Merge WebKit at r78450: Initial merge by git.

Change-Id: I6d3e5f1f868ec266a0aafdef66182ddc3f265dc1

50 files changed, 473 insertions, 345 deletions

diff --git a/Source/WebCore/bindings/v8/DOMDataStore.cpp b/Source/WebCore/bindings/v8/DOMDataStore.cpp
index 5393bd9..21b47a4 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/DOMDataStore.cpp
@@ -173,20 +173,6 @@ void DOMDataStore::weakNodeCallback(v8::Persistent<v8::Value> value, void* domOb
     node->deref(); // Nobody overrides Node::deref so it's safe
 }
 
-bool DOMDataStore::IntrusiveDOMWrapperMap::removeIfPresent(Node* obj, v8::Persistent<v8::Object> value)
-{
-    ASSERT(obj);
-    v8::Persistent<v8::Object>* entry = obj->wrapper();
-    if (!entry)
-        return false;
-    if (*entry != value)
-        return false;
-    obj->clearWrapper();
-    m_table.remove(entry);
-    value.Dispose();
-    return true;
-}
-
 #if ENABLE(SVG)
 
 void DOMDataStore::weakSVGElementInstanceCallback(v8::Persistent<v8::Value> v8Object, void* domObject)
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.h b/Source/WebCore/bindings/v8/DOMDataStore.h
index dbead9c..ffb9df5 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.h
+++ b/Source/WebCore/bindings/v8/DOMDataStore.h
@@ -51,95 +51,6 @@ namespace WebCore {
 
     typedef WTF::Vector<DOMDataStore*> DOMDataList;
 
-    template <class T, int CHUNK_SIZE, class Traits>
-    class ChunkedTable {
-      public:
-        ChunkedTable() : m_chunks(0), m_current(0), m_last(0) { }
-
-        T* add(T element)
-        {
-            if (m_current == m_last) {
-                m_chunks = new Chunk(m_chunks);
-                m_current = m_chunks->m_entries;
-                m_last = m_current + CHUNK_SIZE;
-            }
-            ASSERT((m_chunks->m_entries <= m_current) && (m_current < m_last));
-            T* p = m_current++;
-            *p = element;
-            return p;
-        }
-
-        void remove(T* element)
-        {
-            ASSERT(element);
-            ASSERT(m_current > m_chunks->m_entries);
-            m_current--;
-            if (element != m_current)
-                Traits::move(element, m_current);
-            if (m_current == m_chunks->m_entries) {
-                Chunk* toDelete = m_chunks;
-                m_chunks = toDelete->m_previous;
-                m_current = m_last = m_chunks ? m_chunks->m_entries + CHUNK_SIZE : 0;
-                delete toDelete;
-            }
-            ASSERT(!m_chunks || ((m_chunks->m_entries < m_current) && (m_current <= m_last)));
-        }
-
-        void clear()
-        {
-            if (!m_chunks)
-                return;
-
-            clearEntries(m_chunks->m_entries, m_current);
-            Chunk* last = m_chunks;
-            while (true) {
-                Chunk* previous = last->m_previous;
-                if (!previous)
-                    break;
-                delete last;
-                clearEntries(previous->m_entries, previous->m_entries + CHUNK_SIZE);
-                last = previous;
-            }
-
-            m_chunks = last;
-            m_current = m_chunks->m_entries;
-            m_last = m_current + CHUNK_SIZE;
-        }
-
-        void visit(DOMDataStore* store, typename Traits::Visitor* visitor)
-        {
-            if (!m_chunks)
-                return;
-
-            visitEntries(store, m_chunks->m_entries, m_current, visitor);
-            for (Chunk* chunk = m_chunks->m_previous; chunk; chunk = chunk->m_previous)
-                visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
-        }
-
-      private:
-        struct Chunk {
-            explicit Chunk(Chunk* previous) : m_previous(previous) { }
-            Chunk* const m_previous;
-            T m_entries[CHUNK_SIZE];
-        };
-
-        static void clearEntries(T* first, T* last)
-        {
-            for (T* entry = first; entry < last; entry++)
-                Traits::clear(entry);
-        }
-
-        static void visitEntries(DOMDataStore* store, T* first, T* last, typename Traits::Visitor* visitor)
-        {
-            for (T* entry = first; entry < last; entry++)
-                Traits::visit(store, entry, visitor);
-        }
-
-        Chunk* m_chunks;
-        T* m_current;
-        T* m_last;
-    };
-
     // DOMDataStore
     //
     // DOMDataStore is the backing store that holds the maps between DOM objects
@@ -161,79 +72,6 @@ namespace WebCore {
 #endif
         };
 
-        class IntrusiveDOMWrapperMap : public AbstractWeakReferenceMap<Node, v8::Object> {
-        public:
-            IntrusiveDOMWrapperMap(v8::WeakReferenceCallback callback)
-                : AbstractWeakReferenceMap<Node, v8::Object>(callback) { }
-
-            virtual v8::Persistent<v8::Object> get(Node* obj)
-            {
-                v8::Persistent<v8::Object>* wrapper = obj->wrapper();
-                return wrapper ? *wrapper : v8::Persistent<v8::Object>();
-            }
-
-            virtual void set(Node* obj, v8::Persistent<v8::Object> wrapper)
-            {
-                ASSERT(obj);
-                ASSERT(!obj->wrapper());
-                v8::Persistent<v8::Object>* entry = m_table.add(wrapper);
-                obj->setWrapper(entry);
-                wrapper.MakeWeak(obj, weakReferenceCallback());
-            }
-
-            virtual bool contains(Node* obj)
-            {
-                return obj->wrapper();
-            }
-
-            virtual void visit(DOMDataStore* store, Visitor* visitor)
-            {
-                m_table.visit(store, visitor);
-            }
-
-            virtual bool removeIfPresent(Node*, v8::Persistent<v8::Object>);
-
-            virtual void clear()
-            {
-                m_table.clear();
-            }
-
-        private:
-            static int const numberOfEntries = (1 << 10) - 1;
-
-            struct ChunkedTableTraits {
-                typedef IntrusiveDOMWrapperMap::Visitor Visitor;
-
-                static void move(v8::Persistent<v8::Object>* target, v8::Persistent<v8::Object>* source)
-                {
-                    *target = *source;
-                    Node* node = V8Node::toNative(*target);
-                    ASSERT(node);
-                    node->setWrapper(target);
-                }
-
-                static void clear(v8::Persistent<v8::Object>* entry)
-                {
-                    Node* node = V8Node::toNative(*entry);
-                    ASSERT(node->wrapper() == entry);
-
-                    node->clearWrapper();
-                    entry->Dispose();
-                }
-
-                static void visit(DOMDataStore* store, v8::Persistent<v8::Object>* entry, Visitor* visitor)
-                {
-                    Node* node = V8Node::toNative(*entry);
-                    ASSERT(node->wrapper() == entry);
-
-                    visitor->visitDOMWrapper(store, node, *entry);
-                }
-            };
-
-            typedef ChunkedTable<v8::Persistent<v8::Object>, numberOfEntries, ChunkedTableTraits> Table;
-            Table m_table;
-        };
-
         DOMDataStore(DOMData*);
         virtual ~DOMDataStore();
 
diff --git a/Source/WebCore/bindings/v8/DebuggerScript.js b/Source/WebCore/bindings/v8/DebuggerScript.js
index eb9de2f..1798352 100644
--- a/Source/WebCore/bindings/v8/DebuggerScript.js
+++ b/Source/WebCore/bindings/v8/DebuggerScript.js
@@ -91,15 +91,15 @@ DebuggerScript._formatScript = function(script)
 
 DebuggerScript.setBreakpoint = function(execState, args)
 {
-    args.lineNumber = DebuggerScript._webkitToV8LineNumber(args.lineNumber);
-    var breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, 0 /* column */, args.condition);
+    var breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, args.columnNumber, args.condition);
     if (!args.enabled)
         Debug.disableScriptBreakPoint(breakId);
 
     var locations = Debug.findBreakPointActualLocations(breakId);
     if (!locations.length)
         return undefined;
-    args.lineNumber = DebuggerScript._v8ToWebkitLineNumber(locations[0].line);
+    args.lineNumber = locations[0].line;
+    args.columnNumber = locations[0].column;
     return breakId.toString();
 }
 
@@ -263,11 +263,6 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
     };
 }
 
-DebuggerScript._webkitToV8LineNumber = function(line)
-{
-    return line - 1;
-};
-
 DebuggerScript._v8ToWebkitLineNumber = function(line)
 {
     return line + 1;
diff --git a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
new file mode 100644
index 0000000..5c066f0
--- /dev/null
+++ b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
@@ -0,0 +1,217 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IntrusiveDOMWrapperMap_h
+#define IntrusiveDOMWrapperMap_h
+
+#include "DOMDataStore.h"
+#include "V8Node.h"
+
+namespace WebCore {
+
+template <class T, int CHUNK_SIZE, class Traits>
+class ChunkedTable {
+  public:
+    ChunkedTable() : m_chunks(0), m_current(0), m_last(0) { }
+
+    T* add(T element)
+    {
+        if (m_current == m_last) {
+            m_chunks = new Chunk(m_chunks);
+            m_current = m_chunks->m_entries;
+            m_last = m_current + CHUNK_SIZE;
+        }
+        ASSERT((m_chunks->m_entries <= m_current) && (m_current < m_last));
+        T* p = m_current++;
+        *p = element;
+        return p;
+    }
+
+    void remove(T* element)
+    {
+        ASSERT(element);
+        ASSERT(m_current > m_chunks->m_entries);
+        m_current--;
+        if (element != m_current)
+            Traits::move(element, m_current);
+        if (m_current == m_chunks->m_entries) {
+            Chunk* toDelete = m_chunks;
+            m_chunks = toDelete->m_previous;
+            m_current = m_last = m_chunks ? m_chunks->m_entries + CHUNK_SIZE : 0;
+            delete toDelete;
+        }
+        ASSERT(!m_chunks || ((m_chunks->m_entries < m_current) && (m_current <= m_last)));
+    }
+
+    void clear()
+    {
+        if (!m_chunks)
+            return;
+
+        clearEntries(m_chunks->m_entries, m_current);
+        Chunk* last = m_chunks;
+        while (true) {
+            Chunk* previous = last->m_previous;
+            if (!previous)
+                break;
+            delete last;
+            clearEntries(previous->m_entries, previous->m_entries + CHUNK_SIZE);
+            last = previous;
+        }
+
+        m_chunks = last;
+        m_current = m_chunks->m_entries;
+        m_last = m_current + CHUNK_SIZE;
+    }
+
+    void visit(DOMDataStore* store, typename Traits::Visitor* visitor)
+    {
+        if (!m_chunks)
+            return;
+
+        visitEntries(store, m_chunks->m_entries, m_current, visitor);
+        for (Chunk* chunk = m_chunks->m_previous; chunk; chunk = chunk->m_previous)
+            visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
+    }
+
+  private:
+    struct Chunk {
+        explicit Chunk(Chunk* previous) : m_previous(previous) { }
+        Chunk* const m_previous;
+        T m_entries[CHUNK_SIZE];
+    };
+
+    static void clearEntries(T* first, T* last)
+    {
+        for (T* entry = first; entry < last; entry++)
+            Traits::clear(entry);
+    }
+
+    static void visitEntries(DOMDataStore* store, T* first, T* last, typename Traits::Visitor* visitor)
+    {
+        for (T* entry = first; entry < last; entry++)
+            Traits::visit(store, entry, visitor);
+    }
+
+    Chunk* m_chunks;
+    T* m_current;
+    T* m_last;
+};
+
+
+class IntrusiveDOMWrapperMap : public AbstractWeakReferenceMap<Node, v8::Object> {
+public:
+    IntrusiveDOMWrapperMap(v8::WeakReferenceCallback callback)
+        : AbstractWeakReferenceMap<Node, v8::Object>(callback) { }
+
+    virtual v8::Persistent<v8::Object> get(Node* obj)
+    {
+        v8::Persistent<v8::Object>* wrapper = obj->wrapper();
+        return wrapper ? *wrapper : v8::Persistent<v8::Object>();
+    }
+
+    virtual void set(Node* obj, v8::Persistent<v8::Object> wrapper)
+    {
+        ASSERT(obj);
+        ASSERT(!obj->wrapper());
+        v8::Persistent<v8::Object>* entry = m_table.add(wrapper);
+        obj->setWrapper(entry);
+        wrapper.MakeWeak(obj, weakReferenceCallback());
+    }
+
+    virtual bool contains(Node* obj)
+    {
+        return obj->wrapper();
+    }
+
+    virtual void visit(DOMDataStore* store, Visitor* visitor)
+    {
+        m_table.visit(store, visitor);
+    }
+
+    virtual bool removeIfPresent(Node* obj, v8::Persistent<v8::Object> value)
+    {
+        ASSERT(obj);
+        v8::Persistent<v8::Object>* entry = obj->wrapper();
+        if (!entry)
+            return false;
+        if (*entry != value)
+            return false;
+        obj->clearWrapper();
+        m_table.remove(entry);
+        value.Dispose();
+        return true;
+    }
+
+
+    virtual void clear()
+    {
+        m_table.clear();
+    }
+
+private:
+    static int const numberOfEntries = (1 << 10) - 1;
+
+    struct ChunkedTableTraits {
+        typedef IntrusiveDOMWrapperMap::Visitor Visitor;
+
+        static void move(v8::Persistent<v8::Object>* target, v8::Persistent<v8::Object>* source)
+        {
+            *target = *source;
+            Node* node = V8Node::toNative(*target);
+            ASSERT(node);
+            node->setWrapper(target);
+        }
+
+        static void clear(v8::Persistent<v8::Object>* entry)
+        {
+            Node* node = V8Node::toNative(*entry);
+            ASSERT(node->wrapper() == entry);
+
+            node->clearWrapper();
+            entry->Dispose();
+        }
+
+        static void visit(DOMDataStore* store, v8::Persistent<v8::Object>* entry, Visitor* visitor)
+        {
+            Node* node = V8Node::toNative(*entry);
+            ASSERT(node->wrapper() == entry);
+
+            visitor->visitDOMWrapper(store, node, *entry);
+        }
+    };
+
+    typedef ChunkedTable<v8::Persistent<v8::Object>, numberOfEntries, ChunkedTableTraits> Table;
+    Table m_table;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index e4be0d8..0ecb3c7 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -78,14 +78,14 @@ static void freeV8NPObject(NPObject* npObject)
     free(v8NpObject);
 }
 
-static v8::Handle<v8::Value>* createValueListFromVariantArgs(const NPVariant* arguments, uint32_t argumentCount, NPObject* owner)
+static PassOwnArrayPtr<v8::Handle<v8::Value> > createValueListFromVariantArgs(const NPVariant* arguments, uint32_t argumentCount, NPObject* owner)
 {
-    v8::Handle<v8::Value>* argv = new v8::Handle<v8::Value>[argumentCount];
+    OwnArrayPtr<v8::Handle<v8::Value> > argv = adoptArrayPtr(new v8::Handle<v8::Value>[argumentCount]);
     for (uint32_t index = 0; index < argumentCount; index++) {
         const NPVariant* arg = &arguments[index];
         argv[index] = convertNPVariantToV8Object(arg, owner);
     }
-    return argv;
+    return argv.release();
 }
 
 // Create an identifier (null terminated utf8 char*) from the NPIdentifier.
@@ -188,7 +188,7 @@ bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPV
 
     // Call the function object.
     v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(functionObject);
-    OwnArrayPtr<v8::Handle<v8::Value> > argv(createValueListFromVariantArgs(arguments, argumentCount, npObject));
+    OwnArrayPtr<v8::Handle<v8::Value> > argv = createValueListFromVariantArgs(arguments, argumentCount, npObject);
     v8::Local<v8::Value> resultObject = proxy->callFunction(function, v8NpObject->v8Object, argumentCount, argv.get());
 
     // If we had an error, return false.  The spec is a little unclear here, but says "Returns true if the method was
@@ -237,7 +237,7 @@ bool _NPN_InvokeDefault(NPP npp, NPObject* npObject, const NPVariant* arguments,
         V8Proxy* proxy = toV8Proxy(npObject);
         ASSERT(proxy);
 
-        OwnArrayPtr<v8::Handle<v8::Value> > argv(createValueListFromVariantArgs(arguments, argumentCount, npObject));
+        OwnArrayPtr<v8::Handle<v8::Value> > argv = createValueListFromVariantArgs(arguments, argumentCount, npObject);
         resultObject = proxy->callFunction(function, functionObject, argumentCount, argv.get());
     }
     // If we had an error, return false.  The spec is a little unclear here, but says "Returns true if the method was
@@ -537,7 +537,7 @@ bool _NPN_Construct(NPP npp, NPObject* npObject, const NPVariant* arguments, uin
             V8Proxy* proxy = toV8Proxy(npObject);
             ASSERT(proxy);
 
-            OwnArrayPtr<v8::Handle<v8::Value> > argv(createValueListFromVariantArgs(arguments, argumentCount, npObject));
+            OwnArrayPtr<v8::Handle<v8::Value> > argv = createValueListFromVariantArgs(arguments, argumentCount, npObject);
             resultObject = proxy->newInstance(ctor, argumentCount, argv.get());
         }
 
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index fcbf40d..55f127b 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -61,7 +61,6 @@
 #include "V8NPObject.h"
 #include "V8Proxy.h"
 #include "Widget.h"
-#include "XSSAuditor.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
 
@@ -117,7 +116,6 @@ ScriptController::ScriptController(Frame* frame)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
 #endif
-    , m_XSSAuditor(new XSSAuditor(frame))
 {
 }
 
@@ -219,17 +217,12 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
 }
 
 // Evaluate a script file in the environment of this proxy.
-ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS)
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 {
     String sourceURL = sourceCode.url();
     const String* savedSourceURL = m_sourceURL;
     m_sourceURL = &sourceURL;
 
-    if (shouldAllowXSS == DoNotAllowXSS && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
-        // This script is not safe to be evaluated.
-        return ScriptValue();
-    }
-
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_proxy->frame());
     if (v8Context.IsEmpty())
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index 7664846..b20e7fd 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -61,7 +61,6 @@ class Frame;
 class HTMLPlugInElement;
 class ScriptSourceCode;
 class Widget;
-class XSSAuditor;
 
 class ScriptController {
 public:
@@ -72,8 +71,8 @@ public:
     // or this accessor should be made JSProxy*
     V8Proxy* proxy() { return m_proxy.get(); }
 
-    ScriptValue executeScript(const ScriptSourceCode&, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
-    ScriptValue executeScript(const String& script, bool forceUserGesture = false, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
+    ScriptValue executeScript(const ScriptSourceCode&);
+    ScriptValue executeScript(const String& script, bool forceUserGesture = false);
 
     // Returns true if argument is a JavaScript URL.
     bool executeIfJavaScriptURL(const KURL&, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
@@ -84,7 +83,7 @@ public:
     // Evaluate a script file in the environment of this proxy.
     // If succeeded, 'succ' is set to true and result is returned
     // as a string.
-    ScriptValue evaluate(const ScriptSourceCode&, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
+    ScriptValue evaluate(const ScriptSourceCode&);
 
     void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
@@ -106,8 +105,6 @@ public:
     ScriptController* windowShell(DOMWrapperWorld*) { return this; }
     ScriptController* existingWindowShell(DOMWrapperWorld*) { return this; }
 
-    XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
-
     void collectGarbage();
 
     // Notify V8 that the system is running low on memory.
@@ -215,8 +212,6 @@ private:
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* m_windowScriptNPObject;
 #endif
-    // The XSSAuditor associated with this ScriptController.
-    OwnPtr<XSSAuditor> m_XSSAuditor;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index 1c70a0e..cc7fba8 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -143,7 +143,7 @@ void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page
     // FIXME: Remove all breakpoints set by the agent.
 }
 
-String ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, unsigned* actualLineNumber)
+String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     v8::HandleScope scope;
     v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
@@ -151,15 +151,17 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNum
 
     v8::Local<v8::Object> args = v8::Object::New();
     args->Set(v8::String::New("scriptId"), v8String(sourceID));
-    args->Set(v8::String::New("lineNumber"), v8::Integer::New(lineNumber));
-    args->Set(v8::String::New("condition"), v8String(condition));
-    args->Set(v8::String::New("enabled"), v8::Boolean::New(enabled));
+    args->Set(v8::String::New("lineNumber"), v8::Integer::New(scriptBreakpoint.lineNumber));
+    args->Set(v8::String::New("columnNumber"), v8::Integer::New(scriptBreakpoint.columnNumber));
+    args->Set(v8::String::New("condition"), v8String(scriptBreakpoint.condition));
+    args->Set(v8::String::New("enabled"), v8::Boolean::New(scriptBreakpoint.enabled));
 
     v8::Handle<v8::Function> setBreakpointFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("setBreakpoint")));
     v8::Handle<v8::Value> breakpointId = v8::Debug::Call(setBreakpointFunction, args);
     if (!breakpointId->IsString())
         return "";
     *actualLineNumber = args->Get(v8::String::New("lineNumber"))->Int32Value();
+    *actualColumnNumber = args->Get(v8::String::New("columnNumber"))->Int32Value();
     return v8StringToWebCoreString(breakpointId->ToString());
 }
 
@@ -340,11 +342,6 @@ void ScriptDebugServer::setEnabled(bool value)
      m_enabled = value;
 }
 
-bool ScriptDebugServer::isDebuggerAlwaysEnabled()
-{
-    return m_enabled;
-}
-
 void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task)
 {
     v8::Debug::DebugBreakForCommand(new ClientDataImpl(task));
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index 8fa723f..af3d2ab 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -56,7 +56,7 @@ public:
     void addListener(ScriptDebugListener*, Page*);
     void removeListener(ScriptDebugListener*, Page*);
 
-    String setBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition, bool enabled, unsigned* actualLineNumber);
+    String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
     void setBreakpointsActivated(bool activated);
@@ -99,7 +99,6 @@ public:
     PassRefPtr<JavaScriptCallFrame> currentCallFrame();
 
     void setEnabled(bool);
-    bool isDebuggerAlwaysEnabled();
 
     class Task {
     public:
diff --git a/Source/WebCore/bindings/v8/ScriptEventListener.cpp b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
index b46fc5a..0d758d9 100644
--- a/Source/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -39,7 +39,6 @@
 #include "DocumentParser.h"
 #include "V8AbstractEventListener.h"
 #include "V8Binding.h"
-#include "XSSAuditor.h"
 
 namespace WebCore {
 
@@ -59,11 +58,6 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
 
-        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-            // This script is not safe to execute.
-            return 0;
-        }
-
         position = scriptController->eventHandlerPosition();
         sourceURL = node->document()->url().string();
     }
@@ -84,11 +78,6 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!scriptController->canExecuteScripts(AboutToExecuteScript))
         return 0;
 
-    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
-    }
-
     TextPosition0 position = scriptController->eventHandlerPosition();
     String sourceURL = frame->document()->url().string();
     return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, position, WorldContextHandle(UseMainWorld));
diff --git a/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp b/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 3ea536e..aec742c 100644
--- a/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/Source/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -126,7 +126,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
     ASSERT(value->IsFunction());
 
     v8::Local<v8::Function> function(v8::Function::Cast(*value));
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[m_arguments.size()]);
     for (size_t i = 0; i < m_arguments.size(); ++i)
         args[i] = m_arguments[i].v8Value();
 
@@ -159,7 +159,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
     ASSERT(value->IsFunction());
 
     v8::Local<v8::Function> constructor(v8::Function::Cast(*value));
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[m_arguments.size()]);
     for (size_t i = 0; i < m_arguments.size(); ++i)
         args[i] = m_arguments[i].v8Value();
 
@@ -193,7 +193,7 @@ ScriptValue ScriptCallback::call(bool& hadException)
     v8::Handle<v8::Object> object = v8::Context::GetCurrent()->Global();
     v8::Handle<v8::Function> function = v8::Handle<v8::Function>::Cast(m_function.v8Value());
 
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[m_arguments.size()]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[m_arguments.size()]);
     for (size_t i = 0; i < m_arguments.size(); ++i)
         args[i] = m_arguments[i].v8Value();
 
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
index a58a0cd..55a803f 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
@@ -66,12 +66,13 @@ void ScriptGCEvent::removeEventListener(ScriptGCEventListener* eventListener)
     }
 }
 
-void ScriptGCEvent::getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize)
+void ScriptGCEvent::getHeapSize(size_t& usedHeapSize, size_t& totalHeapSize, size_t& heapSizeLimit)
 {
     v8::HeapStatistics heapStatistics;
     v8::V8::GetHeapStatistics(&heapStatistics);
     usedHeapSize = heapStatistics.used_heap_size();
     totalHeapSize = heapStatistics.total_heap_size();
+    heapSizeLimit = heapStatistics.heap_size_limit();
 }
 
 size_t ScriptGCEvent::getUsedHeapSize()
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.h b/Source/WebCore/bindings/v8/ScriptGCEvent.h
index 80a5a38..2ffd940 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.h
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.h
@@ -45,7 +45,7 @@ class ScriptGCEvent
 public:
     static void addEventListener(ScriptGCEventListener*);
     static void removeEventListener(ScriptGCEventListener*);
-    static void getHeapSize(size_t&, size_t&);
+    static void getHeapSize(size_t&, size_t&, size_t&);
 private:
     typedef Vector<ScriptGCEventListener*> GCEventListeners;
     static GCEventListeners s_eventListeners;
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 02dea14..615dcfc 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -53,16 +53,41 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
-PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& title)
+namespace {
+
+class ActivityControlAdapter : public v8::ActivityControl {
+public:
+    ActivityControlAdapter(ScriptProfiler::HeapSnapshotProgress* progress)
+            : m_progress(progress), m_firstReport(true) { }
+    ControlOption ReportProgressValue(int done, int total)
+    {
+        ControlOption result = m_progress->isCanceled() ? kAbort : kContinue;
+        if (m_firstReport) {
+            m_firstReport = false;
+            m_progress->Start(total);
+        } else
+            m_progress->Worked(done);
+        if (done >= total)
+            m_progress->Done();
+        return result;
+    }
+private:
+    ScriptProfiler::HeapSnapshotProgress* m_progress;
+    bool m_firstReport;
+};
+
+} // namespace
+
+PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& title, HeapSnapshotProgress* control)
 {
     v8::HandleScope hs;
-    const v8::HeapSnapshot* snapshot = v8::HeapProfiler::TakeSnapshot(v8String(title), v8::HeapSnapshot::kAggregated);
+    const v8::HeapSnapshot* snapshot = 0;
+    if (control) {
+        ActivityControlAdapter adapter(control);
+        snapshot = v8::HeapProfiler::TakeSnapshot(v8String(title), v8::HeapSnapshot::kFull, &adapter);
+    } else
+        snapshot = v8::HeapProfiler::TakeSnapshot(v8String(title), v8::HeapSnapshot::kAggregated);
     return snapshot ? ScriptHeapSnapshot::create(snapshot) : 0;
 }
 
-bool ScriptProfiler::isProfilerAlwaysEnabled()
-{
-    return true;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index e0969e1..9016668 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -44,10 +44,18 @@ class InspectorObject;
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
 public:
+    class HeapSnapshotProgress {
+    public:
+        virtual ~HeapSnapshotProgress() { }
+        virtual void Start(int totalWork) = 0;
+        virtual void Worked(int workDone) = 0;
+        virtual void Done() = 0;
+        virtual bool isCanceled() = 0;
+    };
+
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
-    static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title);
-    static bool isProfilerAlwaysEnabled();
+    static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title, HeapSnapshotProgress*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptSourceCode.h b/Source/WebCore/bindings/v8/ScriptSourceCode.h
index 2478151..d7d1510 100644
--- a/Source/WebCore/bindings/v8/ScriptSourceCode.h
+++ b/Source/WebCore/bindings/v8/ScriptSourceCode.h
@@ -63,7 +63,12 @@ public:
 
     const String& source() const { return m_source; }
     CachedScript* cachedScript() const { return m_cachedScript.get(); }
-    const KURL& url() const { return m_url; }
+    const KURL& url() const
+    {
+        if (m_cachedScript)
+            return m_cachedScript->response().url();
+        return m_url;
+    }
     int startLine() const { return m_startPosition.m_line.oneBasedInt(); }
     const TextPosition1& startPosition() const { return m_startPosition; }
 
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 666e619..1c5e4e7 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -1118,12 +1118,15 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(v8::Handle<v8::V
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::createFromWire(String data)
 {
-    return adoptRef(new SerializedScriptValue(data, WireData));
+    return adoptRef(new SerializedScriptValue(data));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(String data)
 {
-    return adoptRef(new SerializedScriptValue(data, StringValue));
+    Writer writer;
+    writer.writeWebCoreString(data);
+    String wireData = StringImpl::adopt(writer.data());
+    return adoptRef(new SerializedScriptValue(wireData));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
@@ -1133,19 +1136,31 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
 
 SerializedScriptValue* SerializedScriptValue::nullValue()
 {
-    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, nullValue, (SerializedScriptValue::create()));
+    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, nullValue, (0));
+    if (!nullValue) {
+        Writer writer;
+        writer.writeNull();
+        String wireData = StringImpl::adopt(writer.data());
+        nullValue = adoptRef(new SerializedScriptValue(wireData));
+    }
     return nullValue.get();
 }
 
 SerializedScriptValue* SerializedScriptValue::undefinedValue()
 {
-    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, undefinedValue, (SerializedScriptValue::create(v8::Undefined())));
+    DEFINE_STATIC_LOCAL(RefPtr<SerializedScriptValue>, undefinedValue, (0));
+    if (!undefinedValue) {
+        Writer writer;
+        writer.writeUndefined();
+        String wireData = StringImpl::adopt(writer.data());
+        undefinedValue = adoptRef(new SerializedScriptValue(wireData));
+    }
     return undefinedValue.get();
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::release()
 {
-    RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data, WireData));
+    RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data));
     m_data = String().crossThreadString();
     return result.release();
 }
@@ -1167,16 +1182,9 @@ SerializedScriptValue::SerializedScriptValue(v8::Handle<v8::Value> value, bool&
     m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
 }
 
-SerializedScriptValue::SerializedScriptValue(String data, StringDataMode mode)
+SerializedScriptValue::SerializedScriptValue(String wireData)
 {
-    if (mode == WireData)
-        m_data = data.crossThreadString();
-    else {
-        ASSERT(mode == StringValue);
-        Writer writer;
-        writer.writeWebCoreString(data);
-        m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
-    }
+    m_data = wireData.crossThreadString();
 }
 
 v8::Handle<v8::Value> SerializedScriptValue::deserialize()
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index ead9511..d0d8575 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -72,7 +72,7 @@ private:
 
     SerializedScriptValue();
     SerializedScriptValue(v8::Handle<v8::Value>, bool& didThrow);
-    SerializedScriptValue(String data, StringDataMode mode);
+    explicit SerializedScriptValue(String wireData);
 
     String m_data;
 };
diff --git a/Source/WebCore/bindings/v8/StaticDOMDataStore.h b/Source/WebCore/bindings/v8/StaticDOMDataStore.h
index fb6aa42..940646e 100644
--- a/Source/WebCore/bindings/v8/StaticDOMDataStore.h
+++ b/Source/WebCore/bindings/v8/StaticDOMDataStore.h
@@ -32,6 +32,7 @@
 #define StaticDOMDataStore_h
 
 #include "DOMDataStore.h"
+#include "IntrusiveDOMWrapperMap.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 52b23bd..2acd29a 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8Binding.h"
 
+#include "DOMStringList.h"
 #include "Element.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
@@ -412,6 +413,13 @@ String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
         throwError(block.Exception());
         return StringImpl::empty();
     }
+    // This path is unexpected.  However there is hypothesis that it
+    // might be combination of v8 and v8 bindings bugs.  For now
+    // just bailout as we'll crash if attempt to convert empty handle into a string.
+    if (v8String.IsEmpty()) {
+        ASSERT_NOT_REACHED();
+        return StringImpl::empty();
+    }
     return v8StringToWebCoreString<String>(v8String, DoNotExternalize);
 }
 
@@ -578,4 +586,19 @@ void setElementStringAttr(const v8::AccessorInfo& info,
     imp->setAttribute(name, v);
 }
 
+PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value> value)
+{
+    v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
+    if (!v8Value->IsArray())
+        return 0;
+
+    RefPtr<DOMStringList> ret = DOMStringList::create();
+    v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
+    for (size_t i = 0; i < v8Array->Length(); ++i) {
+        v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
+        ret->append(v8ValueToWebCoreString(indexedValue));
+    }
+    return ret.release();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index b2d5daa..7873b54 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -41,6 +41,7 @@
 
 namespace WebCore {
 
+    class DOMStringList;
     class EventListener;
     class EventTarget;
 
@@ -206,6 +207,8 @@ namespace WebCore {
 
     String int32ToWebCoreString(int value);
 
+    PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value>);
+
     class V8ParameterBase {
     public:
         operator String() { return toString<String>(); }
@@ -233,6 +236,14 @@ namespace WebCore {
                 return false;
             }
 
+            // This path is unexpected.  However there is hypothesis that it
+            // might be combination of v8 and v8 bindings bugs.  For now
+            // just bailout as we'll crash if attempt to convert empty handle into a string.
+            if (m_v8Object.IsEmpty()) {
+                ASSERT_NOT_REACHED();
+                return false;
+            }
+
             return true;
         }
 
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index f53e1b7..d88d8a6 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -39,6 +39,7 @@
 #include "FrameLoaderClient.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
 #include "ScriptController.h"
@@ -62,6 +63,11 @@
 #include <utility>
 #include <v8-debug.h>
 #include <v8.h>
+
+#if ENABLE(JAVASCRIPT_I18N_API)
+#include <v8/src/extensions/experimental/i18n-extension.h>
+#endif
+
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/StdLibExtras.h>
@@ -368,9 +374,15 @@ v8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Ob
     if (!V8Proxy::registeredExtensionWithV8(DateExtension::get()))
         V8Proxy::registerExtension(DateExtension::get());
 
+#if ENABLE(JAVASCRIPT_I18N_API)
+    // Enables experimental i18n API in V8.
+    if (RuntimeEnabledFeatures::javaScriptI18NAPIEnabled() && !V8Proxy::registeredExtensionWithV8(v8::internal::I18NExtension::get()))
+        V8Proxy::registerExtension(v8::internal::I18NExtension::get());
+#endif
+
     // Dynamically tell v8 about our extensions now.
     const V8Extensions& extensions = V8Proxy::extensions();
-    OwnArrayPtr<const char*> extensionNames(new const char*[extensions.size()]);
+    OwnArrayPtr<const char*> extensionNames = adoptArrayPtr(new const char*[extensions.size()]);
     int index = 0;
     for (size_t i = 0; i < extensions.size(); ++i) {
         // Ensure our date extension is always allowed.
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index b51c5a5..b439274 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -51,6 +51,7 @@
 #include "V8FileWriter.h"
 #include "V8HTMLCollection.h"
 #include "V8HTMLDocument.h"
+#include "V8IDBDatabase.h"
 #include "V8IDBRequest.h"
 #include "V8IDBTransaction.h"
 #include "V8IsolatedContext.h"
@@ -381,6 +382,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
+    if (IDBDatabase* idbDatabase = target->toIDBDatabase())
+        return toV8(idbDatabase);
     if (IDBRequest* idbRequest = target->toIDBRequest())
         return toV8(idbRequest);
     if (IDBTransaction* idbTransaction = target->toIDBTransaction())
diff --git a/Source/WebCore/bindings/v8/V8EventListener.cpp b/Source/WebCore/bindings/v8/V8EventListener.cpp
index 808d342..319da42 100644
--- a/Source/WebCore/bindings/v8/V8EventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8EventListener.cpp
@@ -54,7 +54,9 @@ v8::Local<v8::Function> V8EventListener::getListenerFunction(ScriptExecutionCont
 
     if (listener->IsObject()) {
         v8::Local<v8::Value> property = listener->Get(v8::String::NewSymbol("handleEvent"));
-        if (property->IsFunction())
+        // Check that no exceptions were thrown when getting the
+        // handleEvent property and that the value is a function.
+        if (!property.IsEmpty() && property->IsFunction())
             return v8::Local<v8::Function>::Cast(property);
     }
 
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index 0b1d25e..36640b7 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -101,7 +101,7 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
 
     // Wrap up parameters.
     int numArgs = args.Length();
-    OwnArrayPtr<NPVariant> npArgs(new NPVariant[numArgs]);
+    OwnArrayPtr<NPVariant> npArgs = adoptArrayPtr(new NPVariant[numArgs]);
 
     for (int i = 0; i < numArgs; i++)
         convertV8ObjectToNPVariant(args[i], npObject, &npArgs[i]);
diff --git a/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp b/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp
index 4e0240d..a8ca878 100644
--- a/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp
+++ b/Source/WebCore/bindings/v8/V8NodeFilterCondition.cpp
@@ -80,7 +80,7 @@ short V8NodeFilterCondition::acceptNode(ScriptState* state, Node* node) const
     }
 
     v8::Handle<v8::Object> object = v8::Context::GetCurrent()->Global();
-    OwnArrayPtr<v8::Handle<v8::Value> > args(new v8::Handle<v8::Value>[1]);
+    OwnArrayPtr<v8::Handle<v8::Value> > args = adoptArrayPtr(new v8::Handle<v8::Value>[1]);
     args[0] = toV8(node);
 
     v8::Handle<v8::Value> result = V8Proxy::callFunctionWithoutFrame(callback, object, 1, args.get());
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index 831a6ef..ca57fa8 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -161,10 +161,15 @@ void V8Proxy::reportUnsafeAccessTo(Frame* target)
         return;
 
     Frame* source = V8Proxy::retrieveFrameForEnteredContext();
-    if (!source || !source->document())
-        return; // Ignore error if the source document is gone.
+    if (!source)
+        return;
+    Page* page = source->page();
+    if (!page)
+        return;
 
     Document* sourceDocument = source->document();
+    if (!sourceDocument)
+        return; // Ignore error if the source document is gone.
 
     // FIXME: This error message should contain more specifics of why the same
     // origin check has failed.
@@ -178,7 +183,7 @@ void V8Proxy::reportUnsafeAccessTo(Frame* target)
     // NOTE: Safari prints the message in the target page, but it seems like
     // it should be in the source page. Even for delayed messages, we put it in
     // the source page.
-    addMessageToConsole(source->page(), str, kSourceID, kLineNumber);
+    addMessageToConsole(page, str, kSourceID, kLineNumber);
 }
 
 static void handleFatalErrorInV8()
@@ -430,6 +435,8 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
 
     // Run the script and keep track of the current recursion depth.
     v8::Local<v8::Value> result;
+    v8::TryCatch tryCatch;
+    tryCatch.SetVerbose(true);
     {
         // See comment in V8Proxy::callFunction.
         m_frame->keepAlive();
@@ -446,6 +453,11 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
         ASSERT(result.IsEmpty());
 
     // Handle V8 internal error situation (Out-of-memory).
+    if (tryCatch.HasCaught()) {
+        ASSERT(result.IsEmpty());
+        return notHandledByInterceptor();
+    }
+
     if (result.IsEmpty())
         return notHandledByInterceptor();
 
diff --git a/Source/WebCore/bindings/v8/V8Proxy.h b/Source/WebCore/bindings/v8/V8Proxy.h
index 746d8f8..fc52b19 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.h
+++ b/Source/WebCore/bindings/v8/V8Proxy.h
@@ -116,7 +116,7 @@ namespace WebCore {
                                  const BatchedCallback*, 
                                  size_t callbackCount);
 
-    const int kMaxRecursionDepth = 20;
+    const int kMaxRecursionDepth = 22;
 
     // The list of extensions that are registered for use with V8.
     typedef WTF::Vector<v8::Extension*> V8Extensions;
diff --git a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
index 4203ad5..e33a183 100644
--- a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
@@ -54,8 +54,10 @@ v8::Local<v8::Value> V8WindowErrorHandler::callListenerFunction(ScriptExecutionC
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
         v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        v8::TryCatch tryCatch;
+        tryCatch.SetVerbose(true);
         returnValue = callFunction->Call(thisValue, 3, parameters);
-        if (!returnValue.IsEmpty() && returnValue->IsBoolean() && !returnValue->BooleanValue())
+        if (!tryCatch.HasCaught() && !returnValue.IsEmpty() && returnValue->IsBoolean() && !returnValue->BooleanValue())
             event->preventDefault();
     }
     return returnValue;
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index aef892a..eb7252b 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -49,6 +49,7 @@
 #include "WorkerContext.h"
 #include "WorkerScriptController.h"
 #include "WrapperTypeInfo.h"
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -205,10 +206,14 @@ ScriptValue WorkerContextExecutionProxy::evaluate(const String& script, const St
     if (exceptionCatcher.HasCaught()) {
         v8::Local<v8::Message> message = exceptionCatcher.Message();
         state->hadException = true;
-        state->exception = ScriptValue(exceptionCatcher.Exception());
         state->errorMessage = toWebCoreString(message->Get());
         state->lineNumber = message->GetLineNumber();
         state->sourceURL = toWebCoreString(message->GetScriptResourceName());
+        if (m_workerContext->sanitizeScriptError(state->errorMessage, state->lineNumber, state->sourceURL))
+            state->exception = V8Proxy::throwError(V8Proxy::GeneralError, state->errorMessage.utf8().data());
+        else
+            state->exception = ScriptValue(exceptionCatcher.Exception());
+
         exceptionCatcher.Reset();
     } else
         state->hadException = false;
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
index 99edc8b..9d8907b 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 
 #include "ExceptionCode.h"
@@ -77,5 +74,3 @@ v8::Handle<v8::Value> V8ArrayBuffer::constructorCallback(const v8::Arguments& ar
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index 6881a01..f842b6d 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -31,8 +31,6 @@
 #ifndef V8ArrayBufferViewCustom_h
 #define V8ArrayBufferViewCustom_h
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 
 #include "V8ArrayBuffer.h"
@@ -87,7 +85,7 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     int argLen = args.Length();
     if (!argLen) {
         // This happens when we return a previously constructed
-        // ArrayBufferView, e.g. from the call to <Type>Array.slice().
+        // ArrayBufferView, e.g. from the call to <Type>Array.subset().
         // The V8DOMWrapper will set the internal pointer in the
         // created object. Unfortunately it doesn't look like it's
         // possible to distinguish between this case and that where
@@ -99,7 +97,7 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
         V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
         // Do not call SetIndexedPropertiesToExternalArrayData on this
         // object. Not only is there no point from a performance
-        // perspective, but doing so causes errors in the slice() case.
+        // perspective, but doing so causes errors in the subset() case.
         return toV8(array.release(), args.Holder());
     }
 
@@ -209,6 +207,4 @@ v8::Handle<v8::Value> setWebGLArrayHelper(const v8::Arguments& args)
 
 }
 
-#endif // ENABLE(3D_CANVAS)
-
 #endif // V8ArrayBufferViewCustom_h
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
index e1a1ba4..419cd60 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
@@ -28,8 +28,13 @@
 
 #include "V8AudioContext.h"
 
+#include "ArrayBuffer.h"
+#include "AudioBuffer.h"
 #include "AudioContext.h"
 #include "Frame.h"
+#include "V8ArrayBuffer.h"
+#include "V8AudioBuffer.h"
+#include "V8Binding.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
@@ -55,6 +60,58 @@ v8::Handle<v8::Value> V8AudioContext::constructorCallback(const v8::Arguments& a
     return args.Holder();
 }
 
+v8::Handle<v8::Value> V8AudioContext::createBufferCallback(const v8::Arguments& args)
+{
+    if (args.Length() < 2)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+    AudioContext* audioContext = toNative(args.Holder());
+    ASSERT(audioContext);
+
+    v8::Handle<v8::Value> arg = args[0];
+    
+    // AudioBuffer createBuffer(in ArrayBuffer buffer, in boolean mixToMono);
+    if (V8ArrayBuffer::HasInstance(arg)) {
+        v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
+        ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);
+        ASSERT(arrayBuffer);
+
+        if (arrayBuffer) {
+            bool mixToMono = args[1]->ToBoolean()->Value();
+
+            RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(arrayBuffer, mixToMono);
+            if (!audioBuffer.get())
+                return throwError("Error decoding audio file data", V8Proxy::SyntaxError);
+
+            return toV8(audioBuffer.get());
+        }
+        
+        return v8::Undefined();
+    }
+    
+    // AudioBuffer createBuffer(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate);
+    if (args.Length() < 3)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+    bool ok = false;
+    
+    unsigned numberOfChannels = toInt32(args[0], ok);
+    if (!ok)
+        return throwError("Invalid number of channels", V8Proxy::SyntaxError);
+    
+    unsigned numberOfFrames = toInt32(args[1], ok);
+    if (!ok)
+        return throwError("Invalid number of frames", V8Proxy::SyntaxError);
+    
+    float sampleRate = toFloat(args[2]);
+    
+    RefPtr<AudioBuffer> audioBuffer = audioContext->createBuffer(numberOfChannels, numberOfFrames, sampleRate);
+    if (!audioBuffer.get())
+        return throwError("Error creating AudioBuffer", V8Proxy::SyntaxError);
+
+    return toV8(audioBuffer.get());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 328a9c1..85ae322 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -183,12 +183,6 @@ void V8DOMWindow::eventAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
     context->Global()->SetHiddenValue(eventSymbol, value);
 }
 
-v8::Handle<v8::Value> V8DOMWindow::cryptoAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
-{
-    // FIXME: Implement me.
-    return v8::Undefined();
-}
-
 void V8DOMWindow::locationAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     DOMWindow* imp = V8DOMWindow::toNative(info.Holder());
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index 60ce7ce..14f13cb 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -24,9 +24,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "DataView.h"
 
 #include "V8ArrayBufferViewCustom.h"
@@ -120,5 +117,3 @@ v8::Handle<v8::Value> V8DataView::setUint8Callback(const v8::Arguments& args)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index cda0737..c435863 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -49,7 +49,7 @@
 #include "V8Proxy.h"
 #include "V8Touch.h"
 #include "V8TouchList.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "V8WebGLRenderingContext.h"
 #endif
 #include "V8XPathNSResolver.h"
@@ -110,10 +110,10 @@ v8::Handle<v8::Value> V8Document::getCSSCanvasContextCallback(const v8::Argument
         return v8::Undefined();
     if (result->is2d())
         return toV8(static_cast<CanvasRenderingContext2D*>(result));
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     else if (result->is3d())
         return toV8(static_cast<WebGLRenderingContext*>(result));
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
     ASSERT_NOT_REACHED();
     return v8::Undefined();
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
index 02fc457..e9b9336 100644
--- a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
@@ -58,7 +58,7 @@ v8::Handle<v8::Value> toV8(Element* impl, bool forceNewObject)
     if (!impl)
         return v8::Null();
     if (impl->isHTMLElement())
-        return toV8(static_cast<HTMLElement*>(impl), forceNewObject);
+        return toV8(toHTMLElement(impl), forceNewObject);
 #if ENABLE(SVG)
     if (impl->isSVGElement())
         return toV8(static_cast<SVGElement*>(impl), forceNewObject);
diff --git a/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
index c3dbe3b..178307e 100644
--- a/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Float32Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Float32Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index e154f7f..8fd2d62 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -41,7 +41,7 @@
 #include "V8CanvasRenderingContext2D.h"
 #include "V8Node.h"
 #include "V8Proxy.h"
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 #include "V8WebGLRenderingContext.h"
 #endif
 #include <wtf/MathExtras.h>
@@ -55,7 +55,7 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
     HTMLCanvasElement* imp = V8HTMLCanvasElement::toNative(holder);
     String contextId = toWebCoreString(args[0]);
     RefPtr<CanvasContextAttributes> attrs;
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     if (contextId == "experimental-webgl" || contextId == "webkit-3d") {
         attrs = WebGLContextAttributes::create();
         WebGLContextAttributes* webGLAttrs = static_cast<WebGLContextAttributes*>(attrs.get());
@@ -84,7 +84,7 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
         return v8::Null();
     if (result->is2d())
         return toV8(static_cast<CanvasRenderingContext2D*>(result));
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
     else if (result->is3d())
         return toV8(static_cast<WebGLRenderingContext*>(result));
 #endif
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 6bd5abb..ce1732b 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -36,7 +36,6 @@
 #include "Frame.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
-#include "InspectorController.h"
 #include "InspectorValues.h"
 #include "Node.h"
 #include "Page.h"
@@ -147,8 +146,7 @@ v8::Handle<v8::Value> V8InjectedScriptHost::nodeForIdCallback(const v8::Argument
     if (!node)
         return v8::Undefined();
 
-    InspectorController* ic = host->inspectorController();
-    if (!ic)
+    if (!host->inspectorAgent())
         return v8::Undefined();
 
     return toV8(node);
diff --git a/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
index 94fa86e..a8d8d0b 100644
--- a/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
@@ -32,6 +32,7 @@
 #include "V8InspectorFrontendHost.h"
 
 #include "InspectorController.h"
+#include "InspectorFrontendClient.h"
 #include "InspectorFrontendHost.h"
 #include "PlatformString.h"
 
diff --git a/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
index 244a231..90a3c71 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Int16Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Int16Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
index a5001ed..8fa38a7 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Int32Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Int32Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
index 526d83e..33458dc 100644
--- a/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Int8Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Int8Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index f1357bd..c94afd9 100644
--- a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -81,7 +81,7 @@ v8::Handle<v8::Value> V8NotificationCenter::requestPermissionCallback(const v8::
 {
     INC_STATS(L"DOM.NotificationCenter.RequestPermission()");
     NotificationCenter* notificationCenter = V8NotificationCenter::toNative(args.Holder());
-    ScriptExecutionContext* context = notificationCenter->context();
+    ScriptExecutionContext* context = notificationCenter->scriptExecutionContext();
 
     // Make sure that script execution context is valid.
     if (!context)
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
index e3ae263..aebe310 100644
--- a/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Uint16Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Uint16Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
index 6c60283..563df8e 100644
--- a/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Uint32Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Uint32Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp b/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
index ea9f421..aa46863 100644
--- a/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
@@ -29,9 +29,6 @@
  */
 
 #include "config.h"
-
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
-
 #include "ArrayBuffer.h"
 #include "Uint8Array.h"
 
@@ -67,5 +64,3 @@ v8::Handle<v8::Value> toV8(Uint8Array* impl)
 }
 
 } // namespace WebCore
-
-#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 7fdfc55..5a3f873 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(WEBGL)
 
 #include "V8WebGLRenderingContext.h"
 
@@ -120,14 +120,14 @@ static v8::Handle<v8::Value> toV8Object(const WebGLGetInfo& info)
     }
     case WebGLGetInfo::kTypeFloat:
         return v8::Number::New(info.getFloat());
-    case WebGLGetInfo::kTypeLong:
-        return v8::Integer::New(info.getLong());
+    case WebGLGetInfo::kTypeInt:
+        return v8::Integer::New(info.getInt());
     case WebGLGetInfo::kTypeNull:
         return v8::Null();
     case WebGLGetInfo::kTypeString:
         return v8::String::New(fromWebCoreString(info.getString()), info.getString().length());
-    case WebGLGetInfo::kTypeUnsignedLong:
-        return v8::Integer::NewFromUnsigned(info.getUnsignedLong());
+    case WebGLGetInfo::kTypeUnsignedInt:
+        return v8::Integer::NewFromUnsigned(info.getUnsignedInt());
     case WebGLGetInfo::kTypeWebGLBuffer:
         return toV8(info.getWebGLBuffer());
     case WebGLGetInfo::kTypeWebGLFloatArray:
@@ -773,4 +773,4 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::vertexAttrib4fvCallback(const v8:
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 6a571ae..0548a4d 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -95,7 +95,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::responseAccessorGetter(v8::Local<v8::Str
         return v8::Undefined();
 #endif
 
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
     case XMLHttpRequest::ResponseTypeArrayBuffer:
         {
             ExceptionCode ec = 0;
@@ -193,7 +193,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::sendCallback(const v8::Arguments& args)
             DOMFormData* domFormData = V8DOMFormData::toNative(object);
             ASSERT(domFormData);
             xmlHttpRequest->send(domFormData, ec);
-#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
+#if ENABLE(WEBGL) || ENABLE(BLOB)
         } else if (V8ArrayBuffer::HasInstance(arg)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);