Merge WebKit at r80534: Intial merge by Git

Change-Id: Ia7a83357124c9e1cdb1debf55d9661ec0bd09a61

15 files changed, 245 insertions, 95 deletions

diff --git a/Source/WebCore/bindings/v8/DebuggerScript.js b/Source/WebCore/bindings/v8/DebuggerScript.js
index 1798352..0bed33d 100644
--- a/Source/WebCore/bindings/v8/DebuggerScript.js
+++ b/Source/WebCore/bindings/v8/DebuggerScript.js
@@ -203,8 +203,6 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
 
     // Get location.
     var location  = frameMirror.sourceLocation();
-    var line = DebuggerScript._v8ToWebkitLineNumber(location.line);
-    var column = DebuggerScript._v8ToWebkitLineNumber(location.column);
 
     // Get this object.
     var thisObject = frameMirror.details_.receiver();
@@ -251,8 +249,8 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
 
     return {
         "sourceID": sourceID,
-        "line": line,
-        "column": column,
+        "line": location.line,
+        "column": location.column,
         "functionName": functionName,
         "type": "function",
         "thisObject": thisObject,
@@ -263,11 +261,6 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
     };
 }
 
-DebuggerScript._v8ToWebkitLineNumber = function(line)
-{
-    return line + 1;
-};
-
 return DebuggerScript;
 
 })();
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index 2e8d4fe..dcbdd81 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -33,6 +33,7 @@
 #include "IDBKeyPath.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
+#include "V8IDBKey.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -51,6 +52,8 @@ PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value> value)
     return 0; // Signals type error.
 }
 
+namespace {
+
 template<typename T>
 bool getValueFrom(T indexOrName, v8::Handle<v8::Value>& v8Value)
 {
@@ -61,6 +64,40 @@ bool getValueFrom(T indexOrName, v8::Handle<v8::Value>& v8Value)
     return true;
 }
 
+template<typename T>
+bool setValue(v8::Handle<v8::Value>& v8Object, T indexOrName, const v8::Handle<v8::Value>& v8Value)
+{
+    v8::Local<v8::Object> object = v8Object->ToObject();
+    ASSERT(!object->Has(indexOrName));
+    return object->Set(indexOrName, v8Value);
+}
+
+bool get(v8::Handle<v8::Value>& object, const IDBKeyPathElement& keyPathElement)
+{
+    switch (keyPathElement.type) {
+    case IDBKeyPathElement::IsIndexed:
+        return object->IsArray() && getValueFrom(keyPathElement.index, object);
+    case IDBKeyPathElement::IsNamed:
+        return object->IsObject() && getValueFrom(v8String(keyPathElement.identifier), object);
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return false;
+}
+
+bool set(v8::Handle<v8::Value>& object, const IDBKeyPathElement& keyPathElement, const v8::Handle<v8::Value>& v8Value)
+{
+    switch (keyPathElement.type) {
+    case IDBKeyPathElement::IsIndexed:
+        return object->IsArray() && setValue(object, keyPathElement.index, v8Value);
+    case IDBKeyPathElement::IsNamed:
+        return object->IsObject() && setValue(object, v8String(keyPathElement.identifier), v8Value);
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    return false;
+}
+
 class LocalContext {
 public:
     LocalContext()
@@ -80,25 +117,46 @@ private:
     v8::Persistent<v8::Context> m_context;
 };
 
+v8::Handle<v8::Value> getNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue, const Vector<IDBKeyPathElement>& keyPathElements, size_t index)
+{
+    v8::Handle<v8::Value> currentValue(rootValue);
+
+    ASSERT(index <= keyPathElements.size());
+    for (size_t i = 0; i < index; ++i) {
+        if (!get(currentValue, keyPathElements[i]))
+            return v8::Handle<v8::Value>();
+    }
+
+    return currentValue;
+}
+
+} // anonymous namespace
+
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const Vector<IDBKeyPathElement>& keyPath)
 {
     LocalContext localContext;
     v8::Handle<v8::Value> v8Value(value->deserialize());
-    for (size_t i = 0; i < keyPath.size(); ++i) {
-        switch (keyPath[i].type) {
-        case IDBKeyPathElement::IsIndexed:
-            if (!v8Value->IsArray() || !getValueFrom(keyPath[i].index, v8Value))
-                return 0;
-            break;
-        case IDBKeyPathElement::IsNamed:
-            if (!v8Value->IsObject() || !getValueFrom(v8String(keyPath[i].identifier), v8Value))
-                return 0;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-        }
-    }
-    return createIDBKeyFromValue(v8Value);
+    v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPath, keyPath.size()));
+    if (v8Key.IsEmpty())
+        return 0;
+    return createIDBKeyFromValue(v8Key);
+}
+
+PassRefPtr<SerializedScriptValue> injectIDBKeyIntoSerializedValue(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const Vector<IDBKeyPathElement>& keyPath)
+{
+    LocalContext localContext;
+    if (!keyPath.size())
+        return 0;
+
+    v8::Handle<v8::Value> v8Value(value->deserialize());
+    v8::Handle<v8::Value> parent(getNthValueOnKeyPath(v8Value, keyPath, keyPath.size() - 1));
+    if (parent.IsEmpty())
+        return 0;
+
+    if (!set(parent, keyPath.last(), toV8(key.get())))
+        return 0;
+
+    return SerializedScriptValue::create(v8Value);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.h b/Source/WebCore/bindings/v8/IDBBindingUtilities.h
index 1a794b0..1fb855c 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.h
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.h
@@ -39,6 +39,7 @@ struct IDBKeyPathElement;
 
 PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value>);
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value,  const Vector<IDBKeyPathElement, 0>& keyPath);
+PassRefPtr<SerializedScriptValue> injectIDBKeyIntoSerializedValue(PassRefPtr<IDBKey>, PassRefPtr<SerializedScriptValue>, const Vector<IDBKeyPathElement, 0>&);
 
 }
 
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index 55f127b..42953f2 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -240,7 +240,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     m_sourceURL = savedSourceURL;
 
-    if (object.IsEmpty() || object->IsUndefined())
+    if (object.IsEmpty())
         return ScriptValue();
 
     return ScriptValue(object);
diff --git a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
index c35d508..09e1e54 100644
--- a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
+++ b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
@@ -76,4 +76,10 @@ void ScriptHeapSnapshot::writeJSON(ScriptHeapSnapshot::OutputStream* stream)
     m_snapshot->Serialize(&outputStream, v8::HeapSnapshot::kJSON);
 }
 
+int ScriptHeapSnapshot::exactRetainedSize(uint64_t nodeId)
+{
+    const v8::HeapGraphNode* node = m_snapshot->GetNodeById(nodeId);
+    return node ? node->GetRetainedSize(true) : -1;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
index d3ae022..6cfd76d 100644
--- a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
+++ b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
@@ -59,6 +59,7 @@ public:
     String title() const;
     unsigned int uid() const;
     void writeJSON(OutputStream* stream);
+    int exactRetainedSize(uint64_t nodeId);
 
 private:
     ScriptHeapSnapshot(const v8::HeapSnapshot* snapshot)
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 1c5e4e7..04ef2b1 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -51,9 +51,7 @@
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
-// FIXME:
-// - catch V8 exceptions
-// - consider crashing in debug mode on deserialization errors
+// FIXME: consider crashing in debug mode on deserialization errors
 
 namespace WebCore {
 
@@ -221,14 +219,14 @@ public:
         doWriteUint32(pixelDataLength);
         append(pixelData, pixelDataLength);
     }
-    
+
     void writeRegExp(v8::Local<v8::String> pattern, v8::RegExp::Flags flags)
     {
         append(RegExpTag);
         v8::String::Utf8Value patternUtf8Value(pattern);
         doWriteString(*patternUtf8Value, patternUtf8Value.length());
         doWriteUint32(static_cast<uint32_t>(flags));
-    }    
+    }
 
     void writeArray(uint32_t length)
     {
@@ -339,26 +337,45 @@ private:
 class Serializer {
     class StateBase;
 public:
-    explicit Serializer(Writer& writer)
+    enum Status {
+        Success,
+        InputError,
+        JSException,
+        JSFailure
+    };
+
+    Serializer(Writer& writer, v8::TryCatch& tryCatch)
         : m_writer(writer)
+        , m_tryCatch(tryCatch)
         , m_depth(0)
-        , m_hasError(false)
+        , m_status(Success)
     {
+        ASSERT(!tryCatch.HasCaught());
     }
 
-    bool serialize(v8::Handle<v8::Value> value)
+    Status serialize(v8::Handle<v8::Value> value)
     {
         v8::HandleScope scope;
         StateBase* state = doSerialize(value, 0);
         while (state)
             state = state->advance(*this);
-        return !m_hasError;
+        return m_status;
     }
 
     // Functions used by serialization states.
 
     StateBase* doSerialize(v8::Handle<v8::Value> value, StateBase* next);
 
+    StateBase* checkException(StateBase* state)
+    {
+        return m_tryCatch.HasCaught() ? handleError(JSException, state) : 0;
+    }
+
+    StateBase* reportFailure(StateBase* state)
+    {
+        return handleError(JSFailure, state);
+    }
+
     StateBase* writeArray(uint32_t length, StateBase* state)
     {
         m_writer.writeArray(length);
@@ -447,7 +464,10 @@ private:
         {
             ++m_index;
             for (; m_index < composite()->Length(); ++m_index) {
-                if (StateBase* newState = serializer.doSerialize(composite()->Get(m_index), this))
+                v8::Handle<v8::Value> value = composite()->Get(m_index);
+                if (StateBase* newState = serializer.checkException(this))
+                    return newState;
+                if (StateBase* newState = serializer.doSerialize(value, this))
                     return newState;
             }
             return serializer.writeArray(composite()->Length(), this);
@@ -462,8 +482,7 @@ private:
     public:
         AbstractObjectState(v8::Handle<v8::Object> object, StateBase* next)
             : State<v8::Object>(object, next)
-            , m_propertyNames(object->GetPropertyNames())
-            , m_index(-1)
+            , m_index(0)
             , m_numSerializedProperties(0)
             , m_nameDone(false)
         {
@@ -471,15 +490,32 @@ private:
 
         virtual StateBase* advance(Serializer& serializer)
         {
-            ++m_index;
-            for (; m_index < m_propertyNames->Length(); ++m_index) {
-                if (m_propertyName.IsEmpty()) {
+            if (!m_index) {
+                m_propertyNames = composite()->GetPropertyNames();
+                if (StateBase* newState = serializer.checkException(this))
+                    return newState;
+                if (m_propertyNames.IsEmpty())
+                    return serializer.reportFailure(this);
+            }
+            while (m_index < m_propertyNames->Length()) {
+                if (!m_nameDone) {
                     v8::Local<v8::Value> propertyName = m_propertyNames->Get(m_index);
-                    if ((propertyName->IsString() && composite()->HasRealNamedProperty(propertyName.As<v8::String>()))
-                        || (propertyName->IsUint32() && composite()->HasRealIndexedProperty(propertyName->Uint32Value()))) {
+                    if (StateBase* newState = serializer.checkException(this))
+                        return newState;
+                    if (propertyName.IsEmpty())
+                        return serializer.reportFailure(this);
+                    bool hasStringProperty = propertyName->IsString() && composite()->HasRealNamedProperty(propertyName.As<v8::String>());
+                    if (StateBase* newState = serializer.checkException(this))
+                        return newState;
+                    bool hasIndexedProperty = !hasStringProperty && propertyName->IsUint32() && composite()->HasRealIndexedProperty(propertyName->Uint32Value());
+                    if (StateBase* newState = serializer.checkException(this))
+                        return newState;
+                    if (hasStringProperty || hasIndexedProperty)
                         m_propertyName = propertyName;
-                    } else
+                    else {
+                        ++m_index;
                         continue;
+                    }
                 }
                 ASSERT(!m_propertyName.IsEmpty());
                 if (!m_nameDone) {
@@ -488,8 +524,11 @@ private:
                         return newState;
                 }
                 v8::Local<v8::Value> value = composite()->Get(m_propertyName);
+                if (StateBase* newState = serializer.checkException(this))
+                    return newState;
                 m_nameDone = false;
                 m_propertyName.Clear();
+                ++m_index;
                 ++m_numSerializedProperties;
                 if (StateBase* newState = serializer.doSerialize(value, this))
                     return newState;
@@ -540,7 +579,7 @@ private:
     {
         ASSERT(state);
         ++m_depth;
-        return checkComposite(state) ? state : handleError(state);
+        return checkComposite(state) ? state : handleError(InputError, state);
     }
 
     StateBase* pop(StateBase* state)
@@ -552,9 +591,10 @@ private:
         return next;
     }
 
-    StateBase* handleError(StateBase* state)
+    StateBase* handleError(Status errorStatus, StateBase* state)
     {
-        m_hasError = true;
+        ASSERT(errorStatus != Success);
+        m_status = errorStatus;
         while (state) {
             StateBase* tmp = state->nextState();
             delete state;
@@ -616,7 +656,7 @@ private:
         WTF::ByteArray* pixelArray = imageData->data()->data();
         m_writer.writeImageData(imageData->width(), imageData->height(), pixelArray->data(), pixelArray->length());
     }
-    
+
     void writeRegExp(v8::Handle<v8::Value> value)
     {
         v8::Handle<v8::RegExp> regExp = value.As<v8::RegExp>();
@@ -632,19 +672,20 @@ private:
 
     static StateBase* newObjectState(v8::Handle<v8::Object> object, StateBase* next)
     {
-        // FIXME:
-        // - check not a wrapper
-        // - support File, etc.
+        // FIXME: check not a wrapper
         return new ObjectState(object, next);
     }
 
     Writer& m_writer;
+    v8::TryCatch& m_tryCatch;
     int m_depth;
-    bool m_hasError;
+    Status m_status;
 };
 
 Serializer::StateBase* Serializer::doSerialize(v8::Handle<v8::Value> value, StateBase* next)
 {
+    if (value.IsEmpty())
+        return reportFailure(next);
     if (value->IsUndefined())
         m_writer.writeUndefined();
     else if (value->IsNull())
@@ -890,7 +931,7 @@ private:
         *value = toV8(imageData.release());
         return true;
     }
-    
+
     bool readRegExp(v8::Handle<v8::Value>* value)
     {
         v8::Handle<v8::Value> pattern;
@@ -1105,6 +1146,12 @@ void SerializedScriptValue::deserializeAndSetProperty(v8::Handle<v8::Object> obj
     object->ForceSet(v8::String::NewSymbol(propertyName), deserialized, attribute);
 }
 
+void SerializedScriptValue::deserializeAndSetProperty(v8::Handle<v8::Object> object, const char* propertyName,
+                                                      v8::PropertyAttribute attribute, PassRefPtr<SerializedScriptValue> value)
+{
+    deserializeAndSetProperty(object, propertyName, attribute, value.get());
+}
+
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(v8::Handle<v8::Value> value, bool& didThrow)
 {
     return adoptRef(new SerializedScriptValue(value, didThrow));
@@ -1173,12 +1220,33 @@ SerializedScriptValue::SerializedScriptValue(v8::Handle<v8::Value> value, bool&
 {
     didThrow = false;
     Writer writer;
-    Serializer serializer(writer);
-    if (!serializer.serialize(value)) {
+    Serializer::Status status;
+    {
+        v8::TryCatch tryCatch;
+        Serializer serializer(writer, tryCatch);
+        status = serializer.serialize(value);
+        if (status == Serializer::JSException) {
+            // If there was a JS exception thrown, re-throw it.
+            didThrow = true;
+            tryCatch.ReThrow();
+            return;
+        }
+    }
+    if (status == Serializer::InputError) {
+        // If there was an input error, throw a new exception outside
+        // of the TryCatch scope.
+        didThrow = true;
         throwError(NOT_SUPPORTED_ERR);
+        return;
+    }
+    if (status == Serializer::JSFailure) {
+        // If there was a JS failure (but no exception), there's not
+        // much we can do except for unwinding the C++ stack by
+        // pretending there was a JS exception.
         didThrow = true;
         return;
     }
+    ASSERT(status == Serializer::Success);
     m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
 }
 
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index d0d8575..c0e9109 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -39,8 +39,10 @@ namespace WebCore {
 
 class SerializedScriptValue : public ThreadSafeShared<SerializedScriptValue> {
 public:
-    static void deserializeAndSetProperty(v8::Handle<v8::Object> object, const char* propertyName,
+    static void deserializeAndSetProperty(v8::Handle<v8::Object>, const char* propertyName,
                                           v8::PropertyAttribute, SerializedScriptValue*);
+    static void deserializeAndSetProperty(v8::Handle<v8::Object>, const char* propertyName,
+                                          v8::PropertyAttribute, PassRefPtr<SerializedScriptValue>);
 
     // If a serialization error occurs (e.g., cyclic input value) this
     // function returns an empty representation, schedules a V8 exception to
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index bda4345..6dc49fa 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -147,12 +147,11 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         v8Context->Global()->SetHiddenValue(eventSymbol, jsEvent);
         tryCatch.Reset();
 
-        // Call the event handler.
         returnValue = callListenerFunction(context, jsEvent, event);
+        if (tryCatch.HasCaught())
+            event->target()->uncaughtExceptionInEventHandler();
         if (!tryCatch.CanContinue())
             return;
-
-        // If an error occurs while handling the event, it should be reported in a regular way.
         tryCatch.Reset();
 
         // Restore the old event. This must be done for all exit paths through this method.
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index f296b8f..cda9f3d 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -290,6 +290,7 @@ public:
         if (node->isDocumentNode()) {
             Document* document = reinterpret_cast<Document*>(node);
             addDOMObjectToGroup(store, groupId, document->styleSheets());
+            addDOMObjectToGroup(store, groupId, document->implementation());
         }
 
         WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index 14f13cb..f260cff 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -36,7 +36,10 @@ namespace WebCore {
 
 v8::Handle<v8::Value> V8DataView::constructorCallback(const v8::Arguments& args)
 {
-    INC_STATS("DOM.ArrayBuffer.Constructor");
+    INC_STATS("DOM.DataView.Constructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function", V8Proxy::SyntaxError);
 
     if (args[0]->IsNull() || !V8ArrayBuffer::HasInstance(args[0]))
         return V8Proxy::throwTypeError();
diff --git a/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
index ff9b98b..abb7d4c 100644
--- a/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
@@ -44,8 +44,7 @@
 #include "V8DeviceOrientationEvent.h"
 #include "V8ErrorEvent.h"
 #include "V8HashChangeEvent.h"
-#include "V8IDBErrorEvent.h"
-#include "V8IDBSuccessEvent.h"
+#include "V8IDBVersionChangeEvent.h"
 #include "V8KeyboardEvent.h"
 #include "V8MessageEvent.h"
 #include "V8MouseEvent.h"
@@ -156,10 +155,8 @@ v8::Handle<v8::Value> toV8(Event* impl)
         return toV8(static_cast<StorageEvent*>(impl));
 #endif
 #if ENABLE(INDEXED_DATABASE)
-    if (impl->isIDBErrorEvent())
-        return toV8(static_cast<IDBErrorEvent*>(impl));
-    if (impl->isIDBSuccessEvent())
-        return toV8(static_cast<IDBSuccessEvent*>(impl));
+    if (impl->isIDBVersionChangeEvent())
+        return toV8(static_cast<IDBVersionChangeEvent*>(impl));
 #endif
     if (impl->isBeforeLoadEvent())
         return toV8(static_cast<BeforeLoadEvent*>(impl));
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
index fd6f1a5..ccd6fb2 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
@@ -33,6 +33,7 @@
 
 #include "SerializedScriptValue.h"
 #include "V8IDBCursor.h"
+#include "V8IDBCursorWithValue.h"
 #include "V8IDBDatabase.h"
 #include "V8IDBFactory.h"
 #include "V8IDBIndex.h"
@@ -54,6 +55,8 @@ v8::Handle<v8::Value> toV8(IDBAny* impl)
         return v8::Null();
     case IDBAny::IDBCursorType:
         return toV8(impl->idbCursor());
+    case IDBAny::IDBCursorWithValueType:
+        return toV8(impl->idbCursorWithValue());
     case IDBAny::IDBDatabaseType:
         return toV8(impl->idbDatabase());
     case IDBAny::IDBFactoryType:
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index ce1732b..7a33ed0 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -40,6 +40,7 @@
 #include "Node.h"
 #include "Page.h"
 #include "ScriptDebugServer.h"
+#include "ScriptValue.h"
 
 #include "V8Binding.h"
 #include "V8BindingState.h"
@@ -54,6 +55,22 @@
 
 namespace WebCore {
 
+Node* InjectedScriptHost::scriptValueAsNode(ScriptValue value)
+{
+    if (!value.isObject() || value.isNull())
+        return 0;
+    return V8Node::toNative(v8::Handle<v8::Object>::Cast(value.v8Value()));
+}
+
+ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node)
+{
+    v8::HandleScope scope;
+    v8::Local<v8::Context> context = state->context();
+    v8::Context::Scope contextScope(context);
+
+    return ScriptValue(toV8(node));
+}
+
 static void WeakReferenceCallback(v8::Persistent<v8::Value> object, void* parameter)
 {
     InjectedScriptHost* nativeObject = static_cast<InjectedScriptHost*>(parameter);
@@ -134,21 +151,18 @@ void InjectedScriptHost::discardInjectedScript(ScriptState* inspectedScriptState
     global->DeleteHiddenValue(key);
 }
 
-v8::Handle<v8::Value> V8InjectedScriptHost::nodeForIdCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8InjectedScriptHost::inspectedNodeCallback(const v8::Arguments& args)
 {
-    INC_STATS("InjectedScriptHost.nodeForId()");
+    INC_STATS("InjectedScriptHost.inspectedNode()");
     if (args.Length() < 1)
         return v8::Undefined();
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
     
-    Node* node = host->nodeForId(args[0]->ToInt32()->Value());
+    Node* node = host->inspectedNode(args[0]->ToInt32()->Value());
     if (!node)
         return v8::Undefined();
 
-    if (!host->inspectorAgent())
-        return v8::Undefined();
-
     return toV8(node);
 }
 
@@ -164,61 +178,58 @@ v8::Handle<v8::Value> V8InjectedScriptHost::internalConstructorNameCallback(cons
     return args[0]->ToObject()->GetConstructorName();
 }
 
-v8::Handle<v8::Value> V8InjectedScriptHost::pushNodePathToFrontendCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8InjectedScriptHost::inspectCallback(const v8::Arguments& args)
 {
-    INC_STATS("InjectedScriptHost.pushNodePathToFrontend()");
-    if (args.Length() < 3)
+    INC_STATS("InjectedScriptHost.inspect()");
+    if (args.Length() < 2)
         return v8::Undefined();
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-    Node* node = V8Node::toNative(v8::Handle<v8::Object>::Cast(args[0]));
-    bool withChildren = args[1]->ToBoolean()->Value();
-    bool selectInUI = args[2]->ToBoolean()->Value();
-    if (node)
-        return v8::Number::New(host->pushNodePathToFrontend(node, withChildren, selectInUI));
+    ScriptValue objectId(args[0]);
+    ScriptValue hints(args[1]);
+    host->inspectImpl(objectId.toInspectorValue(ScriptState::current()), hints.toInspectorValue(ScriptState::current()));
 
     return v8::Undefined();
 }
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
 v8::Handle<v8::Value> V8InjectedScriptHost::currentCallFrameCallback(const v8::Arguments& args)
 {
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     INC_STATS("InjectedScriptHost.currentCallFrame()");
     return toV8(ScriptDebugServer::shared().currentCallFrame());
-}
+#else
+    UNUSED_PARAM(args);
+    return v8::Undefined();
 #endif
+}
 
-#if ENABLE(DATABASE)
-v8::Handle<v8::Value> V8InjectedScriptHost::selectDatabaseCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8InjectedScriptHost::databaseIdCallback(const v8::Arguments& args)
 {
-    INC_STATS("InjectedScriptHost.selectDatabase()");
+    INC_STATS("InjectedScriptHost.databaseId()");
     if (args.Length() < 1)
         return v8::Undefined();
-
+#if ENABLE(DATABASE)
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
     Database* database = V8Database::toNative(v8::Handle<v8::Object>::Cast(args[0]));
     if (database)
-        host->selectDatabase(database);
-
+        return v8::Number::New(host->databaseIdImpl(database));
+#endif
     return v8::Undefined();
 }
-#endif
 
-#if ENABLE(DOM_STORAGE)
-v8::Handle<v8::Value> V8InjectedScriptHost::selectDOMStorageCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8InjectedScriptHost::storageIdCallback(const v8::Arguments& args)
 {
-    INC_STATS("InjectedScriptHost.selectDOMStorage()");
     if (args.Length() < 1)
         return v8::Undefined();
-
+#if ENABLE(DOM_STORAGE)
+    INC_STATS("InjectedScriptHost.storageId()");
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
     Storage* storage = V8Storage::toNative(v8::Handle<v8::Object>::Cast(args[0]));
     if (storage)
-        host->selectDOMStorage(storage);
-
+        return v8::Number::New(host->storageIdImpl(storage));
+#endif
     return v8::Undefined();
 }
-#endif
 
 InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* inspectedScriptState)
 {
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 5a3f873..af81a41 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -50,6 +50,7 @@
 #include "V8Int8Array.h"
 #include "V8OESStandardDerivatives.h"
 #include "V8OESTextureFloat.h"
+#include "V8OESVertexArrayObject.h"
 #include "V8Proxy.h"
 #include "V8Uint16Array.h"
 #include "V8Uint32Array.h"
@@ -61,6 +62,7 @@
 #include "V8WebGLShader.h"
 #include "V8WebGLTexture.h"
 #include "V8WebGLUniformLocation.h"
+#include "V8WebGLVertexArrayObjectOES.h"
 #include "WebGLRenderingContext.h"
 #include <wtf/FastMalloc.h>
 
@@ -146,6 +148,8 @@ static v8::Handle<v8::Value> toV8Object(const WebGLGetInfo& info)
         return toV8(info.getWebGLTexture());
     case WebGLGetInfo::kTypeWebGLUnsignedByteArray:
         return toV8(info.getWebGLUnsignedByteArray());
+    case WebGLGetInfo::kTypeWebGLVertexArrayObjectOES:
+        return toV8(info.getWebGLVertexArrayObjectOES());
     default:
         notImplemented();
         return v8::Undefined();
@@ -167,6 +171,9 @@ static v8::Handle<v8::Value> toV8Object(WebGLExtension* extension, v8::Handle<v8
     case WebGLExtension::OESTextureFloatName:
         extensionObject = toV8(static_cast<OESTextureFloat*>(extension));
         break;
+    case WebGLExtension::OESVertexArrayObjectName:
+        extensionObject = toV8(static_cast<OESVertexArrayObject*>(extension));
+        break;
     }
     ASSERT(!extensionObject.IsEmpty());
     V8DOMWrapper::setHiddenReference(contextObject, extensionObject);