Merge WebKit at r78450: Initial merge by git.

Change-Id: I6d3e5f1f868ec266a0aafdef66182ddc3f265dc1

40 files changed, 988 insertions, 355 deletions

diff --git a/Source/JavaScriptCore/wtf/Assertions.cpp b/Source/JavaScriptCore/wtf/Assertions.cpp
index 1841150..cdde180 100644
--- a/Source/JavaScriptCore/wtf/Assertions.cpp
+++ b/Source/JavaScriptCore/wtf/Assertions.cpp
@@ -54,6 +54,12 @@
 #include <wtf/Vector.h>
 #endif
 
+#if PLATFORM(MAC)
+#include <cxxabi.h>
+#include <dlfcn.h>
+#include <execinfo.h>
+#endif
+
 extern "C" {
 
 #if PLATFORM(BREWMP)
@@ -101,7 +107,8 @@ static void vprintf_stderr_common(const char* format, va_list args)
         free(buffer);
         CFRelease(str);
         CFRelease(cfFormat);
-    } else
+        return;
+    }
 #elif PLATFORM(BREWMP)
     // When str is 0, the return value is the number of bytes needed
     // to accept the result including null termination.
@@ -164,10 +171,13 @@ static void printf_stderr_common(const char* format, ...)
 
 static void printCallSite(const char* file, int line, const char* function)
 {
-#if OS(WIN) && !OS(WINCE) && defined _DEBUG
+#if OS(WINDOWS) && !OS(WINCE) && defined(_DEBUG)
     _CrtDbgReport(_CRT_WARN, file, line, NULL, "%s\n", function);
 #else
-    printf_stderr_common("(%s:%d %s)\n", file, line, function);
+    // By using this format, which matches the format used by MSVC for compiler errors, developers
+    // using Visual Studio can double-click the file/line number in the Output Window to have the
+    // editor navigate to that line of code. It seems fine for other developers, too.
+    printf_stderr_common("%s(%d) : %s\n", file, line, function);
 #endif
 }
 
@@ -197,6 +207,34 @@ void WTFReportArgumentAssertionFailure(const char* file, int line, const char* f
     printCallSite(file, line, function);
 }
 
+void WTFReportBacktrace()
+{
+#if PLATFORM(MAC) && !defined(NDEBUG)
+    static const int maxFrames = 32;
+    void* samples[maxFrames];
+    int frames = backtrace(samples, maxFrames);
+
+    for (int i = 1; i < frames; ++i) {
+        void* pointer = samples[i];
+
+        // Try to get a symbol name from the dynamic linker.
+        Dl_info info;
+        if (dladdr(pointer, &info) && info.dli_sname) {
+            const char* mangledName = info.dli_sname;
+
+            // Assume c++ & try to demangle the name.
+            char* demangledName = abi::__cxa_demangle(mangledName, 0, 0, 0);
+            if (demangledName) {
+                fprintf(stderr, " -> %s\n", demangledName);
+                free(demangledName);
+            } else
+                fprintf(stderr, " -> %s\n", mangledName);
+        } else
+            fprintf(stderr, " -> %p\n", pointer);
+    }
+#endif
+}
+
 void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...)
 {
     printf_stderr_common("FATAL ERROR: ");
diff --git a/Source/JavaScriptCore/wtf/Assertions.h b/Source/JavaScriptCore/wtf/Assertions.h
index 3f3af72..13ece31 100644
--- a/Source/JavaScriptCore/wtf/Assertions.h
+++ b/Source/JavaScriptCore/wtf/Assertions.h
@@ -145,6 +145,7 @@ typedef struct {
 void WTFReportAssertionFailure(const char* file, int line, const char* function, const char* assertion);
 void WTFReportAssertionFailureWithMessage(const char* file, int line, const char* function, const char* assertion, const char* format, ...) WTF_ATTRIBUTE_PRINTF(5, 6);
 void WTFReportArgumentAssertionFailure(const char* file, int line, const char* function, const char* argName, const char* assertion);
+void WTFReportBacktrace();
 void WTFReportFatalError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
 void WTFReportError(const char* file, int line, const char* function, const char* format, ...) WTF_ATTRIBUTE_PRINTF(4, 5);
 void WTFLog(WTFLogChannel* channel, const char* format, ...) WTF_ATTRIBUTE_PRINTF(2, 3);
@@ -176,12 +177,23 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 } while(false)
 #else
 #define CRASH() do { \
+    WTFReportBacktrace(); \
     *(int *)(uintptr_t)0xbbadbeef = 0; \
     ((void(*)())0)(); /* More reliable, but doesn't say BBADBEEF */ \
 } while(false)
 #endif
 #endif
 
+/* BACKTRACE
+
+  Print a backtrace to the same location as ASSERT messages.
+*/
+#ifndef BACKTRACE
+#define BACKTRACE() do { \
+    WTFReportBacktrace(); \
+} while(false)
+#endif
+
 /* ASSERT, ASSERT_NOT_REACHED, ASSERT_UNUSED
 
   These macros are compiled out of release builds.
diff --git a/Source/JavaScriptCore/wtf/Bitmap.h b/Source/JavaScriptCore/wtf/Bitmap.h
index 4dd88f6..b046b61 100644
--- a/Source/JavaScriptCore/wtf/Bitmap.h
+++ b/Source/JavaScriptCore/wtf/Bitmap.h
@@ -21,8 +21,8 @@
 
 #include "FixedArray.h"
 #include "StdLibExtras.h"
-
 #include <stdint.h>
+#include <string.h>
 
 namespace WTF {
 
@@ -36,9 +36,10 @@ public:
 
     bool get(size_t) const;
     void set(size_t);
+    bool testAndSet(size_t);
+    size_t nextPossiblyUnset(size_t) const;
     void clear(size_t);
     void clearAll();
-    void advanceToNextFreeBit(size_t&) const;
     size_t count(size_t = 0) const;
     size_t isEmpty() const;
     size_t isFull() const;
@@ -76,6 +77,16 @@ inline void Bitmap<size>::set(size_t n)
 }
 
 template<size_t size>
+inline bool Bitmap<size>::testAndSet(size_t n)
+{
+    WordType mask = one << (n % wordSize);
+    size_t index = n / wordSize;
+    bool result = bits[index] & mask;
+    bits[index] |= mask;
+    return result;
+}
+
+template<size_t size>
 inline void Bitmap<size>::clear(size_t n)
 {
     bits[n / wordSize] &= ~(one << (n % wordSize));
@@ -88,12 +99,11 @@ inline void Bitmap<size>::clearAll()
 }
 
 template<size_t size>
-inline void Bitmap<size>::advanceToNextFreeBit(size_t& start) const
+inline size_t Bitmap<size>::nextPossiblyUnset(size_t start) const
 {
     if (!~bits[start / wordSize])
-        start = ((start / wordSize) + 1) * wordSize;
-    else
-        ++start;
+        return ((start / wordSize) + 1) * wordSize;
+    return start + 1;
 }
 
 template<size_t size>
diff --git a/Source/JavaScriptCore/wtf/BloomFilter.h b/Source/JavaScriptCore/wtf/BloomFilter.h
new file mode 100644
index 0000000..f81d83e
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/BloomFilter.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BloomFilter_h
+#define BloomFilter_h
+
+#include <wtf/AlwaysInline.h>
+#include <wtf/text/AtomicString.h>
+
+namespace WTF {
+
+// Counting bloom filter with k=2 and 8 bit counters. Uses 2^keyBits bytes of memory.
+// False positive rate is approximately (1-e^(-2n/m))^2, where n is the number of unique 
+// keys and m is the table size (==2^keyBits).
+template <unsigned keyBits>
+class BloomFilter {
+public:
+    COMPILE_ASSERT(keyBits <= 16, bloom_filter_key_size);
+
+    static const size_t tableSize = 1 << keyBits;
+    static const unsigned keyMask = (1 << keyBits) - 1;
+    static uint8_t maximumCount() { return std::numeric_limits<uint8_t>::max(); }
+    
+    BloomFilter() { clear(); }
+
+    void add(unsigned hash);
+    void remove(unsigned hash);
+
+    // The filter may give false positives (claim it may contain a key it doesn't)
+    // but never false negatives (claim it doesn't contain a key it does).
+    bool mayContain(unsigned hash) const { return firstSlot(hash) && secondSlot(hash); }
+    
+    // The filter must be cleared before reuse even if all keys are removed.
+    // Otherwise overflowed keys will stick around.
+    void clear();
+
+    void add(const AtomicString& string) { add(string.impl()->existingHash()); }
+    void add(const String& string) { add(string.impl()->hash()); }
+    void remove(const AtomicString& string) { remove(string.impl()->existingHash()); }
+    void remove(const String& string) { remove(string.impl()->hash()); }
+
+    bool mayContain(const AtomicString& string) const { return mayContain(string.impl()->existingHash()); }
+    bool mayContain(const String& string) const { return mayContain(string.impl()->hash()); }
+
+#if !ASSERT_DISABLED
+    // Slow.
+    bool likelyEmpty() const;
+    bool isClear() const;
+#endif
+
+private:
+    uint8_t& firstSlot(unsigned hash) { return m_table[hash & keyMask]; }
+    uint8_t& secondSlot(unsigned hash) { return m_table[(hash >> 16) & keyMask]; }
+    const uint8_t& firstSlot(unsigned hash) const { return m_table[hash & keyMask]; }
+    const uint8_t& secondSlot(unsigned hash) const { return m_table[(hash >> 16) & keyMask]; }
+
+    uint8_t m_table[tableSize];
+};
+    
+template <unsigned keyBits>
+inline void BloomFilter<keyBits>::add(unsigned hash)
+{
+    uint8_t& first = firstSlot(hash);
+    uint8_t& second = secondSlot(hash);
+    if (LIKELY(first < maximumCount()))
+        ++first;
+    if (LIKELY(second < maximumCount()))
+        ++second;
+}
+
+template <unsigned keyBits>
+inline void BloomFilter<keyBits>::remove(unsigned hash)
+{
+    uint8_t& first = firstSlot(hash);
+    uint8_t& second = secondSlot(hash);
+    ASSERT(first);
+    ASSERT(second);
+    // In case of an overflow, the slot sticks in the table until clear().
+    if (LIKELY(first < maximumCount()))
+        --first;
+    if (LIKELY(second < maximumCount()))
+        --second;
+}
+    
+template <unsigned keyBits>
+inline void BloomFilter<keyBits>::clear()
+{
+    memset(m_table, 0, tableSize);
+}
+
+#if !ASSERT_DISABLED
+template <unsigned keyBits>
+bool BloomFilter<keyBits>::likelyEmpty() const
+{
+    for (size_t n = 0; n < tableSize; ++n) {
+        if (m_table[n] && m_table[n] != maximumCount())
+            return false;
+    }
+    return true;
+}
+
+template <unsigned keyBits>
+bool BloomFilter<keyBits>::isClear() const
+{
+    for (size_t n = 0; n < tableSize; ++n) {
+        if (m_table[n])
+            return false;
+    }
+    return true;
+}
+#endif
+
+}
+
+using WTF::BloomFilter;
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/CMakeLists.txt b/Source/JavaScriptCore/wtf/CMakeLists.txt
index b1931d7..f85bf02 100644
--- a/Source/JavaScriptCore/wtf/CMakeLists.txt
+++ b/Source/JavaScriptCore/wtf/CMakeLists.txt
@@ -9,6 +9,7 @@ SET(WTF_HEADERS
     ByteArray.h
     Complex.h
     CrossThreadRefCounted.h
+    CryptographicallyRandomNumber.h
     CurrentTime.h
     DateMath.h
     DecimalNumber.h
@@ -41,8 +42,8 @@ SET(WTF_HEADERS
     NotFound.h
     NullPtr.h
     OSAllocator.h
+    OSRandomSource.h
     OwnArrayPtr.h
-    OwnArrayPtrCommon.h
     OwnFastMallocPtr.h
     OwnPtr.h
     OwnPtrCommon.h
@@ -95,6 +96,7 @@ SET(WTF_HEADERS
     text/StringImplBase.h
     text/WTFString.h
 
+    unicode/CharacterNames.h
     unicode/Collator.h
     unicode/UTF8.h
     unicode/Unicode.h
@@ -103,12 +105,14 @@ SET(WTF_HEADERS
 SET(WTF_SOURCES
     Assertions.cpp
     ByteArray.cpp
+    CryptographicallyRandomNumber.cpp
     CurrentTime.cpp
     DecimalNumber.cpp
     FastMalloc.cpp
     HashTable.cpp
     MainThread.cpp
     MD5.cpp
+    OSRandomSource.cpp
     RandomNumber.cpp
     RefCountedLeakCounter.cpp
     StackBounds.cpp
@@ -136,6 +140,7 @@ INCLUDE_IF_EXISTS(${JAVASCRIPTCORE_DIR}/wtf/CMakeLists${PORT}.txt)
 
 LIST(APPEND WTF_INCLUDE_DIRECTORIES
     "${CMAKE_BINARY_DIR}"
+    "${CMAKE_SOURCE_DIR}/ThirdParty"
 )
 
 WEBKIT_WRAP_SOURCELIST(${WTF_SOURCES})
diff --git a/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp
new file mode 100644
index 0000000..4c49873
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.cpp
@@ -0,0 +1,191 @@
+/*
+ * Copyright (c) 1996, David Mazieres <dm@uun.org>
+ * Copyright (c) 2008, Damien Miller <djm@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Arc4 random number generator for OpenBSD.
+ *
+ * This code is derived from section 17.1 of Applied Cryptography,
+ * second edition, which describes a stream cipher allegedly
+ * compatible with RSA Labs "RC4" cipher (the actual description of
+ * which is a trade secret).  The same algorithm is used as a stream
+ * cipher called "arcfour" in Tatu Ylonen's ssh package.
+ *
+ * RC4 is a registered trademark of RSA Laboratories.
+ */
+
+#include "config.h"
+#include "CryptographicallyRandomNumber.h"
+
+#include "MainThread.h"
+#include "OSRandomSource.h"
+#include "StdLibExtras.h"
+#include "ThreadingPrimitives.h"
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+
+namespace {
+
+class ARC4Stream {
+public:
+    ARC4Stream();
+
+    uint8_t i;
+    uint8_t j;
+    uint8_t s[256];
+};
+
+class ARC4RandomNumberGenerator {
+public:
+    ARC4RandomNumberGenerator();
+
+    uint32_t randomNumber();
+    void randomValues(void* buffer, size_t length);
+
+private:
+    inline void addRandomData(unsigned char *data, int length);
+    void stir();
+    void stirIfNeeded();
+    inline uint8_t getByte();
+    inline uint32_t getWord();
+
+    ARC4Stream m_stream;
+    int m_count;
+#if ENABLE(JSC_MULTIPLE_THREADS)
+    Mutex m_mutex;
+#endif
+};
+
+ARC4Stream::ARC4Stream()
+{
+    for (int n = 0; n < 256; n++)
+        s[n] = n;
+    i = 0;
+    j = 0;
+}
+
+ARC4RandomNumberGenerator::ARC4RandomNumberGenerator()
+    : m_count(0)
+{
+}
+
+void ARC4RandomNumberGenerator::addRandomData(unsigned char* data, int length)
+{
+    m_stream.i--;
+    for (int n = 0; n < 256; n++) {
+        m_stream.i++;
+        uint8_t si = m_stream.s[m_stream.i];
+        m_stream.j += si + data[n % length];
+        m_stream.s[m_stream.i] = m_stream.s[m_stream.j];
+        m_stream.s[m_stream.j] = si;
+    }
+    m_stream.j = m_stream.i;
+}
+
+void ARC4RandomNumberGenerator::stir()
+{
+    unsigned char randomness[128];
+    size_t length = sizeof(randomness);
+    cryptographicallyRandomValuesFromOS(randomness, length);
+    addRandomData(randomness, length);
+
+    // Discard early keystream, as per recommendations in:
+    // http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps
+    for (int i = 0; i < 256; i++)
+        getByte();
+    m_count = 1600000;
+}
+
+void ARC4RandomNumberGenerator::stirIfNeeded()
+{
+    if (m_count <= 0)
+        stir();
+}
+
+uint8_t ARC4RandomNumberGenerator::getByte()
+{
+    m_stream.i++;
+    uint8_t si = m_stream.s[m_stream.i];
+    m_stream.j += si;
+    uint8_t sj = m_stream.s[m_stream.j];
+    m_stream.s[m_stream.i] = sj;
+    m_stream.s[m_stream.j] = si;
+    return (m_stream.s[(si + sj) & 0xff]);
+}
+
+uint32_t ARC4RandomNumberGenerator::getWord()
+{
+    uint32_t val;
+    val = getByte() << 24;
+    val |= getByte() << 16;
+    val |= getByte() << 8;
+    val |= getByte();
+    return val;
+}
+
+uint32_t ARC4RandomNumberGenerator::randomNumber()
+{
+#if ENABLE(JSC_MULTIPLE_THREADS)
+    MutexLocker locker(m_mutex);
+#else
+    ASSERT(isMainThread());
+#endif
+
+    m_count -= 4;
+    stirIfNeeded();
+    return getWord();
+}
+
+void ARC4RandomNumberGenerator::randomValues(void* buffer, size_t length)
+{
+#if ENABLE(JSC_MULTIPLE_THREADS)
+    MutexLocker locker(m_mutex);
+#else
+    ASSERT(isMainThread());
+#endif
+
+    unsigned char* result = reinterpret_cast<unsigned char*>(buffer);
+    stirIfNeeded();
+    while (length--) {
+        m_count--;
+        stirIfNeeded();
+        result[length] = getByte();
+    }
+}
+
+ARC4RandomNumberGenerator& sharedRandomNumberGenerator()
+{
+    DEFINE_STATIC_LOCAL(ARC4RandomNumberGenerator, randomNumberGenerator, ());
+    return randomNumberGenerator;
+}
+
+}
+
+uint32_t cryptographicallyRandomNumber()
+{
+    return sharedRandomNumberGenerator().randomNumber();
+}
+
+void cryptographicallyRandomValues(void* buffer, size_t length)
+{
+    sharedRandomNumberGenerator().randomValues(buffer, length);
+}
+
+#endif
+
+}
diff --git a/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h
new file mode 100644
index 0000000..348242e
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/CryptographicallyRandomNumber.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_CryptographicallyRandomNumber_h
+#define WTF_CryptographicallyRandomNumber_h
+
+#include <stdint.h>
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+uint32_t cryptographicallyRandomNumber();
+void cryptographicallyRandomValues(void* buffer, size_t length);
+#endif
+
+}
+
+#if USE(OS_RANDOMNESS)
+using WTF::cryptographicallyRandomNumber;
+using WTF::cryptographicallyRandomValues;
+#endif
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/CurrentTime.h b/Source/JavaScriptCore/wtf/CurrentTime.h
index 7119656..5fcb63a 100644
--- a/Source/JavaScriptCore/wtf/CurrentTime.h
+++ b/Source/JavaScriptCore/wtf/CurrentTime.h
@@ -36,27 +36,27 @@
 
 namespace WTF {
 
-    // Returns the current UTC time in seconds, counted from January 1, 1970.
-    // Precision varies depending on platform but is usually as good or better 
-    // than a millisecond.
-    double currentTime();
+// Returns the current UTC time in seconds, counted from January 1, 1970.
+// Precision varies depending on platform but is usually as good or better
+// than a millisecond.
+double currentTime();
 
-    // Same thing, in milliseconds.
-    inline double currentTimeMS()
-    {
-        return currentTime() * 1000.0; 
-    }
+// Same thing, in milliseconds.
+inline double currentTimeMS()
+{
+    return currentTime() * 1000.0;
+}
 
-    inline void getLocalTime(const time_t* localTime, struct tm* localTM)
-    {
-    #if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW) || OS(WINCE)
-        *localTM = *localtime(localTime);
-    #elif COMPILER(MSVC)
-        localtime_s(localTM, localTime);
-    #else
-        localtime_r(localTime, localTM);
-    #endif
-    }
+inline void getLocalTime(const time_t* localTime, struct tm* localTM)
+{
+#if COMPILER(MSVC7_OR_LOWER) || COMPILER(MINGW) || OS(WINCE)
+    *localTM = *localtime(localTime);
+#elif COMPILER(MSVC)
+    localtime_s(localTM, localTime);
+#else
+    localtime_r(localTime, localTM);
+#endif
+}
 
 } // namespace WTF
 
diff --git a/Source/JavaScriptCore/wtf/DateMath.h b/Source/JavaScriptCore/wtf/DateMath.h
index 41bd4fa..2ac284e 100644
--- a/Source/JavaScriptCore/wtf/DateMath.h
+++ b/Source/JavaScriptCore/wtf/DateMath.h
@@ -135,7 +135,6 @@ public:
         , year(0)
         , isDST(0)
         , utcOffset(0)
-        , timeZone(0)
     {
     }
 
diff --git a/Source/JavaScriptCore/wtf/FastMalloc.cpp b/Source/JavaScriptCore/wtf/FastMalloc.cpp
index ae93c02..29e9a1a 100644
--- a/Source/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/Source/JavaScriptCore/wtf/FastMalloc.cpp
@@ -1061,11 +1061,8 @@ class PageHeapAllocator {
   template <class Recorder>
   void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
   {
-      vm_address_t adminAllocation = reinterpret_cast<vm_address_t>(allocated_regions_);
-      while (adminAllocation) {
-          recorder.recordRegion(adminAllocation, kAllocIncrement);
-          adminAllocation = *reader(reinterpret_cast<vm_address_t*>(adminAllocation));
-      }
+      for (void* adminAllocation = allocated_regions_; adminAllocation; adminAllocation = reader.nextEntryInLinkedList(reinterpret_cast<void**>(adminAllocation)))
+          recorder.recordRegion(reinterpret_cast<vm_address_t>(adminAllocation), kAllocIncrement);
   }
 #endif
 };
@@ -2221,7 +2218,7 @@ class TCMalloc_ThreadCache_FreeList {
   template <class Finder, class Reader>
   void enumerateFreeObjects(Finder& finder, const Reader& reader)
   {
-      for (void* nextObject = list_; nextObject; nextObject = *reader(reinterpret_cast<void**>(nextObject)))
+      for (void* nextObject = list_; nextObject; nextObject = reader.nextEntryInLinkedList(reinterpret_cast<void**>(nextObject)))
           finder.visit(nextObject);
   }
 #endif
@@ -2346,7 +2343,7 @@ class TCMalloc_Central_FreeList {
     Span* remoteSpan = nonempty_.next;
 
     for (Span* span = reader(remoteSpan); span && remoteSpan != remoteNonempty; remoteSpan = span->next, span = (span->next ? reader(span->next) : 0)) {
-      for (void* nextObject = span->objects; nextObject; nextObject = *reader(reinterpret_cast<void**>(nextObject)))
+      for (void* nextObject = span->objects; nextObject; nextObject = reader.nextEntryInLinkedList(reinterpret_cast<void**>(nextObject)))
         finder.visit(nextObject);
     }
   }
@@ -4341,12 +4338,15 @@ public:
             return 1;
 
         Span* span = m_reader(reinterpret_cast<Span*>(ptr));
+        if (!span)
+            return 1;
+
         if (span->free) {
             void* ptr = reinterpret_cast<void*>(span->start << kPageShift);
             m_freeObjectFinder.visit(ptr);
         } else if (span->sizeclass) {
             // Walk the free list of the small-object span, keeping track of each object seen
-            for (void* nextObject = span->objects; nextObject; nextObject = *m_reader(reinterpret_cast<void**>(nextObject)))
+            for (void* nextObject = span->objects; nextObject; nextObject = m_reader.nextEntryInLinkedList(reinterpret_cast<void**>(nextObject)))
                 m_freeObjectFinder.visit(nextObject);
         }
         return span->length;
@@ -4430,7 +4430,7 @@ public:
             return 1;
 
         Span* span = m_reader(reinterpret_cast<Span*>(ptr));
-        if (!span->start)
+        if (!span || !span->start)
             return 1;
 
         if (m_seenPointers.contains(ptr))
diff --git a/Source/JavaScriptCore/wtf/HashSet.h b/Source/JavaScriptCore/wtf/HashSet.h
index be6b93d..82245f3 100644
--- a/Source/JavaScriptCore/wtf/HashSet.h
+++ b/Source/JavaScriptCore/wtf/HashSet.h
@@ -175,14 +175,14 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V>
-    pair<typename HashSet<T, U, V>::iterator, bool> HashSet<T, U, V>::add(const ValueType& value)
+    inline pair<typename HashSet<T, U, V>::iterator, bool> HashSet<T, U, V>::add(const ValueType& value)
     {
         return m_impl.add(value);
     }
 
     template<typename Value, typename HashFunctions, typename Traits>
     template<typename T, typename HashTranslator>
-    pair<typename HashSet<Value, HashFunctions, Traits>::iterator, bool>
+    inline pair<typename HashSet<Value, HashFunctions, Traits>::iterator, bool>
     HashSet<Value, HashFunctions, Traits>::add(const T& value)
     {
         typedef HashSetTranslatorAdapter<ValueType, ValueTraits, T, HashTranslator> Adapter;
diff --git a/Source/JavaScriptCore/wtf/MallocZoneSupport.h b/Source/JavaScriptCore/wtf/MallocZoneSupport.h
index 62df145..4332e40 100644
--- a/Source/JavaScriptCore/wtf/MallocZoneSupport.h
+++ b/Source/JavaScriptCore/wtf/MallocZoneSupport.h
@@ -47,7 +47,6 @@ public:
     {
         void* output;
         kern_return_t err = (*m_reader)(m_task, address, size, static_cast<void**>(&output));
-        ASSERT(!err);
         if (err)
             output = 0;
         return output;
@@ -58,6 +57,15 @@ public:
     {
         return static_cast<T*>((*this)(reinterpret_cast<vm_address_t>(address), size));
     }
+
+    template <typename T>
+    T* nextEntryInLinkedList(T** address) const
+    {
+        T** output = (*this)(address);
+        if (!output)
+            return 0;
+        return *output;
+    }
 };
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/MathExtras.h b/Source/JavaScriptCore/wtf/MathExtras.h
index 095549e..ec27f5f 100644
--- a/Source/JavaScriptCore/wtf/MathExtras.h
+++ b/Source/JavaScriptCore/wtf/MathExtras.h
@@ -26,8 +26,10 @@
 #ifndef WTF_MathExtras_h
 #define WTF_MathExtras_h
 
+#include <algorithm>
 #include <cmath>
 #include <float.h>
+#include <limits>
 #include <stdlib.h>
 
 #if OS(SOLARIS)
@@ -205,6 +207,32 @@ inline float deg2turn(float d) { return d / 360.0f; }
 inline float rad2grad(float r) { return r * 200.0f / piFloat; }
 inline float grad2rad(float g) { return g * piFloat / 200.0f; }
 
+inline int clampToInteger(double d)
+{
+    const double minIntAsDouble = std::numeric_limits<int>::min();
+    const double maxIntAsDouble = std::numeric_limits<int>::max();
+    return static_cast<int>(std::max(std::min(d, maxIntAsDouble), minIntAsDouble));
+}
+
+inline int clampToPositiveInteger(double d)
+{
+    const double maxIntAsDouble = std::numeric_limits<int>::max();
+    return static_cast<int>(std::max<double>(std::min(d, maxIntAsDouble), 0));
+}
+
+inline int clampToInteger(float d)
+{
+    const float minIntAsFloat = static_cast<float>(std::numeric_limits<int>::min());
+    const float maxIntAsFloat = static_cast<float>(std::numeric_limits<int>::max());
+    return static_cast<int>(std::max(std::min(d, maxIntAsFloat), minIntAsFloat));
+}
+
+inline int clampToPositiveInteger(float d)
+{
+    const float maxIntAsFloat = static_cast<float>(std::numeric_limits<int>::max());
+    return static_cast<int>(std::max<float>(std::min(d, maxIntAsFloat), 0));
+}
+
 #if !COMPILER(MSVC) && !COMPILER(WINSCW) && !(COMPILER(RVCT) && (OS(SYMBIAN) || PLATFORM(BREWMP)))
 using std::isfinite;
 using std::isinf;
diff --git a/Source/JavaScriptCore/wtf/OSRandomSource.cpp b/Source/JavaScriptCore/wtf/OSRandomSource.cpp
new file mode 100644
index 0000000..0c1416a
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/OSRandomSource.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "OSRandomSource.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+
+#if OS(UNIX)
+#include <fcntl.h>
+#include <unistd.h>
+#endif
+
+#if OS(WINDOWS)
+#include <windows.h>
+#include <wincrypt.h> // windows.h must be included before wincrypt.h.
+#endif
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+void cryptographicallyRandomValuesFromOS(unsigned char* buffer, size_t length)
+{
+#if OS(UNIX)
+    int fd = open("/dev/urandom", O_RDONLY, 0);
+    if (fd < 0)
+        CRASH(); // We need /dev/urandom for this API to work...
+
+    if (read(fd, buffer, length) != static_cast<ssize_t>(length))
+        CRASH();
+
+    close(fd);
+#elif OS(WINDOWS)
+    HCRYPTPROV hCryptProv = 0;
+    if (!CryptAcquireContext(&hCryptProv, 0, MS_DEF_PROV, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
+        CRASH();
+    if (!CryptGenRandom(hCryptProv, length, buffer))
+        CRASH();
+    CryptReleaseContext(hCryptProv, 0);
+#else
+    #error "This configuration doesn't have a strong source of randomness."
+    // WARNING: When adding new sources of OS randomness, the randomness must
+    //          be of cryptographic quality!
+#endif
+}
+#endif
+
+}
diff --git a/Source/JavaScriptCore/wtf/OSRandomSource.h b/Source/JavaScriptCore/wtf/OSRandomSource.h
new file mode 100644
index 0000000..214a954
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/OSRandomSource.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_OSRandomSource_h
+#define WTF_OSRandomSource_h
+
+namespace WTF {
+
+#if USE(OS_RANDOMNESS)
+// This function attempts to fill buffer with randomness from the operating
+// system.  If insufficient randomness is available, the buffer will be
+// partially filled.  Rather than calling this function directly, consider
+// calling cryptographicallyRandomNumber or cryptographicallyRandomValues.
+void cryptographicallyRandomValuesFromOS(unsigned char* buffer, size_t length);
+#endif
+
+}
+
+#endif
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtr.h b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
index f838a7e..6b7c8da 100644
--- a/Source/JavaScriptCore/wtf/OwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/OwnArrayPtr.h
@@ -24,13 +24,9 @@
 #include "Assertions.h"
 #include "Noncopyable.h"
 #include "NullPtr.h"
-#include "OwnPtrCommon.h"
-#include "OwnArrayPtrCommon.h"
+#include "PassOwnArrayPtr.h"
 #include <algorithm>
 
-// Remove this once we make all WebKit code compatible with stricter rules about OwnArrayPtr.
-#define LOOSE_OWN_ARRAY_PTR
-
 namespace WTF {
 
 template<typename T> class PassOwnArrayPtr;
@@ -115,16 +111,6 @@ template<typename T> inline typename OwnArrayPtr<T>::PtrType OwnArrayPtr<T>::lea
     return ptr;
 }
 
-#ifdef LOOSE_OWN_ARRAY_PTR
-template<typename T> inline void OwnArrayPtr<T>::set(PtrType ptr)
-{
-    ASSERT(!ptr || m_ptr != ptr);
-    PtrType oldPtr = m_ptr;
-    m_ptr = ptr;
-    deleteOwnedPtr(oldPtr);
-}
-#endif
-
 template<typename T> inline OwnArrayPtr<T>& OwnArrayPtr<T>::operator=(const PassOwnArrayPtr<T>& o)
 {
     PtrType ptr = m_ptr;
diff --git a/Source/JavaScriptCore/wtf/OwnArrayPtrCommon.h b/Source/JavaScriptCore/wtf/OwnArrayPtrCommon.h
deleted file mode 100644
index 0113aff..0000000
--- a/Source/JavaScriptCore/wtf/OwnArrayPtrCommon.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WTF_OwnArrayPtrCommon_h
-#define WTF_OwnArrayPtrCommon_h
-
-namespace WTF {
-
-template<typename T> inline void deleteOwnedArrayPtr(T* ptr)
-{
-    typedef char known[sizeof(T) ? 1 : -1];
-    if (sizeof(known))
-        delete [] ptr;
-}
-
-} // namespace WTF
-
-#endif // WTF_OwnArrayPtrCommon_h
diff --git a/Source/JavaScriptCore/wtf/PageAllocation.h b/Source/JavaScriptCore/wtf/PageAllocation.h
index 232cd20..ad3d217 100644
--- a/Source/JavaScriptCore/wtf/PageAllocation.h
+++ b/Source/JavaScriptCore/wtf/PageAllocation.h
@@ -85,10 +85,17 @@ public:
     {
     }
 
-    using PageBlock::operator bool;
     using PageBlock::size;
     using PageBlock::base;
 
+#ifndef __clang__
+    using PageBlock::operator bool;
+#else
+    // FIXME: This is a workaround for <rdar://problem/8876150>, wherein Clang incorrectly emits an access
+    // control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+    operator bool() const { return PageBlock::operator bool(); }
+#endif
+
     static PageAllocation allocate(size_t size, OSAllocator::Usage usage = OSAllocator::UnknownUsage, bool writable = true, bool executable = false)
     {
         ASSERT(isPageAligned(size));
diff --git a/Source/JavaScriptCore/wtf/PageReservation.h b/Source/JavaScriptCore/wtf/PageReservation.h
index 8c097a4..6dff700 100644
--- a/Source/JavaScriptCore/wtf/PageReservation.h
+++ b/Source/JavaScriptCore/wtf/PageReservation.h
@@ -57,18 +57,23 @@ namespace WTF {
 class PageReservation : private PageBlock {
 public:
     PageReservation()
-        : m_writable(false)
+        : m_committed(0)
+        , m_writable(false)
         , m_executable(false)
-#ifndef NDEBUG
-        , m_committed(0)
-#endif
     {
     }
-    
-    using PageBlock::operator bool;
+
     using PageBlock::base;
     using PageBlock::size;
 
+#ifndef __clang__
+    using PageBlock::operator bool;
+#else
+    // FIXME: This is a workaround for <rdar://problem/8876150>, wherein Clang incorrectly emits an access
+    // control warning when a client tries to use operator bool exposed above via "using PageBlock::operator bool".
+    operator bool() const { return PageBlock::operator bool(); }
+#endif
+
     void commit(void* start, size_t size)
     {
         ASSERT(*this);
@@ -76,9 +81,7 @@ public:
         ASSERT(isPageAligned(size));
         ASSERT(contains(start, size));
 
-#ifndef NDEBUG
         m_committed += size;
-#endif
         OSAllocator::commit(start, size, m_writable, m_executable);
     }
 
@@ -89,12 +92,15 @@ public:
         ASSERT(isPageAligned(size));
         ASSERT(contains(start, size));
 
-#ifndef NDEBUG
         m_committed -= size;
-#endif
         OSAllocator::decommit(start, size);
     }
 
+    size_t committed()
+    {
+        return m_committed;
+    }
+
     static PageReservation reserve(size_t size, OSAllocator::Usage usage = OSAllocator::UnknownUsage, bool writable = true, bool executable = false)
     {
         ASSERT(isPageAligned(size));
@@ -119,19 +125,15 @@ public:
 private:
     PageReservation(void* base, size_t size, bool writable, bool executable)
         : PageBlock(base, size)
+        , m_committed(0)
         , m_writable(writable)
         , m_executable(executable)
-#ifndef NDEBUG
-        , m_committed(0)
-#endif
     {
     }
 
+    size_t m_committed;
     bool m_writable;
     bool m_executable;
-#ifndef NDEBUG
-    size_t m_committed;
-#endif
 };
 
 }
diff --git a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
index 499e850..e1aa61e 100644
--- a/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
+++ b/Source/JavaScriptCore/wtf/PassOwnArrayPtr.h
@@ -28,7 +28,6 @@
 
 #include "Assertions.h"
 #include "NullPtr.h"
-#include "OwnArrayPtrCommon.h"
 #include "TypeTraits.h"
 
 // Remove this once we make all WebKit code compatible with stricter rules about PassOwnArrayPtr.
@@ -39,6 +38,7 @@ namespace WTF {
 template<typename T> class OwnArrayPtr;
 template<typename T> class PassOwnArrayPtr;
 template<typename T> PassOwnArrayPtr<T> adoptArrayPtr(T*);
+template<typename T> void deleteOwnedArrayPtr(T* ptr);
 
 template<typename T> class PassOwnArrayPtr {
 public:
@@ -194,6 +194,13 @@ template<typename T> inline PassOwnArrayPtr<T> adoptArrayPtr(T* ptr)
     return PassOwnArrayPtr<T>(ptr);
 }
 
+template<typename T> inline void deleteOwnedArrayPtr(T* ptr)
+{
+    typedef char known[sizeof(T) ? 1 : -1];
+    if (sizeof(known))
+        delete [] ptr;
+}
+
 template<typename T, typename U> inline PassOwnArrayPtr<T> static_pointer_cast(const PassOwnArrayPtr<U>& p) 
 {
     return adoptArrayPtr(static_cast<T*>(p.leakPtr()));
diff --git a/Source/JavaScriptCore/wtf/Platform.h b/Source/JavaScriptCore/wtf/Platform.h
index e3fec74..18f481d 100644
--- a/Source/JavaScriptCore/wtf/Platform.h
+++ b/Source/JavaScriptCore/wtf/Platform.h
@@ -564,6 +564,7 @@
 
 #if OS(WINCE)
 #include <ce_time.h>
+#define WTF_USE_MERSENNE_TWISTER_19937 1
 #endif
 
 #if (PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || (PLATFORM(QT) && OS(DARWIN) && !ENABLE(SINGLE_THREADED))) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
@@ -600,22 +601,28 @@
 #endif
 
 #if PLATFORM(MAC) && !PLATFORM(IOS)
-#define WTF_PLATFORM_CF 1
-#define WTF_USE_PTHREADS 1
-#define HAVE_PTHREAD_RWLOCK 1
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER) && CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#define ENABLE_GESTURE_EVENTS 1
+#define ENABLE_RUBBER_BANDING 1
+#define WTF_USE_WK_SCROLLBAR_PAINTER 1
+#endif
 #if !defined(ENABLE_JAVA_BRIDGE)
 #define ENABLE_JAVA_BRIDGE 1
 #endif
 #if !defined(ENABLE_DASHBOARD_SUPPORT)
 #define ENABLE_DASHBOARD_SUPPORT 1
 #endif
+#define WTF_PLATFORM_CF 1
+#define WTF_USE_PTHREADS 1
+#define HAVE_PTHREAD_RWLOCK 1
 #define HAVE_READLINE 1
 #define HAVE_RUNLOOP_TIMER 1
 #define ENABLE_FULLSCREEN_API 1
 #define ENABLE_SMOOTH_SCROLLING 1
+#define ENABLE_WEB_ARCHIVE 1
 #endif /* PLATFORM(MAC) && !PLATFORM(IOS) */
 
 #if PLATFORM(ANDROID)
@@ -660,6 +667,7 @@
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #define HAVE_PTHREAD_RWLOCK 1
+#define ENABLE_WEB_ARCHIVE 1
 #endif
 
 #if PLATFORM(ANDROID)
@@ -683,6 +691,10 @@
 #define WTF_USE_PTHREADS 0
 #endif
 
+#if PLATFORM(WIN) && !OS(WINCE) && !PLATFORM(CHROMIUM) && !PLATFORM(QT)
+#define ENABLE_WEB_ARCHIVE 1
+#endif
+
 #if PLATFORM(WX)
 #define ENABLE_ASSEMBLER 1
 #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
@@ -690,6 +702,7 @@
 #define WTF_PLATFORM_CF 1
 #ifndef BUILDING_ON_TIGER
 #define WTF_USE_CORE_TEXT 1
+#define ENABLE_WEB_ARCHIVE 1
 #else
 #define WTF_USE_ATSUI 1
 #endif
@@ -730,6 +743,12 @@
 #define HAVE_SIGNAL_H 1
 #endif
 
+#if !defined(HAVE_STRNSTR)
+#if OS(DARWIN) || OS(FREEBSD)
+#define HAVE_STRNSTR 1
+#endif
+#endif
+
 #if !OS(WINDOWS) && !OS(SOLARIS) && !OS(QNX) \
     && !OS(SYMBIAN) && !OS(HAIKU) && !OS(RVCT) \
     && !OS(ANDROID) && !PLATFORM(BREWMP)
@@ -836,6 +855,9 @@
 #if PLATFORM(QT)
 /* We must not customize the global operator new and delete for the Qt port. */
 #define ENABLE_GLOBAL_FASTMALLOC_NEW 0
+#if !OS(UNIX) || OS(SYMBIAN)
+#define USE_SYSTEM_MALLOC 1
+#endif
 #endif
 
 /* fastMalloc match validation allows for runtime verification that
@@ -1040,7 +1062,10 @@
 #define ENABLE_REGEXP_TRACING 0
 
 /* Yet Another Regex Runtime - turned on by default for JIT enabled ports. */
-#if ENABLE(JIT) && !defined(ENABLE_YARR_JIT)
+#if PLATFORM(CHROMIUM)
+#define ENABLE_YARR_JIT 0
+
+#elif ENABLE(JIT) && !defined(ENABLE_YARR_JIT)
 #define ENABLE_YARR_JIT 1
 
 /* Setting this flag compares JIT results with interpreter results. */
@@ -1054,8 +1079,6 @@
    security but currectly comes at a significant performance cost. */
 #if PLATFORM(IOS)
 #define ENABLE_ASSEMBLER_WX_EXCLUSIVE 1
-#else
-#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
 #endif
 
 /* Pick which allocator to use; we only need an executable allocator if the assembler is compiled in.
@@ -1076,6 +1099,10 @@
 #define ENABLE_SMOOTH_SCROLLING 0
 #endif
 
+#if !defined(ENABLE_WEB_ARCHIVE)
+#define ENABLE_WEB_ARCHIVE 0
+#endif
+
 /* Use the QXmlStreamReader implementation for XMLDocumentParser */
 /* Use the QXmlQuery implementation for XSLTProcessor */
 #if PLATFORM(QT)
diff --git a/Source/JavaScriptCore/wtf/RandomNumber.cpp b/Source/JavaScriptCore/wtf/RandomNumber.cpp
index 0c45416..1574324 100644
--- a/Source/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/Source/JavaScriptCore/wtf/RandomNumber.cpp
@@ -34,9 +34,9 @@
 #include <stdint.h>
 #include <stdlib.h>
 
-#if OS(WINCE)
+#if USE(MERSENNE_TWISTER_19937)
 extern "C" {
-#include "wince/mt19937ar.c"
+#include "mt19937ar.c"
 }
 #endif
 
@@ -78,7 +78,7 @@ double randomNumber()
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
-#elif OS(WINCE)
+#elif USE(MERSENNE_TWISTER_19937)
     return genrand_res53();
 #elif OS(WINDOWS)
     uint32_t part1 = rand() & (RAND_MAX - 1);
diff --git a/Source/JavaScriptCore/wtf/RandomNumberSeed.h b/Source/JavaScriptCore/wtf/RandomNumberSeed.h
index 9ea7c71..0703abf 100644
--- a/Source/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/Source/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -38,7 +38,7 @@
 #include <unistd.h>
 #endif
 
-#if OS(WINCE)
+#if USE(MERSENNE_TWISTER_19937)
 extern "C" {
 void init_by_array(unsigned long init_key[],int key_length);
 }
@@ -54,14 +54,6 @@ inline void initializeRandomNumberGenerator()
 #elif OS(WINCE)
     // initialize rand()
     srand(GetTickCount());
-
-    // use rand() to initialize the real RNG
-    unsigned long initializationBuffer[4];
-    initializationBuffer[0] = (rand() << 16) | rand();
-    initializationBuffer[1] = (rand() << 16) | rand();
-    initializationBuffer[2] = (rand() << 16) | rand();
-    initializationBuffer[3] = (rand() << 16) | rand();
-    init_by_array(initializationBuffer, 4);
 #elif COMPILER(MSVC) && defined(_CRT_RAND_S)
     // On Windows we use rand_s which initialises itself
 #elif PLATFORM(BREWMP)
@@ -74,6 +66,16 @@ inline void initializeRandomNumberGenerator()
 #else
     srand(static_cast<unsigned>(time(0)));
 #endif
+
+#if USE(MERSENNE_TWISTER_19937)
+    // use rand() to initialize the Mersenne Twister random number generator.
+    unsigned long initializationBuffer[4];
+    initializationBuffer[0] = (rand() << 16) | rand();
+    initializationBuffer[1] = (rand() << 16) | rand();
+    initializationBuffer[2] = (rand() << 16) | rand();
+    initializationBuffer[3] = (rand() << 16) | rand();
+    init_by_array(initializationBuffer, 4);
+#endif
 }
 
 }
diff --git a/Source/JavaScriptCore/wtf/StringExtras.h b/Source/JavaScriptCore/wtf/StringExtras.h
index 473bb22..371e33b 100644
--- a/Source/JavaScriptCore/wtf/StringExtras.h
+++ b/Source/JavaScriptCore/wtf/StringExtras.h
@@ -100,8 +100,7 @@ inline int strcasecmp(const char* s1, const char* s2)
 
 #endif
 
-#if COMPILER(MSVC) || COMPILER(RVCT) || OS(WINDOWS) || OS(LINUX) || OS(SOLARIS)
-// FIXME: should check HAVE_STRNSTR
+#if !HAVE(STRNSTR)
 
 inline char* strnstr(const char* buffer, const char* target, size_t bufferLength)
 {
diff --git a/Source/JavaScriptCore/wtf/StringHasher.h b/Source/JavaScriptCore/wtf/StringHasher.h
index 63ce74f..a84b2c4 100644
--- a/Source/JavaScriptCore/wtf/StringHasher.h
+++ b/Source/JavaScriptCore/wtf/StringHasher.h
@@ -141,6 +141,12 @@ public:
         return createHash<UChar>(static_cast<const UChar*>(data), length / sizeof(UChar));
     }
 
+    static inline unsigned createBlobHash(const void* data, unsigned size)
+    {
+        ASSERT(!(size % 2));
+        return createHash<UChar>(static_cast<const UChar*>(data), size / sizeof(UChar));
+    }
+
 private:
     static inline UChar defaultCoverter(UChar ch)
     {
diff --git a/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp b/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 0b7ecc9..3cb59e8 100644
--- a/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/Source/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -31,6 +31,7 @@
 // Author: Sanjay Ghemawat
 
 #include "config.h"
+#if !(defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC)
 #include "TCSystemAlloc.h"
 
 #include <algorithm>
@@ -519,3 +520,6 @@ void TCMalloc_SystemCommit(void* start, size_t length)
 // declared in TCSystemAlloc.h
 
 #endif
+
+#endif // #if !(defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC)
+
diff --git a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
index 809c3e2..831a99e 100644
--- a/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
+++ b/Source/JavaScriptCore/wtf/ThreadingPrimitives.h
@@ -150,10 +150,20 @@ private:
     PlatformCondition m_condition;
 };
 
+#if OS(WINDOWS)
+// The absoluteTime is in seconds, starting on January 1, 1970. The time is assumed to use the same time zone as WTF::currentTime().
+// Returns an interval in milliseconds suitable for passing to one of the Win32 wait functions (e.g., ::WaitForSingleObject).
+DWORD absoluteTimeToWaitTimeoutInterval(double absoluteTime);
+#endif
+
 } // namespace WTF
 
 using WTF::Mutex;
 using WTF::MutexLocker;
 using WTF::ThreadCondition;
 
+#if OS(WINDOWS)
+using WTF::absoluteTimeToWaitTimeoutInterval;
+#endif
+
 #endif // ThreadingPrimitives_h
diff --git a/Source/JavaScriptCore/wtf/ThreadingWin.cpp b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
index 00319a4..4ca290f 100644
--- a/Source/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/Source/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -458,20 +458,15 @@ void ThreadCondition::wait(Mutex& mutex)
 
 bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
 {
-    double currentTime = WTF::currentTime();
+    DWORD interval = absoluteTimeToWaitTimeoutInterval(absoluteTime);
 
-    // Time is in the past - return immediately.
-    if (absoluteTime < currentTime)
+    if (!interval) {
+        // Consider the wait to have timed out, even if our condition has already been signaled, to
+        // match the pthreads implementation.
         return false;
-
-    // Time is too far in the future (and would overflow unsigned long) - wait forever.
-    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0) {
-        wait(mutex);
-        return true;
     }
 
-    double intervalMilliseconds = (absoluteTime - currentTime) * 1000.0;
-    return m_condition.timedWait(mutex.impl(), static_cast<unsigned long>(intervalMilliseconds));
+    return m_condition.timedWait(mutex.impl(), interval);
 }
 
 void ThreadCondition::signal()
@@ -484,4 +479,19 @@ void ThreadCondition::broadcast()
     m_condition.signal(true); // Unblock all threads.
 }
 
+DWORD absoluteTimeToWaitTimeoutInterval(double absoluteTime)
+{
+    double currentTime = WTF::currentTime();
+
+    // Time is in the past - return immediately.
+    if (absoluteTime < currentTime)
+        return 0;
+
+    // Time is too far in the future (and would overflow unsigned long) - wait forever.
+    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0)
+        return INFINITE;
+
+    return static_cast<DWORD>((absoluteTime - currentTime) * 1000.0);
+}
+
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
index f9f8f2f..8061e8a 100644
--- a/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
+++ b/Source/JavaScriptCore/wtf/gobject/GTypedefs.h
@@ -53,8 +53,8 @@ typedef struct _GHashTable GHashTable;
 typedef struct _GInputStream GInputStream;
 typedef struct _GList GList;
 typedef struct _GMutex GMutex;
-typedef struct _GOutputStream GOutputStream;
 typedef struct _GPatternSpec GPatternSpec;
+typedef struct _GPollableOutputStream GPollableOutputStream;
 typedef struct _GSocketClient GSocketClient;
 typedef struct _GSocketConnection GSocketConnection;
 typedef struct _GSource GSource;
diff --git a/Source/JavaScriptCore/wtf/text/AtomicString.cpp b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
index dd8d66c..e0a866d 100644
--- a/Source/JavaScriptCore/wtf/text/AtomicString.cpp
+++ b/Source/JavaScriptCore/wtf/text/AtomicString.cpp
@@ -376,7 +376,20 @@ AtomicString AtomicString::fromUTF8(const char* characters)
 {
     if (!characters)
         return AtomicString();
-    return fromUTF8(characters, strlen(characters));
+
+    if (!*characters)
+        return emptyAtom;
+
+    HashAndUTF8Characters buffer;
+    buffer.characters = characters;
+    buffer.hash = calculateStringHashAndLengthFromUTF8(characters, buffer.length, buffer.utf16Length);
+
+    if (!buffer.hash)
+        return AtomicString();
+
+    AtomicString atomicString;
+    atomicString.m_string = addToStringTable<HashAndUTF8Characters, HashAndUTF8CharactersTranslator>(buffer);
+    return atomicString;
 }
 
 } // namespace WTF
diff --git a/Source/JavaScriptCore/wtf/text/StringImpl.h b/Source/JavaScriptCore/wtf/text/StringImpl.h
index dc1dbb2..25411e1 100644
--- a/Source/JavaScriptCore/wtf/text/StringImpl.h
+++ b/Source/JavaScriptCore/wtf/text/StringImpl.h
@@ -354,6 +354,16 @@ inline bool equalIgnoringCase(const char* a, const UChar* b, unsigned length) {
 
 bool equalIgnoringNullity(StringImpl*, StringImpl*);
 
+template<size_t inlineCapacity>
+bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, StringImpl* b)
+{
+    if (!b)
+        return !a.size();
+    if (a.size() != b->length())
+        return false;
+    return !memcmp(a.data(), b->characters(), b->length());
+}
+
 int codePointCompare(const StringImpl*, const StringImpl*);
 
 static inline bool isSpaceOrNewline(UChar c)
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.cpp b/Source/JavaScriptCore/wtf/text/WTFString.cpp
index 4b6ff75..b9b4e74 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.cpp
+++ b/Source/JavaScriptCore/wtf/text/WTFString.cpp
@@ -637,7 +637,7 @@ void String::split(UChar separator, Vector<String>& result) const
 
 CString String::ascii() const
 {
-    // Basic Latin1 (ISO) encoding - Unicode characters 0..255 are
+    // Printable ASCII characters 32..127 and the null character are
     // preserved, characters outside of this range are converted to '?'.
 
     unsigned length = this->length();
diff --git a/Source/JavaScriptCore/wtf/text/WTFString.h b/Source/JavaScriptCore/wtf/text/WTFString.h
index 4d853d2..0aee2ef 100644
--- a/Source/JavaScriptCore/wtf/text/WTFString.h
+++ b/Source/JavaScriptCore/wtf/text/WTFString.h
@@ -66,6 +66,7 @@ struct StringHash;
 // Declarations of string operations
 
 bool charactersAreAllASCII(const UChar*, size_t);
+bool charactersAreAllLatin1(const UChar*, size_t);
 int charactersToIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 unsigned charactersToUIntStrict(const UChar*, size_t, bool* ok = 0, int base = 10);
 int64_t charactersToInt64Strict(const UChar*, size_t, bool* ok = 0, int base = 10);
@@ -328,6 +329,7 @@ public:
     WTF::Unicode::Direction defaultWritingDirection() const { return m_impl ? m_impl->defaultWritingDirection() : WTF::Unicode::LeftToRight; }
 
     bool containsOnlyASCII() const { return charactersAreAllASCII(characters(), length()); }
+    bool containsOnlyLatin1() const { return charactersAreAllLatin1(characters(), length()); }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     String(WTF::HashTableDeletedValueType) : m_impl(WTF::HashTableDeletedValue) { }
@@ -367,6 +369,9 @@ inline bool equalPossiblyIgnoringCase(const String& a, const String& b, bool ign
 
 inline bool equalIgnoringNullity(const String& a, const String& b) { return equalIgnoringNullity(a.impl(), b.impl()); }
 
+template<size_t inlineCapacity>
+inline bool equalIgnoringNullity(const Vector<UChar, inlineCapacity>& a, const String& b) { return equalIgnoringNullity(a, b.impl()); }
+
 inline bool operator!(const String& str) { return str.isNull(); }
 
 inline void swap(String& a, String& b) { a.swap(b); }
@@ -388,6 +393,14 @@ inline bool charactersAreAllASCII(const UChar* characters, size_t length)
     return !(ored & 0xFF80);
 }
 
+inline bool charactersAreAllLatin1(const UChar* characters, size_t length)
+{
+    UChar ored = 0;
+    for (size_t i = 0; i < length; ++i)
+        ored |= characters[i];
+    return !(ored & 0xFF00);
+}
+
 int codePointCompare(const String&, const String&);
 
 inline size_t find(const UChar* characters, unsigned length, UChar matchCharacter, unsigned index = 0)
@@ -480,6 +493,7 @@ using WTF::String;
 using WTF::append;
 using WTF::appendNumber;
 using WTF::charactersAreAllASCII;
+using WTF::charactersAreAllLatin1;
 using WTF::charactersToIntStrict;
 using WTF::charactersToUIntStrict;
 using WTF::charactersToInt64Strict;
diff --git a/Source/JavaScriptCore/wtf/unicode/CharacterNames.h b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
new file mode 100644
index 0000000..3d093a6
--- /dev/null
+++ b/Source/JavaScriptCore/wtf/unicode/CharacterNames.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CharacterNames_h
+#define CharacterNames_h
+
+#include "Unicode.h"
+
+namespace WTF {
+namespace Unicode {
+
+// Names here are taken from the Unicode standard.
+
+// Most of these are UChar constants, not UChar32, which makes them
+// more convenient for WebCore code that mostly uses UTF-16.
+
+const UChar32 aegeanWordSeparatorLine = 0x10100;
+const UChar32 aegeanWordSeparatorDot = 0x10101;
+const UChar blackCircle = 0x25CF;
+const UChar blackSquare = 0x25A0;
+const UChar blackUpPointingTriangle = 0x25B2;
+const UChar bullet = 0x2022;
+const UChar bullseye = 0x25CE;
+const UChar carriageReturn = 0x000D;
+const UChar ethiopicPrefaceColon = 0x1366;
+const UChar ethiopicWordspace = 0x1361;
+const UChar fisheye = 0x25C9;
+const UChar hebrewPunctuationGeresh = 0x05F3;
+const UChar hebrewPunctuationGershayim = 0x05F4;
+const UChar horizontalEllipsis = 0x2026;
+const UChar hyphen = 0x2010;
+const UChar hyphenMinus = 0x002D;
+const UChar ideographicComma = 0x3001;
+const UChar ideographicFullStop = 0x3002;
+const UChar ideographicSpace = 0x3000;
+const UChar leftDoubleQuotationMark = 0x201C;
+const UChar leftSingleQuotationMark = 0x2018;
+const UChar leftToRightEmbed = 0x202A;
+const UChar leftToRightMark = 0x200E;
+const UChar leftToRightOverride = 0x202D;
+const UChar minusSign = 0x2212;
+const UChar newlineCharacter = 0x000A;
+const UChar noBreakSpace = 0x00A0;
+const UChar objectReplacementCharacter = 0xFFFC;
+const UChar popDirectionalFormatting = 0x202C;
+const UChar replacementCharacter = 0xFFFD;
+const UChar rightDoubleQuotationMark = 0x201D;
+const UChar rightSingleQuotationMark = 0x2019;
+const UChar rightToLeftEmbed = 0x202B;
+const UChar rightToLeftMark = 0x200F;
+const UChar rightToLeftOverride = 0x202E;
+const UChar sesameDot = 0xFE45;
+const UChar softHyphen = 0x00AD;
+const UChar space = 0x0020;
+const UChar tibetanMarkIntersyllabicTsheg = 0x0F0B;
+const UChar tibetanMarkDelimiterTshegBstar = 0x0F0C;
+const UChar32 ugariticWordDivider = 0x1039F;
+const UChar whiteBullet = 0x25E6;
+const UChar whiteCircle = 0x25CB;
+const UChar whiteSesameDot = 0xFE46;
+const UChar whiteUpPointingTriangle = 0x25B3;
+const UChar yenSign = 0x00A5;
+const UChar zeroWidthJoiner = 0x200D;
+const UChar zeroWidthNonJoiner = 0x200C;
+const UChar zeroWidthSpace = 0x200B;
+
+} // namespace Unicode
+} // namespace WTF
+
+using WTF::Unicode::aegeanWordSeparatorLine;
+using WTF::Unicode::aegeanWordSeparatorDot;
+using WTF::Unicode::blackCircle;
+using WTF::Unicode::blackSquare;
+using WTF::Unicode::blackUpPointingTriangle;
+using WTF::Unicode::bullet;
+using WTF::Unicode::bullseye;
+using WTF::Unicode::carriageReturn;
+using WTF::Unicode::ethiopicPrefaceColon;
+using WTF::Unicode::ethiopicWordspace;
+using WTF::Unicode::fisheye;
+using WTF::Unicode::hebrewPunctuationGeresh;
+using WTF::Unicode::hebrewPunctuationGershayim;
+using WTF::Unicode::horizontalEllipsis;
+using WTF::Unicode::hyphen;
+using WTF::Unicode::hyphenMinus;
+using WTF::Unicode::ideographicComma;
+using WTF::Unicode::ideographicFullStop;
+using WTF::Unicode::ideographicSpace;
+using WTF::Unicode::leftDoubleQuotationMark;
+using WTF::Unicode::leftSingleQuotationMark;
+using WTF::Unicode::leftToRightEmbed;
+using WTF::Unicode::leftToRightMark;
+using WTF::Unicode::leftToRightOverride;
+using WTF::Unicode::minusSign;
+using WTF::Unicode::newlineCharacter;
+using WTF::Unicode::noBreakSpace;
+using WTF::Unicode::objectReplacementCharacter;
+using WTF::Unicode::popDirectionalFormatting;
+using WTF::Unicode::replacementCharacter;
+using WTF::Unicode::rightDoubleQuotationMark;
+using WTF::Unicode::rightSingleQuotationMark;
+using WTF::Unicode::rightToLeftEmbed;
+using WTF::Unicode::rightToLeftMark;
+using WTF::Unicode::rightToLeftOverride;
+using WTF::Unicode::sesameDot;
+using WTF::Unicode::softHyphen;
+using WTF::Unicode::space;
+using WTF::Unicode::tibetanMarkIntersyllabicTsheg;
+using WTF::Unicode::tibetanMarkDelimiterTshegBstar;
+using WTF::Unicode::ugariticWordDivider;
+using WTF::Unicode::whiteBullet;
+using WTF::Unicode::whiteCircle;
+using WTF::Unicode::whiteSesameDot;
+using WTF::Unicode::whiteUpPointingTriangle;
+using WTF::Unicode::yenSign;
+using WTF::Unicode::zeroWidthJoiner;
+using WTF::Unicode::zeroWidthNonJoiner;
+using WTF::Unicode::zeroWidthSpace;
+
+#endif // CharacterNames_h
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
index dc24ed5..4c3738b 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.cpp
@@ -26,16 +26,14 @@
 
 #include "config.h"
 #include "UTF8.h"
-#include <wtf/StringHasher.h>
 
 #include "ASCIICType.h"
+#include <wtf/StringHasher.h>
+#include <wtf/unicode/CharacterNames.h>
 
 namespace WTF {
 namespace Unicode {
 
-// FIXME: Use definition from CharacterNames.h.
-static const UChar replacementCharacter = 0xFFFD;
-
 inline int inlineUTF8SequenceLengthNonASCII(char b0)
 {
     if ((b0 & 0xC0) != 0xC0)
@@ -316,25 +314,33 @@ ConversionResult convertUTF8ToUTF16(
     return result;
 }
 
-unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length)
+static inline unsigned calculateStringHashAndLengthFromUTF8Internal(const char* data, const char* dataEnd, unsigned& dataLength, unsigned& utf16Length)
 {
     if (!data)
         return 0;
 
     WTF::StringHasher stringHasher;
+    dataLength = 0;
     utf16Length = 0;
 
-    while (data < dataEnd) {
+    while (data < dataEnd || (!dataEnd && *data)) {
         if (isASCII(*data)) {
             stringHasher.addCharacter(*data++);
+            dataLength++;
             utf16Length++;
             continue;
         }
 
         int utf8SequenceLength = inlineUTF8SequenceLengthNonASCII(*data);
+        dataLength += utf8SequenceLength;
 
-        if (dataEnd - data < utf8SequenceLength)
-            return false;
+        if (!dataEnd) {
+            for (int i = 1; i < utf8SequenceLength; ++i) {
+                if (!data[i])
+                    return 0;
+            }
+        } else if (dataEnd - data < utf8SequenceLength)
+            return 0;
 
         if (!isLegalUTF8(reinterpret_cast<const unsigned char*>(data), utf8SequenceLength))
             return 0;
@@ -359,6 +365,17 @@ unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsi
     return stringHasher.hash();
 }
 
+unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length)
+{
+    unsigned dataLength;
+    return calculateStringHashAndLengthFromUTF8Internal(data, dataEnd, dataLength, utf16Length);
+}
+
+unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length)
+{
+    return calculateStringHashAndLengthFromUTF8Internal(data, 0, dataLength, utf16Length);
+}
+
 bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd)
 {
     while (b < bEnd) {
diff --git a/Source/JavaScriptCore/wtf/unicode/UTF8.h b/Source/JavaScriptCore/wtf/unicode/UTF8.h
index 1f4baca..bbfaa84 100644
--- a/Source/JavaScriptCore/wtf/unicode/UTF8.h
+++ b/Source/JavaScriptCore/wtf/unicode/UTF8.h
@@ -71,6 +71,7 @@ namespace Unicode {
                     char** targetStart, char* targetEnd, bool strict = true);
 
     unsigned calculateStringHashFromUTF8(const char* data, const char* dataEnd, unsigned& utf16Length);
+    unsigned calculateStringHashAndLengthFromUTF8(const char* data, unsigned& dataLength, unsigned& utf16Length);
 
     bool equalUTF16WithUTF8(const UChar* a, const UChar* aEnd, const char* b, const char* bEnd);
 
diff --git a/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h b/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h
index 8959912..09a7036 100644
--- a/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h
+++ b/Source/JavaScriptCore/wtf/unicode/UnicodeMacrosFromICU.h
@@ -1,25 +1,5 @@
 /*
  *  Copyright (C) 1999-2004, International Business Machines Corporation and others.  All Rights Reserved.
- *  Copyright (C) 2006 George Staikos <staikos@kde.org>
- *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
- *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
- *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
- *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Library General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Library General Public License for more details.
- *
- *  You should have received a copy of the GNU Library General Public License
- *  along with this library; see the file COPYING.LIB.  If not, write to
- *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301, USA.
  *
  */
 
@@ -97,4 +77,24 @@
 
 #define U_MASK(x) ((uint32_t)1<<(x))
 
+#define U8_MAX_LENGTH 4
+
+#define U8_APPEND_UNSAFE(s, i, c) { \
+    if((uint32_t)(c)<=0x7f) { \
+        (s)[(i)++]=(uint8_t)(c); \
+    } else { \
+        if((uint32_t)(c)<=0x7ff) { \
+            (s)[(i)++]=(uint8_t)(((c)>>6)|0xc0); \
+        } else { \
+            if((uint32_t)(c)<=0xffff) { \
+                (s)[(i)++]=(uint8_t)(((c)>>12)|0xe0); \
+            } else { \
+                (s)[(i)++]=(uint8_t)(((c)>>18)|0xf0); \
+                (s)[(i)++]=(uint8_t)((((c)>>12)&0x3f)|0x80); \
+            } \
+            (s)[(i)++]=(uint8_t)((((c)>>6)&0x3f)|0x80); \
+        } \
+        (s)[(i)++]=(uint8_t)(((c)&0x3f)|0x80); \
+    } \
+}
 #endif
diff --git a/Source/JavaScriptCore/wtf/wince/mt19937ar.c b/Source/JavaScriptCore/wtf/wince/mt19937ar.c
deleted file mode 100644
index 4715958..0000000
--- a/Source/JavaScriptCore/wtf/wince/mt19937ar.c
+++ /dev/null
@@ -1,170 +0,0 @@
-/*
-   A C-program for MT19937, with initialization improved 2002/1/26.
-   Coded by Takuji Nishimura and Makoto Matsumoto.
-
-   Before using, initialize the state by using init_genrand(seed)
-   or init_by_array(init_key, key_length).
-
-   Copyright (C) 1997 - 2002, Makoto Matsumoto and Takuji Nishimura,
-   All rights reserved.
-
-   Redistribution and use in source and binary forms, with or without
-   modification, are permitted provided that the following conditions
-   are met:
-
-     1. Redistributions of source code must retain the above copyright
-        notice, this list of conditions and the following disclaimer.
-
-     2. Redistributions in binary form must reproduce the above copyright
-        notice, this list of conditions and the following disclaimer in the
-        documentation and/or other materials provided with the distribution.
-
-     3. The names of its contributors may not be used to endorse or promote
-        products derived from this software without specific prior written
-        permission.
-
-   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-   A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
-   CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-   EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-   PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-   PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-   LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-   Any feedback is very welcome.
-   http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html
-   email: m-mat @ math.sci.hiroshima-u.ac.jp (remove space)
-*/
-
-#include <stdio.h>
-
-/* Period parameters */
-#define N 624
-#define M 397
-#define MATRIX_A 0x9908b0dfUL   /* constant vector a */
-#define UPPER_MASK 0x80000000UL /* most significant w-r bits */
-#define LOWER_MASK 0x7fffffffUL /* least significant r bits */
-
-static unsigned long mt[N]; /* the array for the state vector  */
-static int mti=N+1; /* mti==N+1 means mt[N] is not initialized */
-
-/* initializes mt[N] with a seed */
-void init_genrand(unsigned long s)
-{
-    mt[0]= s & 0xffffffffUL;
-    for (mti=1; mti<N; mti++) {
-        mt[mti] = (1812433253UL * (mt[mti-1] ^ (mt[mti-1] >> 30)) + mti);
-        /* See Knuth TAOCP Vol2. 3rd Ed. P.106 for multiplier. */
-        /* In the previous versions, MSBs of the seed affect   */
-        /* only MSBs of the array mt[].                        */
-        /* 2002/01/09 modified by Makoto Matsumoto             */
-        mt[mti] &= 0xffffffffUL;
-        /* for >32 bit machines */
-    }
-}
-
-/* initialize by an array with array-length */
-/* init_key is the array for initializing keys */
-/* key_length is its length */
-/* slight change for C++, 2004/2/26 */
-void init_by_array(unsigned long init_key[],int key_length)
-{
-    int i, j, k;
-    init_genrand(19650218UL);
-    i=1; j=0;
-    k = (N>key_length ? N : key_length);
-    for (; k; k--) {
-        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1664525UL))
-          + init_key[j] + j; /* non linear */
-        mt[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */
-        i++; j++;
-        if (i>=N) { mt[0] = mt[N-1]; i=1; }
-        if (j>=key_length) j=0;
-    }
-    for (k=N-1; k; k--) {
-        mt[i] = (mt[i] ^ ((mt[i-1] ^ (mt[i-1] >> 30)) * 1566083941UL))
-          - i; /* non linear */
-        mt[i] &= 0xffffffffUL; /* for WORDSIZE > 32 machines */
-        i++;
-        if (i>=N) { mt[0] = mt[N-1]; i=1; }
-    }
-
-    mt[0] = 0x80000000UL; /* MSB is 1; assuring non-zero initial array */
-}
-
-/* generates a random number on [0,0xffffffff]-interval */
-unsigned long genrand_int32(void)
-{
-    unsigned long y;
-    static unsigned long mag01[2]={0x0UL, MATRIX_A};
-    /* mag01[x] = x * MATRIX_A  for x=0,1 */
-
-    if (mti >= N) { /* generate N words at one time */
-        int kk;
-
-        if (mti == N+1)   /* if init_genrand() has not been called, */
-            init_genrand(5489UL); /* a default initial seed is used */
-
-        for (kk=0;kk<N-M;kk++) {
-            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
-            mt[kk] = mt[kk+M] ^ (y >> 1) ^ mag01[y & 0x1UL];
-        }
-        for (;kk<N-1;kk++) {
-            y = (mt[kk]&UPPER_MASK)|(mt[kk+1]&LOWER_MASK);
-            mt[kk] = mt[kk+(M-N)] ^ (y >> 1) ^ mag01[y & 0x1UL];
-        }
-        y = (mt[N-1]&UPPER_MASK)|(mt[0]&LOWER_MASK);
-        mt[N-1] = mt[M-1] ^ (y >> 1) ^ mag01[y & 0x1UL];
-
-        mti = 0;
-    }
-
-    y = mt[mti++];
-
-    /* Tempering */
-    y ^= (y >> 11);
-    y ^= (y << 7) & 0x9d2c5680UL;
-    y ^= (y << 15) & 0xefc60000UL;
-    y ^= (y >> 18);
-
-    return y;
-}
-
-/* generates a random number on [0,0x7fffffff]-interval */
-long genrand_int31(void)
-{
-    return (long)(genrand_int32()>>1);
-}
-
-/* generates a random number on [0,1]-real-interval */
-double genrand_real1(void)
-{
-    return genrand_int32()*(1.0/4294967295.0);
-    /* divided by 2^32-1 */
-}
-
-/* generates a random number on [0,1)-real-interval */
-double genrand_real2(void)
-{
-    return genrand_int32()*(1.0/4294967296.0);
-    /* divided by 2^32 */
-}
-
-/* generates a random number on (0,1)-real-interval */
-double genrand_real3(void)
-{
-    return (((double)genrand_int32()) + 0.5)*(1.0/4294967296.0);
-    /* divided by 2^32 */
-}
-
-/* generates a random number on [0,1) with 53-bit resolution*/
-double genrand_res53(void)
-{
-    unsigned long a=genrand_int32()>>5, b=genrand_int32()>>6;
-    return(a*67108864.0+b)*(1.0/9007199254740992.0);
-}
diff --git a/Source/JavaScriptCore/wtf/wtf.pri b/Source/JavaScriptCore/wtf/wtf.pri
index 8535ef3..3be3b5f 100644
--- a/Source/JavaScriptCore/wtf/wtf.pri
+++ b/Source/JavaScriptCore/wtf/wtf.pri
@@ -3,6 +3,7 @@
 SOURCES += \
     wtf/Assertions.cpp \
     wtf/ByteArray.cpp \
+    wtf/CryptographicallyRandomNumber.cpp \
     wtf/CurrentTime.cpp \
     wtf/DateMath.cpp \
     wtf/dtoa.cpp \
@@ -14,6 +15,7 @@ SOURCES += \
     wtf/MD5.cpp \
     wtf/MainThread.cpp \
     wtf/NullPtr.cpp \
+    wtf/OSRandomSource.cpp \
     wtf/qt/MainThreadQt.cpp \
     wtf/qt/StringQt.cpp \
     wtf/qt/ThreadingQt.cpp \
@@ -22,6 +24,7 @@ SOURCES += \
     wtf/RandomNumber.cpp \
     wtf/RefCountedLeakCounter.cpp \
     wtf/StackBounds.cpp \
+    wtf/TCSystemAlloc.cpp \
     wtf/ThreadingNone.cpp \
     wtf/Threading.cpp \
     wtf/TypeTraits.cpp \
@@ -42,10 +45,6 @@ contains(DEFINES, USE_GSTREAMER=1) {
     CONFIG += link_pkgconfig
 }
 
-!contains(DEFINES, USE_SYSTEM_MALLOC=1) {
-    SOURCES += wtf/TCSystemAlloc.cpp
-}
-
 unix:!symbian: SOURCES += wtf/OSAllocatorPosix.cpp
 symbian: SOURCES += wtf/OSAllocatorSymbian.cpp
 win*|wince*: SOURCES += wtf/OSAllocatorWin.cpp
diff --git a/Source/JavaScriptCore/wtf/wx/StringWx.cpp b/Source/JavaScriptCore/wtf/wx/StringWx.cpp
index 59d500b..fe0fd89 100644
--- a/Source/JavaScriptCore/wtf/wx/StringWx.cpp
+++ b/Source/JavaScriptCore/wtf/wx/StringWx.cpp
@@ -24,10 +24,10 @@
  */
 
 #include "config.h"
-#include "PlatformString.h"
 
-#include <unicode/ustring.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
 #include <wx/defs.h>
 #include <wx/string.h>
 
@@ -39,7 +39,7 @@ String::String(const wxString& wxstr)
     #error "This code only works in Unicode build of wxWidgets"
 #endif
 
-#if SIZEOF_WCHAR_T == sizeof(UChar)
+#if SIZEOF_WCHAR_T == U_SIZEOF_UCHAR
 
     m_impl = StringImpl::create(wxstr.wc_str(), wxstr.length());
 
@@ -61,8 +61,8 @@ String::String(const wxString& wxstr)
     UChar* data;
     wxMBConvUTF16 conv;
     unsigned utf16Length = conv.FromWChar(0, 0, wideString, wideLength);
-    m_impl = StringImpl::createUninitialized(utf16Length, data)
-    conv.FromWChar(data, utf16Length, wideString, wideLength);
+    m_impl = StringImpl::createUninitialized(utf16Length, data);
+    conv.FromWChar((char*)data, utf16Length, wideString, wideLength);
 
 #endif // SIZEOF_WCHAR_T == 4
 }