+        socket_ = socket.socket(self.address_family, self.socket_type)
+        if WebSocketServer.options.use_tls:
+            ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
+            ctx.use_privatekey_file(WebSocketServer.options.private_key)
+            ctx.use_certificate_file(WebSocketServer.options.certificate)
+            socket_ = OpenSSL.SSL.Connection(ctx, socket_)
+        return socket_
+
+class WebSocketRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
+    """SimpleHTTPRequestHandler specialized for Web Socket."""
+
+    def setup(self):
+        """Override SocketServer.StreamRequestHandler.setup."""
+
+        self.connection = self.request
+        self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
+        self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)
+
+    def __init__(self, *args, **keywords):
+        self._request = _StandaloneRequest(
+                self, WebSocketRequestHandler.options.use_tls)
+        self._dispatcher = dispatch.Dispatcher(
+                WebSocketRequestHandler.options.websock_handlers,
+                WebSocketRequestHandler.options.scan_dir)
+        self._print_warnings_if_any()
+        self._handshaker = handshake.Handshaker(self._request,
+                                                self._dispatcher)
+        SimpleHTTPServer.SimpleHTTPRequestHandler.__init__(
+                self, *args, **keywords)
+
+    def _print_warnings_if_any(self):
+        warnings = self._dispatcher.source_warnings()
+        if warnings:
+            for warning in warnings:
+                logging.warning('mod_pywebsocket: %s' % warning)
+
+    def parse_request(self):
+        """Override BaseHTTPServer.BaseHTTPRequestHandler.parse_request.
+
+        Return True to continue processing for HTTP(S), False otherwise.
+        """
+        result = SimpleHTTPServer.SimpleHTTPRequestHandler.parse_request(self)
+        if result:
+            try:
+                self._handshaker.do_handshake()
+                self._dispatcher.transfer_data(self._request)
+                return False
+            except handshake.HandshakeError, e:
+                # Handshake for ws(s) failed. Assume http(s).
+                logging.info('mod_pywebsocket: %s' % e)
+                return True
+            except dispatch.DispatchError, e:
+                logging.warning('mod_pywebsocket: %s' % e)
+                return False
+        return result
+
+
+def _main():
+    logging.basicConfig()
+
+    parser = optparse.OptionParser()
+    parser.add_option('-p', '--port', dest='port', type='int',
+                      default=handshake._DEFAULT_WEB_SOCKET_PORT,
+                      help='port to listen to')
+    parser.add_option('-w', '--websock_handlers', dest='websock_handlers',
+                      default='.',
+                      help='Web Socket handlers root directory.')
+    parser.add_option('-s', '--scan_dir', dest='scan_dir',
+                      default=None,
+                      help=('Web Socket handlers scan directory. '
+                            'Must be a directory under websock_handlers.'))
+    parser.add_option('-d', '--document_root', dest='document_root',
+                      default='.',
+                      help='Document root directory.')
+    parser.add_option('-t', '--tls', dest='use_tls', action='store_true',
+                      default=False, help='use TLS (wss://)')
+    parser.add_option('-k', '--private_key', dest='private_key',
+                      default='', help='TLS private key file.')
+    parser.add_option('-c', '--certificate', dest='certificate',
+                      default='', help='TLS certificate file.')
+    options = parser.parse_args()[0]
+
+    if options.use_tls:
+        if not _HAS_OPEN_SSL:
+            print >>sys.stderr, 'To use TLS, install pyOpenSSL.'
+            sys.exit(1)
+        if not options.private_key or not options.certificate:
+            print >>sys.stderr, ('To use TLS, specify private_key and '
+                                 'certificate.')
+            sys.exit(1)
+
+    if not options.scan_dir:
+        options.scan_dir = options.websock_handlers
+
+    WebSocketRequestHandler.options = options
+    WebSocketServer.options = options
+
+    os.chdir(options.document_root)
+
+    server = WebSocketServer(('', options.port), WebSocketRequestHandler)
+    server.serve_forever()
+
+
+if __name__ == '__main__':
+    _main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/mod_pywebsocket/util.py b/WebKitTools/pywebsocket/mod_pywebsocket/util.py
new file mode 100644
index 0000000..4835298
--- /dev/null
+++ b/WebKitTools/pywebsocket/mod_pywebsocket/util.py
@@ -0,0 +1,52 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Web Sockets utilities.
+"""
+
+
+import StringIO
+import traceback
+
+
+def get_stack_trace():
+    """Get the current stack trace as string.
+
+    This is needed to support Python 2.3.
+    TODO: Remove this when we only support Python 2.4 and above.
+          Use traceback.format_exc instead.
+    """
+
+    out = StringIO.StringIO()
+    traceback.print_exc(file=out)
+    return out.getvalue()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/setup.py b/WebKitTools/pywebsocket/setup.py
new file mode 100644
index 0000000..1810a6d
--- /dev/null
+++ b/WebKitTools/pywebsocket/setup.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Set up script for mod_pywebsocket.
+"""
+
+
+from distutils.core import setup
+import sys
+
+
+_PACKAGE_NAME = 'mod_pywebsocket'
+
+if sys.version < '2.3':
+    print >>sys.stderr, '%s requires Python 2.3 or later.' % _PACKAGE_NAME
+    sys.exit(1)
+
+setup(author='Yuzo Fujishima',
+      author_email='yuzo@chromium.org',
+      description='Web Socket extension for Apache HTTP Server.',
+      long_description=(
+              'mod_pywebsocket is an Apache HTTP Server extension for '
+              'Web Socket (http://tools.ietf.org/html/'
+              'draft-hixie-thewebsocketprotocol). '
+              'See mod_pywebsocket/__init__.py for more detail.'),
+      license='See COPYING',
+      name=_PACKAGE_NAME,
+      packages=[_PACKAGE_NAME],
+      url='http://code.google.com/p/pywebsocket/',
+      version='0.4.1',
+      )
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/config.py b/WebKitTools/pywebsocket/test/config.py
new file mode 100644
index 0000000..5aaab8c
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/config.py
@@ -0,0 +1,45 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Configuration for testing.
+
+Test files should import this module before mod_pywebsocket.
+"""
+
+
+import os
+import sys
+
+
+# Add the parent directory to sys.path to enable importing mod_pywebsocket.
+sys.path += [os.path.join(os.path.split(__file__)[0], '..')]
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/mock.py b/WebKitTools/pywebsocket/test/mock.py
new file mode 100644
index 0000000..3b85d64
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/mock.py
@@ -0,0 +1,205 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Mocks for testing.
+"""
+
+
+import Queue
+import threading
+
+
+class _MockConnBase(object):
+    """Base class of mocks for mod_python.apache.mp_conn.
+
+    This enables tests to check what is written to a (mock) mp_conn.
+    """
+
+    def __init__(self):
+        self._write_data = []
+
+    def write(self, data):
+        """Override mod_python.apache.mp_conn.write."""
+
+        self._write_data.append(data)
+
+    def written_data(self):
+        """Get bytes written to this mock."""
+
+        return ''.join(self._write_data)
+
+
+class MockConn(_MockConnBase):
+    """Mock for mod_python.apache.mp_conn.
+
+    This enables tests to specify what should be read from a (mock) mp_conn as
+    well as to check what is written to it.
+    """
+
+    def __init__(self, read_data):
+        """Constructs an instance.
+
+        Args:
+            read_data: bytes that should be returned when read* methods are
+            called.
+        """
+
+        _MockConnBase.__init__(self)
+        self._read_data = read_data
+        self._read_pos = 0
+
+    def readline(self):
+        """Override mod_python.apache.mp_conn.readline."""
+
+        if self._read_pos >= len(self._read_data):
+            return ''
+        end_index = self._read_data.find('\n', self._read_pos) + 1
+        if not end_index:
+            end_index = len(self._read_data)
+        return self._read_up_to(end_index)
+
+    def read(self, length):
+        """Override mod_python.apache.mp_conn.read."""
+
+        if self._read_pos >= len(self._read_data):
+            return ''
+        end_index = min(len(self._read_data), self._read_pos + length)
+        return self._read_up_to(end_index)
+
+    def _read_up_to(self, end_index):
+        line = self._read_data[self._read_pos:end_index]
+        self._read_pos = end_index
+        return line
+
+
+class MockBlockingConn(_MockConnBase):
+    """Blocking mock for mod_python.apache.mp_conn.
+
+    This enables tests to specify what should be read from a (mock) mp_conn as
+    well as to check what is written to it.
+    Callers of read* methods will block if there is no bytes available.
+    """
+
+    def __init__(self):
+        _MockConnBase.__init__(self)
+        self._queue = Queue.Queue()
+
+    def readline(self):
+        """Override mod_python.apache.mp_conn.readline."""
+        line = ''
+        while True:
+            c = self._queue.get()
+            line += c
+            if c == '\n':
+                return line
+
+    def read(self, length):
+        """Override mod_python.apache.mp_conn.read."""
+
+        data = ''
+        for unused in range(length):
+            data += self._queue.get()
+        return data
+
+    def put_bytes(self, bytes):
+        """Put bytes to be read from this mock.
+
+        Args:
+            bytes: bytes to be read.
+        """
+
+        for byte in bytes:
+            self._queue.put(byte)
+
+
+class MockTable(dict):
+    """Mock table.
+
+    This mimics mod_python mp_table. Note that only the methods used by
+    tests are overridden.
+    """
+
+    def __init__(self, copy_from={}):
+        if isinstance(copy_from, dict):
+            copy_from = copy_from.items()
+        for key, value in copy_from:
+            self.__setitem__(key, value)
+
+    def __getitem__(self, key):
+        return super(MockTable, self).__getitem__(key.lower())
+
+    def __setitem__(self, key, value):
+        super(MockTable, self).__setitem__(key.lower(), value)
+
+    def get(self, key, def_value=None):
+        return super(MockTable, self).get(key.lower(), def_value)
+
+
+class MockRequest(object):
+    """Mock request.
+
+    This mimics mod_python request.
+    """
+
+    def __init__(self, uri=None, headers_in={}, connection=None,
+                 is_https=False):
+        """Construct an instance.
+
+        Arguments:
+            uri: URI of the request.
+            headers_in: Request headers.
+            connection: Connection used for the request.
+            is_https: Whether this request is over SSL.
+
+        See the document of mod_python Request for details.
+        """
+        self.uri = uri
+        self.connection = connection
+        self.headers_in = MockTable(headers_in)
+        # self.is_https_ needs to be accessible from tests.  To avoid name
+        # conflict with self.is_https(), it is named as such.
+        self.is_https_ = is_https
+
+    def is_https(self):
+        """Return whether this request is over SSL."""
+        return self.is_https_
+
+
+class MockDispatcher(object):
+    """Mock for dispatch.Dispatcher."""
+
+    def do_extra_handshake(self, conn_context):
+        pass
+
+    def transfer_data(self, conn_context):
+        pass
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/run_all.py b/WebKitTools/pywebsocket/test/run_all.py
new file mode 100644
index 0000000..3885618
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/run_all.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Run all tests in the same directory.
+"""
+
+
+import os
+import re
+import unittest
+
+
+_TEST_MODULE_PATTERN = re.compile(r'^(test_.+)\.py$')
+
+
+def _list_test_modules(directory):
+    module_names = []
+    for filename in os.listdir(directory):
+        match = _TEST_MODULE_PATTERN.search(filename)
+        if match:
+            module_names.append(match.group(1))
+    return module_names
+
+
+def _suite():
+    loader = unittest.TestLoader()
+    return loader.loadTestsFromNames(
+            _list_test_modules(os.path.join(os.path.split(__file__)[0], '.')))
+
+
+if __name__ == '__main__':
+    unittest.main(defaultTest='_suite')
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/test_dispatch.py b/WebKitTools/pywebsocket/test/test_dispatch.py
new file mode 100644
index 0000000..d617205
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/test_dispatch.py
@@ -0,0 +1,222 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Tests for dispatch module."""
+
+
+
+import os
+import unittest
+
+import config  # This must be imported before mod_pywebsocket.
+from mod_pywebsocket import dispatch
+
+import mock
+
+
+_TEST_HANDLERS_DIR = os.path.join(
+        os.path.split(__file__)[0], 'testdata', 'handlers')
+
+_TEST_HANDLERS_SUB_DIR = os.path.join(_TEST_HANDLERS_DIR, 'sub')
+
+class DispatcherTest(unittest.TestCase):
+    def test_normalize_path(self):
+        self.assertEqual(os.path.abspath('/a/b').replace('\\', '/'),
+                         dispatch._normalize_path('/a/b'))
+        self.assertEqual(os.path.abspath('/a/b').replace('\\', '/'),
+                         dispatch._normalize_path('\\a\\b'))
+        self.assertEqual(os.path.abspath('/a/b').replace('\\', '/'),
+                         dispatch._normalize_path('/a/c/../b'))
+        self.assertEqual(os.path.abspath('abc').replace('\\', '/'),
+                         dispatch._normalize_path('abc'))
+
+    def test_converter(self):
+        converter = dispatch._path_to_resource_converter('/a/b')
+        self.assertEqual('/h', converter('/a/b/h_wsh.py'))
+        self.assertEqual('/c/h', converter('/a/b/c/h_wsh.py'))
+        self.assertEqual(None, converter('/a/b/h.py'))
+        self.assertEqual(None, converter('a/b/h_wsh.py'))
+
+        converter = dispatch._path_to_resource_converter('a/b')
+        self.assertEqual('/h', converter('a/b/h_wsh.py'))
+
+        converter = dispatch._path_to_resource_converter('/a/b///')
+        self.assertEqual('/h', converter('/a/b/h_wsh.py'))
+        self.assertEqual('/h', converter('/a/b/../b/h_wsh.py'))
+
+        converter = dispatch._path_to_resource_converter('/a/../a/b/../b/')
+        self.assertEqual('/h', converter('/a/b/h_wsh.py'))
+
+        converter = dispatch._path_to_resource_converter(r'\a\b')
+        self.assertEqual('/h', converter(r'\a\b\h_wsh.py'))
+        self.assertEqual('/h', converter(r'/a/b/h_wsh.py'))
+
+    def test_source_file_paths(self):
+        paths = list(dispatch._source_file_paths(_TEST_HANDLERS_DIR))
+        paths.sort()
+        self.assertEqual(7, len(paths))
+        expected_paths = [
+                os.path.join(_TEST_HANDLERS_DIR, 'blank_wsh.py'),
+                os.path.join(_TEST_HANDLERS_DIR, 'origin_check_wsh.py'),
+                os.path.join(_TEST_HANDLERS_DIR, 'sub',
+                             'exception_in_transfer_wsh.py'),
+                os.path.join(_TEST_HANDLERS_DIR, 'sub', 'non_callable_wsh.py'),
+                os.path.join(_TEST_HANDLERS_DIR, 'sub', 'plain_wsh.py'),
+                os.path.join(_TEST_HANDLERS_DIR, 'sub',
+                             'wrong_handshake_sig_wsh.py'),
+                os.path.join(_TEST_HANDLERS_DIR, 'sub',
+                             'wrong_transfer_sig_wsh.py'),
+                ]
+        for expected, actual in zip(expected_paths, paths):
+            self.assertEqual(expected, actual)
+
+    def test_source(self):
+        self.assertRaises(dispatch.DispatchError, dispatch._source, '')
+        self.assertRaises(dispatch.DispatchError, dispatch._source, 'def')
+        self.assertRaises(dispatch.DispatchError, dispatch._source, '1/0')
+        self.failUnless(dispatch._source(
+                'def web_socket_do_extra_handshake(request):pass\n'
+                'def web_socket_transfer_data(request):pass\n'))
+
+    def test_source_warnings(self):
+        dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
+        warnings = dispatcher.source_warnings()
+        warnings.sort()
+        expected_warnings = [
+                (os.path.join(_TEST_HANDLERS_DIR, 'blank_wsh.py') +
+                 ': web_socket_do_extra_handshake is not defined.'),
+                (os.path.join(_TEST_HANDLERS_DIR, 'sub',
+                              'non_callable_wsh.py') +
+                 ': web_socket_do_extra_handshake is not callable.'),
+                (os.path.join(_TEST_HANDLERS_DIR, 'sub',
+                              'wrong_handshake_sig_wsh.py') +
+                 ': web_socket_do_extra_handshake is not defined.'),
+                (os.path.join(_TEST_HANDLERS_DIR, 'sub',
+                              'wrong_transfer_sig_wsh.py') +
+                 ': web_socket_transfer_data is not defined.'),
+                ]
+        self.assertEquals(4, len(warnings))
+        for expected, actual in zip(expected_warnings, warnings):
+            self.assertEquals(expected, actual)
+
+    def test_do_extra_handshake(self):
+        dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
+        request = mock.MockRequest()
+        request.ws_resource = '/origin_check'
+        request.ws_origin = 'http://example.com'
+        dispatcher.do_extra_handshake(request)  # Must not raise exception.
+
+        request.ws_origin = 'http://bad.example.com'
+        self.assertRaises(dispatch.DispatchError,
+                          dispatcher.do_extra_handshake, request)
+
+    def test_transfer_data(self):
+        dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
+        request = mock.MockRequest(connection=mock.MockConn(''))
+        request.ws_resource = '/origin_check'
+        request.ws_protocol = 'p1'
+
+        dispatcher.transfer_data(request)
+        self.assertEqual('origin_check_wsh.py is called for /origin_check, p1',
+                         request.connection.written_data())
+
+        request = mock.MockRequest(connection=mock.MockConn(''))
+        request.ws_resource = '/sub/plain'
+        request.ws_protocol = None
+        dispatcher.transfer_data(request)
+        self.assertEqual('sub/plain_wsh.py is called for /sub/plain, None',
+                         request.connection.written_data())
+
+    def test_transfer_data_no_handler(self):
+        dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
+        for resource in ['/blank', '/sub/non_callable',
+                         '/sub/no_wsh_at_the_end', '/does/not/exist']:
+            request = mock.MockRequest(connection=mock.MockConn(''))
+            request.ws_resource = resource
+            request.ws_protocol = 'p2'
+            try:
+                dispatcher.transfer_data(request)
+                self.fail()
+            except dispatch.DispatchError, e:
+                self.failUnless(str(e).find('No handler') != -1)
+            except Exception:
+                self.fail()
+
+    def test_transfer_data_handler_exception(self):
+        dispatcher = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
+        request = mock.MockRequest(connection=mock.MockConn(''))
+        request.ws_resource = '/sub/exception_in_transfer'
+        request.ws_protocol = 'p3'
+        try:
+            dispatcher.transfer_data(request)
+            self.fail()
+        except dispatch.DispatchError, e:
+            self.failUnless(str(e).find('Intentional') != -1)
+        except Exception:
+            self.fail()
+
+    def test_scan_dir(self):
+        disp = dispatch.Dispatcher(_TEST_HANDLERS_DIR, None)
+        self.assertEqual(3, len(disp._handlers))
+        self.failUnless(disp._handlers.has_key('/origin_check'))
+        self.failUnless(disp._handlers.has_key('/sub/exception_in_transfer'))
+        self.failUnless(disp._handlers.has_key('/sub/plain'))
+
+    def test_scan_sub_dir(self):
+        disp = dispatch.Dispatcher(_TEST_HANDLERS_DIR, _TEST_HANDLERS_SUB_DIR)
+        self.assertEqual(2, len(disp._handlers))
+        self.failIf(disp._handlers.has_key('/origin_check'))
+        self.failUnless(disp._handlers.has_key('/sub/exception_in_transfer'))
+        self.failUnless(disp._handlers.has_key('/sub/plain'))
+
+    def test_scan_sub_dir_as_root(self):
+        disp = dispatch.Dispatcher(_TEST_HANDLERS_SUB_DIR,
+                                   _TEST_HANDLERS_SUB_DIR)
+        self.assertEqual(2, len(disp._handlers))
+        self.failIf(disp._handlers.has_key('/origin_check'))
+        self.failIf(disp._handlers.has_key('/sub/exception_in_transfer'))
+        self.failIf(disp._handlers.has_key('/sub/plain'))
+        self.failUnless(disp._handlers.has_key('/exception_in_transfer'))
+        self.failUnless(disp._handlers.has_key('/plain'))
+
+    def test_scan_dir_must_under_root(self):
+        dispatch.Dispatcher('a/b', 'a/b/c')  # OK
+        dispatch.Dispatcher('a/b///', 'a/b')  # OK
+        self.assertRaises(dispatch.DispatchError,
+                          dispatch.Dispatcher, 'a/b/c', 'a/b')
+
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/test_handshake.py b/WebKitTools/pywebsocket/test/test_handshake.py
new file mode 100644
index 0000000..dd1f65c
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/test_handshake.py
@@ -0,0 +1,316 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Tests for handshake module."""
+
+
+import unittest
+
+import config  # This must be imported before mod_pywebsocket.
+from mod_pywebsocket import handshake
+
+import mock
+
+
+_GOOD_REQUEST = (
+    80,
+    '/demo',
+    {
+        'Upgrade':'WebSocket',
+        'Connection':'Upgrade',
+        'Host':'example.com',
+        'Origin':'http://example.com',
+        'WebSocket-Protocol':'sample',
+    }
+)
+
+_GOOD_RESPONSE_DEFAULT_PORT = (
+    'HTTP/1.1 101 Web Socket Protocol Handshake\r\n'
+    'Upgrade: WebSocket\r\n'
+    'Connection: Upgrade\r\n'
+    'WebSocket-Origin: http://example.com\r\n'
+    'WebSocket-Location: ws://example.com/demo\r\n'
+    'WebSocket-Protocol: sample\r\n'
+    '\r\n')
+
+_GOOD_RESPONSE_SECURE = (
+    'HTTP/1.1 101 Web Socket Protocol Handshake\r\n'
+    'Upgrade: WebSocket\r\n'
+    'Connection: Upgrade\r\n'
+    'WebSocket-Origin: http://example.com\r\n'
+    'WebSocket-Location: wss://example.com/demo\r\n'
+    'WebSocket-Protocol: sample\r\n'
+    '\r\n')
+
+_GOOD_REQUEST_NONDEFAULT_PORT = (
+    8081,
+    '/demo',
+    {
+        'Upgrade':'WebSocket',
+        'Connection':'Upgrade',
+        'Host':'example.com:8081',
+        'Origin':'http://example.com',
+        'WebSocket-Protocol':'sample',
+    }
+)
+
+_GOOD_RESPONSE_NONDEFAULT_PORT = (
+    'HTTP/1.1 101 Web Socket Protocol Handshake\r\n'
+    'Upgrade: WebSocket\r\n'
+    'Connection: Upgrade\r\n'
+    'WebSocket-Origin: http://example.com\r\n'
+    'WebSocket-Location: ws://example.com:8081/demo\r\n'
+    'WebSocket-Protocol: sample\r\n'
+    '\r\n')
+
+_GOOD_RESPONSE_SECURE_NONDEF = (
+    'HTTP/1.1 101 Web Socket Protocol Handshake\r\n'
+    'Upgrade: WebSocket\r\n'
+    'Connection: Upgrade\r\n'
+    'WebSocket-Origin: http://example.com\r\n'
+    'WebSocket-Location: wss://example.com:8081/demo\r\n'
+    'WebSocket-Protocol: sample\r\n'
+    '\r\n')
+
+_GOOD_REQUEST_NO_PROTOCOL = (
+    80,
+    '/demo',
+    {
+        'Upgrade':'WebSocket',
+        'Connection':'Upgrade',
+        'Host':'example.com',
+        'Origin':'http://example.com',
+    }
+)
+
+_GOOD_RESPONSE_NO_PROTOCOL = (
+    'HTTP/1.1 101 Web Socket Protocol Handshake\r\n'
+    'Upgrade: WebSocket\r\n'
+    'Connection: Upgrade\r\n'
+    'WebSocket-Origin: http://example.com\r\n'
+    'WebSocket-Location: ws://example.com/demo\r\n'
+    '\r\n')
+
+_GOOD_REQUEST_WITH_OPTIONAL_HEADERS = (
+    80,
+    '/demo',
+    {
+        'Upgrade':'WebSocket',
+        'Connection':'Upgrade',
+        'Host':'example.com',
+        'Origin':'http://example.com',
+        'WebSocket-Protocol':'sample',
+        'AKey':'AValue',
+        'EmptyValue':'',
+    }
+)
+
+_BAD_REQUESTS = (
+    (  # HTTP request
+        80,
+        '/demo',
+        {
+            'Host':'www.google.com',
+            'User-Agent':'Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5;'
+                         ' en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3'
+                         ' GTB6 GTBA',
+            'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,'
+                     '*/*;q=0.8',
+            'Accept-Language':'en-us,en;q=0.5',
+            'Accept-Encoding':'gzip,deflate',
+            'Accept-Charset':'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
+            'Keep-Alive':'300',
+            'Connection':'keep-alive',
+        }
+    ),
+    (  # Missing Upgrade
+        80,
+        '/demo',
+        {
+            'Connection':'Upgrade',
+            'Host':'example.com',
+            'Origin':'http://example.com',
+            'WebSocket-Protocol':'sample',
+        }
+    ),
+    (  # Wrong Upgrade
+        80,
+        '/demo',
+        {
+            'Upgrade':'NonWebSocket',
+            'Connection':'Upgrade',
+            'Host':'example.com',
+            'Origin':'http://example.com',
+            'WebSocket-Protocol':'sample',
+        }
+    ),
+    (  # Empty WebSocket-Protocol
+        80,
+        '/demo',
+        {
+            'Upgrade':'WebSocket',
+            'Connection':'Upgrade',
+            'Host':'example.com',
+            'Origin':'http://example.com',
+            'WebSocket-Protocol':'',
+        }
+    ),
+    (  # Wrong port number format
+        80,
+        '/demo',
+        {
+            'Upgrade':'WebSocket',
+            'Connection':'Upgrade',
+            'Host':'example.com:0x50',
+            'Origin':'http://example.com',
+            'WebSocket-Protocol':'sample',
+        }
+    ),
+    (  # Header/connection port mismatch
+        8080,
+        '/demo',
+        {
+            'Upgrade':'WebSocket',
+            'Connection':'Upgrade',
+            'Host':'example.com',
+            'Origin':'http://example.com',
+            'WebSocket-Protocol':'sample',
+        }
+    ),
+    (  # Illegal WebSocket-Protocol
+        80,
+        '/demo',
+        {
+            'Upgrade':'WebSocket',
+            'Connection':'Upgrade',
+            'Host':'example.com',
+            'Origin':'http://example.com',
+            'WebSocket-Protocol':'illegal protocol',
+        }
+    ),
+)
+
+
+def _create_request(request_def):
+    conn = mock.MockConn('')
+    conn.local_addr = ('0.0.0.0', request_def[0])
+    return mock.MockRequest(
+            uri=request_def[1],
+            headers_in=request_def[2],
+            connection=conn)
+
+
+class HandshakerTest(unittest.TestCase):
+    def test_validate_protocol(self):
+        handshake._validate_protocol('sample')  # should succeed.
+        handshake._validate_protocol('Sample')  # should succeed.
+        self.assertRaises(handshake.HandshakeError,
+                          handshake._validate_protocol,
+                          'sample protocol')
+        self.assertRaises(handshake.HandshakeError,
+                          handshake._validate_protocol,
+                          # "Japan" in Japanese
+                          u'\u65e5\u672c')
+
+    def test_good_request_default_port(self):
+        request = _create_request(_GOOD_REQUEST)
+        handshaker = handshake.Handshaker(request,
+                                          mock.MockDispatcher())
+        handshaker.do_handshake()
+        self.assertEqual(_GOOD_RESPONSE_DEFAULT_PORT,
+                         request.connection.written_data())
+        self.assertEqual('/demo', request.ws_resource)
+        self.assertEqual('http://example.com', request.ws_origin)
+        self.assertEqual('ws://example.com/demo', request.ws_location)
+        self.assertEqual('sample', request.ws_protocol)
+
+    def test_good_request_secure_default_port(self):
+        request = _create_request(_GOOD_REQUEST)
+        request.connection.local_addr = ('0.0.0.0', 443)
+        request.is_https_ = True
+        handshaker = handshake.Handshaker(request,
+                                          mock.MockDispatcher())
+        handshaker.do_handshake()
+        self.assertEqual(_GOOD_RESPONSE_SECURE,
+                         request.connection.written_data())
+        self.assertEqual('sample', request.ws_protocol)
+
+    def test_good_request_nondefault_port(self):
+        request = _create_request(_GOOD_REQUEST_NONDEFAULT_PORT)
+        handshaker = handshake.Handshaker(request,
+                                          mock.MockDispatcher())
+        handshaker.do_handshake()
+        self.assertEqual(_GOOD_RESPONSE_NONDEFAULT_PORT,
+                         request.connection.written_data())
+        self.assertEqual('sample', request.ws_protocol)
+
+    def test_good_request_secure_non_default_port(self):
+        request = _create_request(_GOOD_REQUEST_NONDEFAULT_PORT)
+        request.is_https_ = True
+        handshaker = handshake.Handshaker(request,
+                                          mock.MockDispatcher())
+        handshaker.do_handshake()
+        self.assertEqual(_GOOD_RESPONSE_SECURE_NONDEF,
+                         request.connection.written_data())
+        self.assertEqual('sample', request.ws_protocol)
+
+    def test_good_request_default_no_protocol(self):
+        request = _create_request(_GOOD_REQUEST_NO_PROTOCOL)
+        handshaker = handshake.Handshaker(request,
+                                          mock.MockDispatcher())
+        handshaker.do_handshake()
+        self.assertEqual(_GOOD_RESPONSE_NO_PROTOCOL,
+                         request.connection.written_data())
+        self.assertEqual(None, request.ws_protocol)
+
+    def test_good_request_optional_headers(self):
+        request = _create_request(_GOOD_REQUEST_WITH_OPTIONAL_HEADERS)
+        handshaker = handshake.Handshaker(request,
+                                          mock.MockDispatcher())
+        handshaker.do_handshake()
+        self.assertEqual('AValue',
+                         request.headers_in['AKey'])
+        self.assertEqual('',
+                         request.headers_in['EmptyValue'])
+
+    def test_bad_requests(self):
+        for request in map(_create_request, _BAD_REQUESTS):
+            handshaker = handshake.Handshaker(request,
+                                              mock.MockDispatcher())
+            self.assertRaises(handshake.HandshakeError, handshaker.do_handshake)
+
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/test_mock.py b/WebKitTools/pywebsocket/test/test_mock.py
new file mode 100644
index 0000000..8b137d1
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/test_mock.py
@@ -0,0 +1,126 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Tests for mock module."""
+
+
+import Queue
+import threading
+import unittest
+
+import mock
+
+
+class MockConnTest(unittest.TestCase):
+    def setUp(self):
+        self._conn = mock.MockConn('ABC\r\nDEFG\r\n\r\nHIJK')
+
+    def test_readline(self):
+        self.assertEqual('ABC\r\n', self._conn.readline())
+        self.assertEqual('DEFG\r\n', self._conn.readline())
+        self.assertEqual('\r\n', self._conn.readline())
+        self.assertEqual('HIJK', self._conn.readline())
+        self.assertEqual('', self._conn.readline())
+
+    def test_read(self):
+        self.assertEqual('ABC\r\nD', self._conn.read(6))
+        self.assertEqual('EFG\r\n\r\nHI', self._conn.read(9))
+        self.assertEqual('JK', self._conn.read(10))
+        self.assertEqual('', self._conn.read(10))
+
+    def test_read_and_readline(self):
+        self.assertEqual('ABC\r\nD', self._conn.read(6))
+        self.assertEqual('EFG\r\n', self._conn.readline())
+        self.assertEqual('\r\nHIJK', self._conn.read(9))
+        self.assertEqual('', self._conn.readline())
+
+    def test_write(self):
+        self._conn.write('Hello\r\n')
+        self._conn.write('World\r\n')
+        self.assertEqual('Hello\r\nWorld\r\n', self._conn.written_data())
+
+
+class MockBlockingConnTest(unittest.TestCase):
+    def test_read(self):
+        class LineReader(threading.Thread):
+            def __init__(self, conn, queue):
+                threading.Thread.__init__(self)
+                self._queue = queue
+                self._conn = conn
+                self.setDaemon(True)
+                self.start()
+            def run(self):
+                while True:
+                    data = self._conn.readline()
+                    self._queue.put(data)
+        conn = mock.MockBlockingConn()
+        queue = Queue.Queue()
+        reader = LineReader(conn, queue)
+        self.failUnless(queue.empty())
+        conn.put_bytes('Foo bar\r\n')
+        read = queue.get()
+        self.assertEqual('Foo bar\r\n', read)
+
+
+class MockTableTest(unittest.TestCase):
+    def test_create_from_dict(self):
+        table = mock.MockTable({'Key':'Value'})
+        self.assertEqual('Value', table.get('KEY'))
+        self.assertEqual('Value', table['key'])
+
+    def test_create_from_list(self):
+        table = mock.MockTable([('Key', 'Value')])
+        self.assertEqual('Value', table.get('KEY'))
+        self.assertEqual('Value', table['key'])
+
+    def test_create_from_tuple(self):
+        table = mock.MockTable((('Key', 'Value'),))
+        self.assertEqual('Value', table.get('KEY'))
+        self.assertEqual('Value', table['key'])
+
+    def test_set_and_get(self):
+        table = mock.MockTable()
+        self.assertEqual(None, table.get('Key'))
+        table['Key'] = 'Value'
+        self.assertEqual('Value', table.get('Key'))
+        self.assertEqual('Value', table.get('key'))
+        self.assertEqual('Value', table.get('KEY'))
+        self.assertEqual('Value', table['Key'])
+        self.assertEqual('Value', table['key'])
+        self.assertEqual('Value', table['KEY'])
+
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/test_msgutil.py b/WebKitTools/pywebsocket/test/test_msgutil.py
new file mode 100644
index 0000000..b3ba539
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/test_msgutil.py
@@ -0,0 +1,149 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Tests for msgutil module."""
+
+
+import Queue
+import unittest
+
+import config  # This must be imported before mod_pywebsocket.
+from mod_pywebsocket import msgutil
+
+import mock
+
+
+def _create_request(read_data):
+    return mock.MockRequest(connection=mock.MockConn(read_data))
+
+def _create_blocking_request():
+    return mock.MockRequest(connection=mock.MockBlockingConn())
+
+class MessageTest(unittest.TestCase):
+    def test_send_message(self):
+        request = _create_request('')
+        msgutil.send_message(request, 'Hello')
+        self.assertEqual('\x00Hello\xff', request.connection.written_data())
+
+    def test_send_message_unicode(self):
+        request = _create_request('')
+        msgutil.send_message(request, u'\u65e5')
+        # U+65e5 is encoded as e6,97,a5 in UTF-8
+        self.assertEqual('\x00\xe6\x97\xa5\xff',
+                         request.connection.written_data())
+
+    def test_receive_message(self):
+        request = _create_request('\x00Hello\xff\x00World!\xff')
+        self.assertEqual('Hello', msgutil.receive_message(request))
+        self.assertEqual('World!', msgutil.receive_message(request))
+
+    def test_receive_message_unicode(self):
+        request = _create_request('\x00\xe6\x9c\xac\xff')
+        # U+672c is encoded as e6,9c,ac in UTF-8
+        self.assertEqual(u'\u672c', msgutil.receive_message(request))
+
+    def test_receive_message_discard(self):
+        request = _create_request('\x80\x06IGNORE\x00Hello\xff'
+                                '\x01DISREGARD\xff\x00World!\xff')
+        self.assertEqual('Hello', msgutil.receive_message(request))
+        self.assertEqual('World!', msgutil.receive_message(request))
+
+    def test_payload_length(self):
+        for length, bytes in ((0, '\x00'), (0x7f, '\x7f'), (0x80, '\x81\x00'),
+                              (0x1234, '\x80\xa4\x34')):
+            self.assertEqual(length,
+                             msgutil._payload_length(_create_request(bytes)))
+
+    def test_receive_bytes(self):
+        request = _create_request('abcdefg')
+        self.assertEqual('abc', msgutil._receive_bytes(request, 3))
+        self.assertEqual('defg', msgutil._receive_bytes(request, 4))
+
+    def test_read_until(self):
+        request = _create_request('abcXdefgX')
+        self.assertEqual('abc', msgutil._read_until(request, 'X'))
+        self.assertEqual('defg', msgutil._read_until(request, 'X'))
+
+
+class MessageReceiverTest(unittest.TestCase):
+    def test_queue(self):
+        request = _create_blocking_request()
+        receiver = msgutil.MessageReceiver(request)
+
+        self.assertEqual(None, receiver.receive_nowait())
+
+        request.connection.put_bytes('\x00Hello!\xff')
+        self.assertEqual('Hello!', receiver.receive())
+
+    def test_onmessage(self):
+        onmessage_queue = Queue.Queue()
+        def onmessage_handler(message):
+            onmessage_queue.put(message)
+
+        request = _create_blocking_request()
+        receiver = msgutil.MessageReceiver(request, onmessage_handler)
+
+        request.connection.put_bytes('\x00Hello!\xff')
+        self.assertEqual('Hello!', onmessage_queue.get())
+
+
+class MessageSenderTest(unittest.TestCase):
+    def test_send(self):
+        request = _create_blocking_request()
+        sender = msgutil.MessageSender(request)
+
+        sender.send('World')
+        self.assertEqual('\x00World\xff', request.connection.written_data())
+
+    def test_send_nowait(self):
+        # Use a queue to check the bytes written by MessageSender.
+        # request.connection.written_data() cannot be used here because
+        # MessageSender runs in a separate thread.
+        send_queue = Queue.Queue()
+        def write(bytes):
+            send_queue.put(bytes)
+        request = _create_blocking_request()
+        request.connection.write = write
+
+        sender = msgutil.MessageSender(request)
+
+        sender.send_nowait('Hello')
+        sender.send_nowait('World')
+        self.assertEqual('\x00Hello\xff', send_queue.get())
+        self.assertEqual('\x00World\xff', send_queue.get())
+
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/test_util.py b/WebKitTools/pywebsocket/test/test_util.py
new file mode 100644
index 0000000..8058b6d
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/test_util.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python
+#
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Tests for util module."""
+
+
+import unittest
+
+import config  # This must be imported before mod_pywebsocket.
+from mod_pywebsocket import util
+
+
+class UtilTest(unittest.TestCase):
+    def test_get_stack_trace(self):
+        self.assertEqual('None\n', util.get_stack_trace())
+        try:
+            a = 1 / 0  # Intentionally raise exception.
+        except Exception:
+            trace = util.get_stack_trace()
+            self.failUnless(trace.startswith('Traceback'))
+            self.failUnless(trace.find('ZeroDivisionError') != -1)
+
+
+if __name__ == '__main__':
+    unittest.main()
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/blank_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/blank_wsh.py
new file mode 100644
index 0000000..7f87c6a
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/blank_wsh.py
@@ -0,0 +1,31 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+# intentionally left blank
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/origin_check_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/origin_check_wsh.py
new file mode 100644
index 0000000..2c139fa
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/origin_check_wsh.py
@@ -0,0 +1,42 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+def web_socket_do_extra_handshake(request):
+    if request.ws_origin == 'http://example.com':
+        return
+    raise ValueError('Unacceptable origin: %r' % request.ws_origin)
+
+
+def web_socket_transfer_data(request):
+    request.connection.write('origin_check_wsh.py is called for %s, %s' %
+                             (request.ws_resource, request.ws_protocol))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/sub/exception_in_transfer_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/sub/exception_in_transfer_wsh.py
new file mode 100644
index 0000000..b982d02
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/sub/exception_in_transfer_wsh.py
@@ -0,0 +1,44 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Exception in web_socket_transfer_data().
+"""
+
+
+def web_socket_do_extra_handshake(request):
+    pass
+
+
+def web_socket_transfer_data(request):
+    raise Exception('Intentional Exception for %s, %s' %
+                    (request.ws_resource, request.ws_protocol))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/sub/no_wsh_at_the_end.py b/WebKitTools/pywebsocket/test/testdata/handlers/sub/no_wsh_at_the_end.py
new file mode 100644
index 0000000..17e7be1
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/sub/no_wsh_at_the_end.py
@@ -0,0 +1,45 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Correct signatures, wrong file name.
+"""
+
+
+def web_socket_do_extra_handshake(request):
+    pass
+
+
+def web_socket_transfer_data(request):
+    request.connection.write(
+            'sub/no_wsh_at_the_end.py is called for %s, %s' %
+            (request.ws_resource, request.ws_protocol))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/sub/non_callable_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/sub/non_callable_wsh.py
new file mode 100644
index 0000000..26352eb
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/sub/non_callable_wsh.py
@@ -0,0 +1,39 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Non-callable handlers.
+"""
+
+
+web_socket_do_extra_handshake = True
+web_socket_transfer_data = 1
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/sub/plain_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/sub/plain_wsh.py
new file mode 100644
index 0000000..db3ff69
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/sub/plain_wsh.py
@@ -0,0 +1,40 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+def web_socket_do_extra_handshake(request):
+    pass
+
+
+def web_socket_transfer_data(request):
+    request.connection.write('sub/plain_wsh.py is called for %s, %s' %
+                             (request.ws_resource, request.ws_protocol))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/sub/wrong_handshake_sig_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/sub/wrong_handshake_sig_wsh.py
new file mode 100644
index 0000000..6bf659b
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/sub/wrong_handshake_sig_wsh.py
@@ -0,0 +1,45 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Wrong web_socket_do_extra_handshake signature.
+"""
+
+
+def no_web_socket_do_extra_handshake(request):
+    pass
+
+
+def web_socket_transfer_data(request):
+    request.connection.write(
+            'sub/wrong_handshake_sig_wsh.py is called for %s, %s' %
+             (request.ws_resource, request.ws_protocol))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/pywebsocket/test/testdata/handlers/sub/wrong_transfer_sig_wsh.py b/WebKitTools/pywebsocket/test/testdata/handlers/sub/wrong_transfer_sig_wsh.py
new file mode 100644
index 0000000..e0e2e55
--- /dev/null
+++ b/WebKitTools/pywebsocket/test/testdata/handlers/sub/wrong_transfer_sig_wsh.py
@@ -0,0 +1,45 @@
+# Copyright 2009, Google Inc.
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+"""Wrong web_socket_transfer_data() signature.
+"""
+
+
+def web_socket_do_extra_handshake(request):
+    pass
+
+
+def no_web_socket_transfer_data(request):
+    request.connection.write(
+            'sub/wrong_transfer_sig_wsh.py is called for %s, %s' %
+            (request.ws_resource, request.ws_protocol))
+
+
+# vi:sts=4 sw=4 et
diff --git a/WebKitTools/wx/browser/wscript b/WebKitTools/wx/browser/wscript
index 530cd75..d5246c1 100644
--- a/WebKitTools/wx/browser/wscript
+++ b/WebKitTools/wx/browser/wscript
@@ -45,7 +45,7 @@ def build(bld):
         includes = ' '.join(include_paths),
         source = 'browser.cpp',
         target = 'wxBrowser',
-        uselib = 'WX CURL ICU SQLITE3 XSLT XML WXWEBKIT ' + get_config(),
+        uselib = 'WXWEBKIT WX ' + get_config(),
         libpath = [output_dir],
         uselib_local = '',
         install_path = output_dir)
diff --git a/WebKitTools/wx/build/build_utils.py b/WebKitTools/wx/build/build_utils.py
index 0a795a8..b767d9f 100644
--- a/WebKitTools/wx/build/build_utils.py
+++ b/WebKitTools/wx/build/build_utils.py
@@ -27,13 +27,12 @@ import commands
 import glob
 import os
 import platform
+import re
 import shutil
 import sys
 import urllib
 import urlparse
 
-import Logs
-
 def get_output(command):
     """
     Windows-compatible function for getting output from a command.
@@ -110,6 +109,7 @@ def update_wx_deps(conf, wk_root, msvc_version='msvc2008'):
     """
     Download and update tools needed to build the wx port.
     """
+    import Logs
     Logs.info('Ensuring wxWebKit dependencies are up-to-date.')
     
     wklibs_dir = os.path.join(wk_root, 'WebKitLibraries')
@@ -154,3 +154,35 @@ def flattenSources(sources):
         flat_sources.extend(group)
         
     return flat_sources
+
+def git_branch_name():
+    try:
+        branches = commands.getoutput("git branch --no-color")
+        match = re.search('^\* (.*)', branches, re.MULTILINE)
+        if match:
+            return ".%s" % match.group(1)
+    except:
+        pass
+
+    return ""
+
+def get_config(wk_root):
+    config_file = os.path.join(wk_root, 'WebKitBuild', 'Configuration')
+    config = 'Debug'
+
+    if os.path.exists(config_file):
+        config = open(config_file).read()
+
+    return config
+
+def svn_revision():
+    if os.system("git info") == 0:
+        info = commands.getoutput("git-svn info ../..")
+    else:
+        info = commands.getoutput("svn info")
+    
+    for line in info.split("\n"):
+        if line.startswith("Revision: "):
+            return line.replace("Revision: ", "").strip()
+    
+    return ""
diff --git a/WebKitTools/wx/build/settings.py b/WebKitTools/wx/build/settings.py
index 4019273..652a880 100644
--- a/WebKitTools/wx/build/settings.py
+++ b/WebKitTools/wx/build/settings.py
@@ -95,8 +95,9 @@ jscore_dirs = [
 ]
 
 webcore_dirs = [
-    'accessibility', 
-    'bindings/js', 
+    'accessibility',
+    'bindings',
+    'bindings/js',
     'bridge', 
     'bridge/c', 
     'css',
@@ -139,21 +140,8 @@ webcore_dirs = [
     'xml'
 ]
 
-config_file = os.path.join(wk_root, 'WebKitBuild', 'Configuration')
-config = 'Debug'
-
-if os.path.exists(config_file):
-    config = open(config_file).read()
-
-config_dir = config
-
-try:
-    branches = commands.getoutput("git branch --no-color")
-    match = re.search('^\* (.*)', branches, re.MULTILINE)
-    if match:
-        config_dir += ".%s" % match.group(1)
-except:
-    pass
+config = get_config(wk_root)
+config_dir = config + git_branch_name()
 
 output_dir = os.path.join(wk_root, 'WebKitBuild', config_dir)
 
@@ -203,6 +191,7 @@ def common_set_options(opt):
     opt.add_option('--wxpython', action='store_true', default=False, help='Create the wxPython bindings.')
     opt.add_option('--wx-compiler-prefix', action='store', default='vc',
                    help='Specify a different compiler prefix (do this if you used COMPILER_PREFIX when building wx itself)')
+    opt.add_option('--macosx-version', action='store', default='', help="Version of OS X to build for.")
 
 def common_configure(conf):
     """
@@ -245,11 +234,32 @@ def common_configure(conf):
             msvc_version = 'msvc2005'
         
         msvclibs_dir = os.path.join(wklibs_dir, msvc_version, 'win')
-        conf.env.append_value('CXXFLAGS', ['/wd4291','/wd4344','/wd4396','/wd4800'])
+
+        # Disable several warnings which occur many times during the build.
+        # Some of them are harmless (4099, 4344, 4396, 4800) and working around
+        # them in WebKit code is probably just not worth it. We can simply do
+        # nothing about the others (4503). A couple are possibly valid but
+        # there are just too many of them in the code so fixing them is
+        # impossible in practice and just results in tons of distracting output
+        # (4244, 4291). Finally 4996 is actively harmful as it is given for
+        # just about any use of standard C/C++ library facilities.
+        conf.env.append_value('CXXFLAGS', [
+            '/wd4099',  # type name first seen using 'struct' now seen using 'class'
+            '/wd4244',  # conversion from 'xxx' to 'yyy', possible loss of data:
+            '/wd4291',  # no matching operator delete found (for placement new)
+            '/wd4344',  # behaviour change in template deduction
+            '/wd4396',  # inline can't be used in friend declaration
+            '/wd4503',  # decorated name length exceeded, name was truncated
+            '/wd4800',  # forcing value to bool 'true' or 'false'
+            '/wd4996',  # deprecated function
+        ])
+
+        # This one also occurs in C code, so disable it there as well.
+        conf.env.append_value('CCFLAGS', ['/wd4996'])
     
     for use in port_uses[build_port]:
        conf.env.append_value('CXXDEFINES', ['WTF_USE_%s' % use])
-    
+
     if build_port == "wx":
         update_wx_deps(conf, wk_root, msvc_version)
     
@@ -265,7 +275,7 @@ def common_configure(conf):
             conf.env['CPPPATH_WX'] = wxincludes
             conf.env['LIB_WX'] = wxlibs
             conf.env['LIBPATH_WX'] = wxlibpaths
-    
+
     if sys.platform.startswith('darwin'):
         conf.env['LIB_ICU'] = ['icucore']
         # Apple does not ship the ICU headers with Mac OS X, so WebKit includes a copy of 3.2 headers
@@ -274,15 +284,33 @@ def common_configure(conf):
         conf.env.append_value('CPPPATH', wklibs_dir)
         conf.env.append_value('LIBPATH', wklibs_dir)
         
-        # WebKit only supports 10.4+
+        min_version = None
+        
         mac_target = 'MACOSX_DEPLOYMENT_TARGET'
-        if mac_target in os.environ and os.environ[mac_target] == '10.3':
-            os.environ[mac_target] = '10.4'
+        if Options.options.macosx_version != '':
+            min_version = Options.options.macosx_version
         
-        if mac_target in conf.env and conf.env[mac_target] == '10.3':
-            conf.env[mac_target] = '10.4'
-    
-    #conf.env['PREFIX'] = output_dir
+        # WebKit only supports 10.4+, but ppc systems often set this to earlier systems
+        if not min_version:
+            min_version = commands.getoutput('sw_vers -productVersion')[:4]
+            if min_version in ['10.1','10.2','10.3']:
+                min_version = '10.4'
+
+        os.environ[mac_target] = conf.env[mac_target] = min_version        
+
+        sdk_version = min_version
+        if min_version == "10.4":
+            sdk_version += "u"
+            conf.env.append_value('LIB', ['WebKitSystemInterfaceTiger'])
+        
+        sdkroot = '/Developer/SDKs/MacOSX%s.sdk' % sdk_version
+        sdkflags = ['-arch', 'i386', '-isysroot', sdkroot]
+        
+        conf.env.append_value('CPPFLAGS', sdkflags)
+        conf.env.append_value('LINKFLAGS', sdkflags)
+        
+        conf.env.append_value('CPPPATH_SQLITE3', [os.path.join(wklibs_dir, 'WebCoreSQLite3')])
+        conf.env.append_value('LIB_SQLITE3', ['WebCoreSQLite3'])
     
     libprefix = ''
     if building_on_win32:
@@ -310,7 +338,7 @@ def common_configure(conf):
         conf.env.append_value('LIB', [
             'kernel32', 'user32','gdi32','comdlg32','winspool','winmm',
             'shell32', 'comctl32', 'ole32', 'oleaut32', 'uuid', 'advapi32', 
-            'wsock32', 'gdiplus'])
+            'wsock32', 'gdiplus', 'version'])
 
         conf.env['LIB_ICU'] = ['icudt', 'icule', 'iculx', 'icuuc', 'icuin', 'icuio', 'icutu']
         
@@ -337,9 +365,10 @@ def common_configure(conf):
             
         conf.check_cfg(msg='Checking for libxslt', path='xslt-config', args='--cflags --libs', package='', uselib_store='XSLT', mandatory=True)
         conf.check_cfg(path='xml2-config', args='--cflags --libs', package='', uselib_store='XML', mandatory=True)
-        conf.check_cfg(path='curl-config', args='--cflags --libs', package='', uselib_store='CURL', mandatory=True)
-        if sys.platform.startswith('darwin'):
-            conf.env.append_value('LIB', ['WebCoreSQLite3'])
+        if sys.platform.startswith('darwin') and min_version and min_version == '10.4':
+            conf.check_cfg(path=os.path.join(wklibs_dir, 'unix', 'bin', 'curl-config'), args='--cflags --libs', package='', uselib_store='CURL', mandatory=True)
+        else:
+            conf.check_cfg(path='curl-config', args='--cflags --libs', package='', uselib_store='CURL', mandatory=True)
         
         if not sys.platform.startswith('darwin'):
             conf.check_cfg(package='cairo', args='--cflags --libs', uselib_store='WX', mandatory=True)
diff --git a/WebKitTools/wx/install-unix-extras b/WebKitTools/wx/install-unix-extras
index 68d81e4..00c936c 100755
--- a/WebKitTools/wx/install-unix-extras
+++ b/WebKitTools/wx/install-unix-extras
@@ -74,6 +74,12 @@ LIBPNG_VERSION="1.2.33"
 LIBPNG_TARBALL="libpng-$LIBPNG_VERSION.tar.gz"
 LIBPNG_URL="http://wxwebkit.wxcommunity.com/downloads/deps/$LIBPNG_TARBALL"
 
+LIBCURL_VERSION="7.19.6"
+LIBCURL_TARBALL="curl-$LIBCURL_VERSION.tar.gz"
+LIBCURL_URL="http://curl.haxx.se/download/$LIBCURL_TARBALL"
+
+export MAC_OS_X_DEPLOYMENT_TARGET=10.4
+
 cd $DL_DIR
 # build ICU
 if [ `which icu-config >/dev/null 2>&1` ]; then
@@ -170,3 +176,25 @@ if [ ! -f $DEPS_PREFIX/lib/libpng.a ]; then
   cd $DL_DIR
   rm -rf $DL_DIR/libpng-$LIBPNG_VERSION
 fi
+
+if [ ! -f $DEPS_PREFIX/lib/libcurl.$DLLEXT ]; then
+  $DL_CMD -o $DL_DIR/$LIBCURL_TARBALL $LIBCURL_URL
+
+  tar xzvf $DL_DIR/$LIBCURL_TARBALL
+  cd $DL_DIR/curl-$LIBCURL_VERSION
+
+  if [ "${OSTYPE:0:6}" == "darwin" ]; then
+    ./configure --prefix=$DEPS_PREFIX --disable-dependency-tracking
+    make CFLAGS="-O -g -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch i386 -arch ppc" \
+    LDFLAGS="-arch i386 -arch ppc"
+    make install
+  else
+    ./configure --prefix=$DEPS_PREFIX
+  
+    make
+    make install
+  fi
+  
+  cd $DL_DIR
+  rm -rf $DL_DIR/curl-$LIBCURL_VERSION
+fi
diff --git a/WebKitTools/wx/packaging/build-mac-installer.py b/WebKitTools/wx/packaging/build-mac-installer.py
new file mode 100644
index 0000000..a0c1b22
--- /dev/null
+++ b/WebKitTools/wx/packaging/build-mac-installer.py
@@ -0,0 +1,157 @@
+#!/usr/bin/env python
+
+# Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+#
+# Script for building Mac .pkg installer
+
+import commands
+import distutils.sysconfig
+import glob
+import optparse
+import os
+import shutil
+import string
+import sys
+import tempfile
+
+script_dir = os.path.abspath(os.path.dirname(__file__))
+sys.path.append(os.path.abspath(os.path.join(script_dir, "..", "build")))
+
+from build_utils import *
+
+import wx
+
+wxwk_root = os.path.abspath(os.path.join(script_dir, "..", "..", ".."))
+wxwebkit_dir = os.path.abspath(os.path.join(wxwk_root, "WebKitBuild", get_config(wxwk_root) + git_branch_name()))
+
+wx_version = wx.__version__[:5]
+py_version = sys.version[:3]
+
+wxwk_version = svn_revision()
+
+platform = "osx"
+    
+pkgname = "wxWebKit-%s-wx%s-py%s" % (platform, wx_version[:3], py_version)
+
+tempdir = "/tmp/%s" % (pkgname)
+
+if os.path.exists(tempdir):
+    shutil.rmtree(tempdir)
+    os.makedirs(tempdir)
+
+installroot = os.path.join(tempdir, "install-root")
+installapps = os.path.join(tempdir, "install-apps")
+
+sp_root = distutils.sysconfig.get_python_lib()
+wx_root = sp_root
+if sys.platform.startswith("darwin"):
+    wx_root = "/usr/local/lib/wxPython-unicode-%s" % wx.__version__
+    sp_root = "%s/lib/python%s/site-packages" % (wx_root, py_version)
+sitepackages = "%s/wx-%s-mac-unicode/wx" % (sp_root, wx_version[:3])
+prefix = sitepackages
+
+def mac_update_dependencies(dylib, prefix):
+    """
+    Copies any non-system dependencies into the bundle, and
+    updates the install name path to the new path in the bundle.
+    """
+    global wx_root
+    system_prefixes = ["/usr/lib", "/System/Library", wx_root]
+
+    output = commands.getoutput("otool -L %s" % dylib).strip()
+    for line in output.split("\n"):
+        filename = line.split("(")[0].strip()
+        if os.path.exists(filename):
+            print "checking dll %s" % filename
+            copy = True
+            for sys_prefix in system_prefixes:
+                if filename.startswith(sys_prefix):
+                    copy = False
+            
+            if copy:
+                copydir = os.path.dirname(dylib)
+                
+                filedir, basename = os.path.split(filename)
+                dest_filename = os.path.join(prefix, basename)
+                copyname = os.path.join(copydir, basename)
+                if not os.path.exists(copyname):
+                    shutil.copy(filename, copydir)
+                    os.system("install_name_tool -id %s %s" % (dest_filename, copyname))
+                
+                os.system("install_name_tool -change %s %s %s" % (filename, dest_filename, dylib))
+
+def exitIfError(cmd):
+    print cmd
+    retval = os.system(cmd)
+    if retval != 0:
+        if os.path.exists(tempdir):
+            shutil.rmtree(tempdir)
+        sys.exit(1)
+
+wxroot = installroot + prefix
+wxpythonroot = installroot + sitepackages
+
+try:
+    if not os.path.exists(wxroot):
+        os.makedirs(wxroot)
+    
+    if not os.path.exists(wxpythonroot):
+        os.makedirs(wxpythonroot)
+    
+    for wildcard in ["*.py", "*.so", "*.dylib"]:
+        files = glob.glob(os.path.join(wxwebkit_dir, wildcard))
+        for afile in files:
+            shutil.copy(afile, wxpythonroot)
+    
+    if sys.platform.startswith("darwin"):
+        dylib_path = os.path.join(wxpythonroot, "libwxwebkit.dylib")
+        os.system("install_name_tool -id %s %s" % (os.path.join(prefix, "libwxwebkit.dylib"), dylib_path))
+        mac_update_dependencies(dylib_path, prefix)
+        mac_update_dependencies(os.path.join(wxpythonroot, "_webview.so"), prefix)
+        
+        demodir = installroot + "/Applications/wxWebKit/Demos"
+        if not os.path.exists(demodir):
+            os.makedirs(demodir)
+            
+        shutil.copy(os.path.join(wxwk_root, "WebKit", "wx", "bindings", "python", "samples", "simple.py"), demodir)
+        
+        if os.path.exists(pkgname + ".pkg"):
+            shutil.rmtree(pkgname + ".pkg")
+    
+        pkg_args = ['--title ' + pkgname,
+                    '--out %s.pkg' % pkgname,
+                    '--version ' + wxwk_version.strip(),
+                    '--id org.wxwebkit.wxwebkit',
+                    '--domain system',
+                    '--root-volume-only',
+                    '--root ' + installroot,
+                    '--resources %s/mac/resources' % script_dir,
+                    '--verbose'
+                    ]
+    
+        packagemaker = "/Developer/Applications/Utilities/PackageMaker.app/Contents/MacOS/PackageMaker"
+        exitIfError(packagemaker + " %s" % (string.join(pkg_args, " ")))
+finally:
+    if os.path.exists(tempdir):
+        shutil.rmtree(tempdir)
diff --git a/WebKitTools/wx/packaging/build-win-installer.py b/WebKitTools/wx/packaging/build-win-installer.py
index beed705..2bb8034 100644
--- a/WebKitTools/wx/packaging/build-win-installer.py
+++ b/WebKitTools/wx/packaging/build-win-installer.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 
 # Copyright (C) 2008 Kevin Ollivier  All rights reserved.
 #
@@ -30,6 +30,14 @@ import commands
 import glob
 from subprocess import *
 
+script_dir = os.path.abspath(os.path.dirname(__file__))
+sys.path.append(os.path.abspath(os.path.join(script_dir, "..", "build")))
+
+from build_utils import *
+
+wxwk_root = os.path.abspath(os.path.join(script_dir, "..", "..", ".."))
+wxwebkit_dir = os.path.abspath(os.path.join(wxwk_root, "WebKitBuild", get_config(wxwk_root) + git_branch_name()))
+
 # Find InnoSetup executable
 def getInnoSetupPath():
     name = "ISCC.exe"
@@ -37,6 +45,7 @@ def getInnoSetupPath():
     dirs = os.environ["PATH"].split(":")
     # Add the default file path
     dirs.append("C:\\Program Files\\Inno Setup 5")
+    dirs.append("C:\\Program Files (x86)\\Inno Setup 5")
                     
     if os.environ.has_key("INNO5"):
         retval = os.environ["INNO5"]
@@ -48,40 +57,19 @@ def getInnoSetupPath():
                 retval = filepath
             
     return retval
-    
-def getWebKitOutputDir():
-    retval = ""
-    if os.environ.has_key("WEBKITOUTPUTDIR"):
-        retval = os.environ["WEBKITOUTPUTDIR"]
-        
-    if retval == "":
-        retval = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "..", "WebKitBuild"))
-        
-    return os.path.join(retval, "Release")
-
-def getRevisionString():
-    pipe = Popen("svnversion", shell=True, stdout=PIPE).stdout
-    svnrevision = pipe.read().strip()
-    print "r" + svnrevision
-    svnrevision = string.split(svnrevision, ":")[0]
-    svnrevision = svnrevision.replace("M", "")
-    svnrevision = "r" + svnrevision
-    
-    return svnrevision
 
 if __name__ == "__main__":
     innoSetup = getInnoSetupPath()
-    buildDir = getWebKitOutputDir()
     os.chdir(sys.path[0])
 
-    svnrevision = getRevisionString()
+    svnrevision = svn_revision()
 
     if not os.path.exists(innoSetup):
         print "ERROR: Cannot find InnoSetup."
         #sys.exit(1)
         
-    if not os.path.exists(buildDir):
-        print "ERROR: Build dir %s doesn't exist." % buildDir
+    if not os.path.exists(wxwebkit_dir):
+        print "ERROR: Build dir %s doesn't exist." % wxwebkit_dir
         sys.exit(1)
 
     fileList = """
@@ -89,7 +77,7 @@ CopyMode: alwaysoverwrite; Source: *.pyd;        DestDir: "{app}"
 CopyMode: alwaysoverwrite; Source: *.py;        DestDir: "{app}"
 """
     
-    dlls = glob.glob(os.path.join(buildDir, "*.dll"))
+    dlls = glob.glob(os.path.join(wxwebkit_dir, "*.dll"))
     for dll in dlls:
         if dll.find("wxbase") == -1 and dll.find("wxmsw") == -1:
             fileList += """CopyMode: alwaysoverwrite; Source: %s;        DestDir: "{app}" \n""" % dll
@@ -97,8 +85,8 @@ CopyMode: alwaysoverwrite; Source: *.py;        DestDir: "{app}"
     installerTemplate = open("wxWebKitInstaller.iss.in", "r").read()
 
     installerTemplate = installerTemplate.replace("<<VERSION>>", svnrevision)
-    installerTemplate = installerTemplate.replace("<<ROOTDIR>>", buildDir )
-    installerTemplate = installerTemplate.replace("<<PYTHONVER>>", "2.5" )
+    installerTemplate = installerTemplate.replace("<<ROOTDIR>>", wxwebkit_dir )
+    installerTemplate = installerTemplate.replace("<<PYTHONVER>>", sys.version[0:3] )
     installerTemplate = installerTemplate.replace("<<FILES>>", fileList )
 
     outputFile = open("wxWebKitInstaller.iss", "w")
diff --git a/WebKitTools/wx/packaging/wxWebKitInstaller.iss.in b/WebKitTools/wx/packaging/wxWebKitInstaller.iss.in
index a2c808c..ebc89d4 100644
--- a/WebKitTools/wx/packaging/wxWebKitInstaller.iss.in
+++ b/WebKitTools/wx/packaging/wxWebKitInstaller.iss.in
@@ -17,7 +17,7 @@ UninstallFilesDir={app}\Uninstall
 Compression=bzip/9
 SourceDir=<<ROOTDIR>>
 OutputDir=win-installer
-OutputBaseFilename=wxWebKit-Py<<PYTHONVER>>-<<VERSION>>
+OutputBaseFilename=wxWebKit-wx2.8-Py<<PYTHONVER>>-<<VERSION>>
 DisableStartupPrompt=yes
 AllowNoIcons=yes
 DisableProgramGroupPage=yes
diff --git a/autotools/symbols.filter b/autotools/symbols.filter
index 4296d09..7bc3f64 100644
--- a/autotools/symbols.filter
+++ b/autotools/symbols.filter
@@ -1,4 +1,10 @@
 {
+global:
+_ZN3WTF10fastMallocEj;
+_ZN3WTF11fastReallocEPvj;
+_ZN3WTF8fastFreeEPv;
+_ZN3WTF10fastCallocEjj;
+
 local:
 _Z*;
 cti*;
diff --git a/autotools/webkit.m4 b/autotools/webkit.m4
index 5bb4f65..14dd0a5 100644
--- a/autotools/webkit.m4
+++ b/autotools/webkit.m4
@@ -144,13 +144,16 @@ AC_MSG_RESULT([$with_unicode_backend])
 # with the WTF Unicode backend being based on GLib while text codecs and TextBreakIterator
 # keep the ICU dependency. That's why we temporarily add icu headers and libs for glib config case as well.
 if test "$with_unicode_backend" = "icu" -o "$with_unicode_backend" = "glib"; then
-	if test "$os_darwin" = "yes"; then
-		UNICODE_CFLAGS="-I\$(srcdir)/JavaScriptCore/icu -I\$(srcdir)/WebCore/icu"
+        case "$host" in
+            *-*-darwin*)
+		UNICODE_CFLAGS="-I$srcdir/JavaScriptCore/icu -I$srcdir/WebCore/icu"
 		UNICODE_LIBS="-licucore"
-	elif test "$os_win32" = "yes"; then
+                ;;
+            *-*-mingw*)
 		UNICODE_CFLAGS=""
 		UNICODE_LIBS="-licuin -licuuc"
-	else
+                ;;
+            *)
 		AC_PATH_PROG(icu_config, icu-config, no)
 		if test "$icu_config" = "no"; then
 			AC_MSG_ERROR([Cannot find icu-config. The ICU library is needed.])
@@ -161,7 +164,8 @@ if test "$with_unicode_backend" = "icu" -o "$with_unicode_backend" = "glib"; the
 		# See man (1) icu-config for more info.
 		UNICODE_CFLAGS=`$icu_config --cppflags`
 		UNICODE_LIBS=`$icu_config --ldflags-libsonly`
-	fi
+                ;;
+        esac
 fi
 
 if test "$with_unicode_backend" = "glib"; then