Merge webkit.org at R49305 : Automatic merge by git.

Change-Id: I8968561bc1bfd72b8923b7118d3728579c6dbcc7

140 files changed, 5171 insertions, 1060 deletions

diff --git a/WebCore/bindings/js/DOMObjectWithSVGContext.h b/WebCore/bindings/js/DOMObjectWithSVGContext.h
index 570548d..3d435cb 100644
--- a/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ b/WebCore/bindings/js/DOMObjectWithSVGContext.h
@@ -40,7 +40,7 @@ namespace WebCore {
         SVGElement* context() const { return m_context.get(); }
 
     protected:
-        DOMObjectWithSVGContext(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
+        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
             : DOMObject(structure)
             , m_context(context)
         {
diff --git a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 003f544..9411ad8 100644
--- a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -44,30 +44,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSAbstractWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onerror());
-
-    typedef AbstractWorker::EventListenersMap EventListenersMap;
-    typedef AbstractWorker::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,10 +63,12 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index abd5ad5..14457c4 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,7 +48,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
         if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
+            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
+            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
                 return;
         }
     }
@@ -58,4 +59,16 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     setDOMException(exec, ec);
 }
 
+void JSAttr::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->ownerElement()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSAudioConstructor.cpp b/WebCore/bindings/js/JSAudioConstructor.cpp
index 87a3880..174cc11 100644
--- a/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSHTMLAudioElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSCSSRuleListCustom.cpp b/WebCore/bindings/js/JSCSSRuleListCustom.cpp
new file mode 100644
index 0000000..be3a9a2
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSRuleListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCSSRuleList.h"
+
+#include "CSSRuleList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCSSRuleList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSRuleList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 280ec93..4a137d3 100644
--- a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,8 @@
 #include "JSCSSStyleDeclarationCustom.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
 #include "PlatformString.h"
 #include <runtime/StringObjectThatMasqueradesAsUndefined.h>
@@ -40,6 +40,21 @@ using namespace WTF;
 
 namespace WebCore {
 
+void JSCSSStyleDeclaration::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSStyleDeclaration* declaration = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    if (declaration->isMutableStyleDeclaration()) {
+        CSSMutableStyleDeclaration* mutableDeclaration = static_cast<CSSMutableStyleDeclaration*>(declaration);
+        CSSMutableStyleDeclaration::const_iterator end = mutableDeclaration->end();
+        for (CSSMutableStyleDeclaration::const_iterator it = mutableDeclaration->begin(); it != end; ++it)
+            markDOMObjectWrapper(markStack, globalData, it->value());
+    }
+}
+
 // Check for a CSS prefix.
 // Passed prefix is all lowercase.
 // First character of the prefix within the property name may be upper or lowercase.
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
new file mode 100644
index 0000000..d08f760
--- /dev/null
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCallbackData.h"
+
+#include "Document.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+    
+namespace WebCore {
+
+void JSCallbackData::deleteData(void* context)
+{
+    delete static_cast<JSCallbackData*>(context);
+}
+
+JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedException)
+{
+    ASSERT(callback());
+    ASSERT(globalObject());
+
+    ExecState* exec = globalObject()->globalExec();
+    
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = callback()->getCallData(callData);
+        if (callType == CallTypeNone)
+            return JSValue();
+        function = callback();
+    }
+    
+    globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = call(exec, function, callType, callData, callback(), args);
+    globalObject()->globalData()->timeoutChecker.stop();
+
+    Document::updateStyleForAllDocuments();
+
+    if (exec->hadException()) {
+        reportCurrentException(exec);
+        if (raisedException)
+            *raisedException = true;
+        return result;
+    }
+    
+    return result;
+}
+    
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCallbackData.h b/WebCore/bindings/js/JSCallbackData.h
new file mode 100644
index 0000000..4fc9f84
--- /dev/null
+++ b/WebCore/bindings/js/JSCallbackData.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCallbackData_h
+#define JSCallbackData_h
+
+#include "JSDOMGlobalObject.h"
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+// We have to clean up this data on the main thread because unprotecting a
+// JSObject on a non-main thread without synchronization would corrupt the heap
+// (and synchronization would be slow).
+
+class JSCallbackData {
+public:
+    static void deleteData(void*);
+
+    JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+    
+    ~JSCallbackData()
+    {
+        ASSERT(isMainThread());
+    }
+
+    JSC::JSObject* callback() { return m_callback.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
+    
+    JSC::JSValue invokeCallback(JSC::MarkedArgumentBuffer&, bool* raisedException = 0);
+
+private:
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
+
+} // namespace WebCore
+
+#endif // JSCallbackData_h
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
new file mode 100644
index 0000000..93d53ca
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArrayBufferConstructor.h"
+
+#include "Document.h"
+#include "CanvasArrayBuffer.h"
+#include "JSCanvasArrayBuffer.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+
+JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+
+    unsigned int size = 0;
+    if (args.size() == 1) {
+        size = (unsigned int)args.at(0).toInt32(exec);
+        if (isnan(size))
+            size = 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+}
+
+JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasArrayBuffer;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
new file mode 100644
index 0000000..5f1254e
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasArrayBufferConstructor_h
+#define JSCanvasArrayBufferConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include "JSCanvasArrayBuffer.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+    class CanvasArray;
+
+    // Template function used by CanvasXXXArrayConstructors
+    template<class C, typename T>
+    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    {
+        // There are 3 constructors:
+        //
+        //  1) (in int size)
+        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
+        //
+        RefPtr<C> arrayObject;
+        
+        // For the 0 args case, just create an object without a buffer 
+        if (args.size() < 1)
+            return C::create(0, 0, 0);
+        
+        if (args.at(0).isObject()) {
+            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            if (buffer) {
+                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
+                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                return C::create(buffer, offset, length);
+            }
+            
+            JSC::JSObject* array = asObject(args.at(0));
+            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            void* tempValues;
+            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+                throwError(exec, JSC::GeneralError);
+                return 0;
+            }
+            
+            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
+            for (int i = 0; i < length; ++i) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return 0;
+                values.get()[i] = static_cast<T>(v.toNumber(exec));
+            }
+            
+            return C::create(values.get(), length);
+        }
+        
+        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        return C::create(size);
+    }
+
+    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasArrayBufferConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
new file mode 100644
index 0000000..4aa1547
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSCanvasArray.h"
+
+#include "CanvasArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
new file mode 100644
index 0000000..ec1d66d
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
+    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.h b/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
index cd6c2cb..4d5dc11 100644
--- a/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,44 +23,24 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSNamedNodesCollection_h
-#define JSNamedNodesCollection_h
+#ifndef JSCanvasByteArrayConstructor_h
+#define JSCanvasByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
-#include <wtf/Vector.h>
+#include "JSDocument.h"
 
 namespace WebCore {
 
-    class Node;
-
-    // Internal class, used for the collection return by e.g. document.forms.myinput
-    // when multiple nodes have the same name.
-    class JSNamedNodesCollection : public DOMObjectWithGlobalPointer {
+    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSNamedNodesCollection(JSC::ExecState*, JSDOMGlobalObject*, const Vector<RefPtr<Node> >&);
-
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
-        {
-            return globalObject->objectPrototype();
-        }
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-        {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-        }
-
     private:
-        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        OwnPtr<Vector<RefPtr<Node> > > m_nodes;
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
 
-} // namespace WebCore
+}
 
-#endif // JSNamedNodesCollection_h
+#endif // JSCanvasByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..04697ce
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArray.h"
+
+#include "CanvasByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
new file mode 100644
index 0000000..15e39c2
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasFloatArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasFloatArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
+    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasFloatArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
new file mode 100644
index 0000000..efea250
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasFloatArrayConstructor_h
+#define JSCanvasFloatArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasFloatArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..20cd805
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArray.h"
+
+#include "CanvasFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
new file mode 100644
index 0000000..6d57912
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
+    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
new file mode 100644
index 0000000..5e19652
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasIntArrayConstructor_h
+#define JSCanvasIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..8442b87
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArray.h"
+
+#include "CanvasIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp b/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
new file mode 100644
index 0000000..be10ac0
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasNumberArray.h"
+
+#include "CanvasNumberArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasNumberArray::getByIndex(JSC::ExecState* exec, unsigned int index)
+{
+    JSC::JSValue result = jsNumber(exec, impl()->item(index));
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 398a6799..bb3500b 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -67,27 +67,31 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 
 JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->strokeStyle());        
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->strokeStyle());        
 }
 
 void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
-    impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->fillStyle());
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->fillStyle());
 }
 
 void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
-    impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -124,7 +128,7 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -162,7 +166,7 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
 
 JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     if (args.size() <= 4)
         context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
@@ -176,7 +180,7 @@ JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& a
 
 JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // DrawImage has three variants:
     //     drawImage(img, dx, dy)
@@ -264,7 +268,7 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -284,7 +288,7 @@ JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const Arg
 
 JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     switch (args.size()) {
         case 3:
@@ -330,7 +334,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -362,7 +366,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
     // putImageData has two variants
     // putImageData(ImageData, x, y)
     // putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
@@ -377,7 +381,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
@@ -395,7 +399,7 @@ JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& arg
 
 JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..3938ba1
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,443 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext3D.h"
+
+#include "CanvasRenderingContext3D.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebKitCSSMatrix.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
+        return jsUndefined();
+    }
+
+    CanvasArray* array = toCanvasArray(args.at(1));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
+    return jsUndefined();
+}
+
+JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    
+    CanvasArray* array = toCanvasArray(args.at(2));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
+    return jsUndefined();
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        CanvasArray* array = toCanvasArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size); break;
+        case f_uniform2v: context->uniform2fv(location, array, size); break;
+        case f_uniform3v: context->uniform3fv(location, array, size); break;
+        case f_uniform4v: context->uniform4fv(location, array, size); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
+            default: break;
+        }
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size); break;
+        case f_uniform2v: context->uniform2iv(location, array, size); break;
+        case f_uniform3v: context->uniform3iv(location, array, size); break;
+        case f_uniform4v: context->uniform4iv(location, array, size); break;
+        default: break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
+    }
+    return jsUndefined();
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
new file mode 100644
index 0000000..0cd2aa3
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCanvasRenderingContext.h"
+
+#include "CanvasRenderingContext2D.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "CanvasRenderingContext3D.h"
+#include "JSCanvasRenderingContext3D.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasRenderingContext* object)
+{
+    if (!object)
+        return jsUndefined();
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
new file mode 100644
index 0000000..a885b7b
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasShortArray.h"
+#include "JSCanvasArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
+    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
new file mode 100644
index 0000000..df21825
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasShortArrayConstructor_h
+#define JSCanvasShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..21af0a6
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArray.h"
+
+#include "CanvasShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
new file mode 100644
index 0000000..5d0800e
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
new file mode 100644
index 0000000..9cfb721
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedByteArrayConstructor_h
+#define JSCanvasUnsignedByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..f2b0c74
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArray.h"
+
+#include "CanvasUnsignedByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
new file mode 100644
index 0000000..5f145a7
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..6016159
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedIntArrayConstructor_h
+#define JSCanvasUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..95a80a7
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArray.h"
+
+#include "CanvasUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
new file mode 100644
index 0000000..9735693
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedShortArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
new file mode 100644
index 0000000..23c197f
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedShortArrayConstructor_h
+#define JSCanvasUnsignedShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..290cd4b
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArray.h"
+
+#include "CanvasUnsignedShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.cpp b/WebCore/bindings/js/JSCustomPositionCallback.cpp
index ec2d8e3..07788a8 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -35,42 +35,20 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
-    JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
     RefPtr<JSCustomPositionCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
+<<<<<<< HEAD:WebCore/bindings/js/JSCustomPositionCallback.cpp
 
     globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
@@ -81,6 +59,9 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
     }
     
     Document::updateStyleForAllDocuments();
+=======
+    m_data.invokeCallback(args);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSCustomPositionCallback.cpp
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.h b/WebCore/bindings/js/JSCustomPositionCallback.h
index 9c8fe86..dff34fe 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -26,31 +26,33 @@
 #ifndef JSCustomPositionCallback_h
 #define JSCustomPositionCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionCallback.h"
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class Geoposition;
+class JSDOMGlobalObject;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
-    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionCallback(callback, globalObject));
+    }
     
+<<<<<<< HEAD:WebCore/bindings/js/JSCustomPositionCallback.h
     virtual void handleEvent(Geoposition*);
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSCustomPositionCallback.h
 private:
-    JSCustomPositionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    virtual void handleEvent(Geoposition*);
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index cda5738..bd64deb 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -35,51 +35,21 @@ namespace WebCore {
     
 using namespace JSC;
 
-JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    RefPtr<JSCustomPositionErrorCallback> protect(this);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
     JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
-    RefPtr<JSCustomPositionErrorCallback> protect(this);
-    
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-    
-    if (exec->hadException())
-        reportCurrentException(exec);
-    
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index 9f143a2..59328ca 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -26,31 +26,26 @@
 #ifndef JSCustomPositionErrorCallback_h
 #define JSCustomPositionErrorCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionErrorCallback.h"
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class PositionError;
 
 class JSCustomPositionErrorCallback : public PositionErrorCallback {
 public:
-    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionErrorCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(PositionError*);
-
 private:
-    JSCustomPositionErrorCallback(JSC::JSObject* callback, Frame*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
+    virtual void handleEvent(PositionError*);
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index d0943de..1f6bd95 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,6 +28,7 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
@@ -35,60 +36,38 @@
 #include "JSSQLResultSet.h"
 #include "JSSQLTransaction.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
     
-void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-        
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
-        
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-
-        raisedException = true;
-    }
 
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index c380670..259aecf 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSCallbackData.h"
 #include "SQLStatementCallback.h"
-
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLResultSet;
 
 class JSCustomSQLStatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
+    }
+    
+    virtual ~JSCustomSQLStatementCallback();
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
-    JSCustomSQLStatementCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 6c831ac..6178509 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -32,75 +32,51 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
 #include "JSSQLTransaction.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-        
-    if (!m_frame->script()->isEnabled())
-        return true;
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
+JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_callback->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return true;
-        }
-    }
+bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+{
+    ASSERT(m_data);
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-        
-    JSValue result;
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
-    else
-        result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-            
+    
+    bool raisedException = false;
+    JSValue result = m_data->invokeCallback(args, &raisedException);
+    if (raisedException) {
         // The spec says:
         // "If the error callback returns false, then move on to the next statement..."
         // "Otherwise, the error callback did not return false, or there was no error callback"
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-        
-    Document::updateStyleForAllDocuments();
-
     return result.toBoolean(exec);
 }
 
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e563393..ac4e45f 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -31,32 +31,31 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementErrorCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
-    
-class Frame;
+
+class JSCallbackData;    
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementErrorCallback(callback, frame)); }
-        
+    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
+    }
+
+    virtual ~JSCustomSQLStatementErrorCallback();
+
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
-    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 3d42f81..456022f 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,9 +32,11 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
+#include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -47,39 +49,17 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread for two reasons:
-//
-//     1) Can't deref a Frame on a non-main thread.
-//     2) Unprotecting the JSObject on a non-main thread would register that thread
-//        for JavaScript garbage collection, which could unnecessarily slow things down.
-
-class JSCustomSQLTransactionCallback::Data {
-public:
-    Data(JSObject* callback, Frame* frame) : m_callback(callback), m_frame(frame) { }
-    JSObject* callback() { return m_callback; }
-    Frame* frame() { return m_frame.get(); }
-
-private:
-    ProtectedPtr<JSObject> m_callback;
-    RefPtr<Frame> m_frame;
-};
-
-JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, Frame* frame)
-    : m_data(new Data(callback, frame))
+JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
 #endif
 }
 
-void JSCustomSQLTransactionCallback::deleteData(void* context)
-{
-    delete static_cast<Data*>(context);
-}
-
 JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 {
-    callOnMainThread(deleteData, m_data);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
 #ifndef NDEBUG
     m_data = 0;
     counter.decrement();
@@ -89,51 +69,14 @@ JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bool& raisedException)
 {
     ASSERT(m_data);
-    ASSERT(m_data->callback());
-    ASSERT(m_data->frame());
 
-    if (!m_data->frame()->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_data->frame()->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
-
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_data->callback()->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-    }
-        
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
-
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
-    else
-        call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-        
-        raisedException = true;
-    }
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 22c367c..f142e59 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -32,7 +32,6 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionCallback.h"
-
 #include <wtf/PassRefPtr.h>
 
 namespace JSC {
@@ -42,22 +41,24 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSCallbackData;
+class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionCallback(callback, globalObject));
+    }
 
     virtual ~JSCustomSQLTransactionCallback();
     
     virtual void handleEvent(SQLTransaction*, bool& raisedException);
 
 private:
-    JSCustomSQLTransactionCallback(JSC::JSObject* callback, Frame*);
-
-    static void deleteData(void*);
+    JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    class Data;
-    Data* m_data;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 2d41bb8..331e014 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -32,59 +32,40 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-
-    if (!m_frame->script()->isEnabled())
-        return;
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-
-    JSC::JSLock lock(SilenceAssertionsOnly);
+JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index be3df29..54bf33b 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -32,31 +32,30 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionErrorCallback.h"
-
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
+class JSCallbackData;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
+    }
+    
+    virtual ~JSCustomSQLTransactionErrorCallback();
     
     virtual void handleEvent(SQLError*);
 
 private:
-    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.cpp b/WebCore/bindings/js/JSCustomVoidCallback.cpp
index b4e525b..0edd66f 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -30,70 +30,38 @@
 #include "JSCustomVoidCallback.h"
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMWindowCustom.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
+
+JSCustomVoidCallback::~JSCustomVoidCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
     
 void JSCustomVoidCallback::handleEvent()
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-       
-    if (!m_frame->script()->isEnabled())
-        return;
-        
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-        
+    ASSERT(m_data);
+
     RefPtr<JSCustomVoidCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
     MarkedArgumentBuffer args;
-    
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException())
-        reportCurrentException(exec);
-        
-    Document::updateStyleForAllDocuments();
-}
- 
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
-{
-    JSObject* object = value.getObject();
-    if (!object)
-        return 0;
-    
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return 0;
-    
-    return JSCustomVoidCallback::create(object, frame);
+    m_data->invokeCallback(args);
 }
 
-}
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.h b/WebCore/bindings/js/JSCustomVoidCallback.h
index 9cd7c34..4b8d7ea 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -29,33 +29,31 @@
 #ifndef JSCustomVoidCallback_h
 #define JSCustomVoidCallback_h
 
+#include "JSDOMGlobalObject.h"
 #include "VoidCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
+
+class JSCallbackData;
+
+class JSCustomVoidCallback : public VoidCallback {
+public: 
+    static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomVoidCallback(callback, globalObject));
+    }
     
-    class Frame;
+    virtual ~JSCustomVoidCallback();
     
-    class JSCustomVoidCallback : public VoidCallback {
-    public: 
-        static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, Frame* frame)
-        {
-            return adoptRef(new JSCustomVoidCallback(callback, frame));
-        }
-        
-        virtual void handleEvent();
-        
-    private:
-        JSCustomVoidCallback(JSC::JSObject* callback, Frame*);
-
-        JSC::ProtectedPtr<JSC::JSObject> m_callback;
-        RefPtr<Frame> m_frame;
-    };
-
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
+    virtual void handleEvent();
+    
+private:
+    JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    JSCallbackData* m_data;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 4476be5..da4a53a 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -49,13 +49,13 @@ PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecSta
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
-    
-    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()));
+
+    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())));
 }
 
-JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, Frame* frame)
+JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, JSDOMWindow* globalObject)
     : m_customResolver(customResolver)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
@@ -67,15 +67,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
     ASSERT(m_customResolver);
 
-    if (!m_frame)
-        return String();
-    if (!m_frame->script()->isEnabled())
-        return String();
-
     JSLock lock(SilenceAssertionsOnly);
 
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
@@ -84,7 +78,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Pass actual line number and source URL.
-            m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
+            m_globalObject->impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
             return String();
         }
         function = m_customResolver;
@@ -95,9 +89,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->globalData()->timeoutChecker.start();
+    m_globalObject->globalData()->timeoutChecker.start();
     JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.h b/WebCore/bindings/js/JSCustomXPathNSResolver.h
index 44c44f9..7d66494 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -41,6 +41,7 @@ namespace JSC {
 namespace WebCore {
 
     class Frame;
+    class JSDOMWindow;
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
@@ -51,10 +52,11 @@ namespace WebCore {
         virtual String lookupNamespaceURI(const String& prefix);
 
     private:
-        JSCustomXPathNSResolver(JSC::JSObject*, Frame*);
+        JSCustomXPathNSResolver(JSC::JSObject*, JSDOMWindow*);
 
-        JSC::JSObject* m_customResolver; // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the object.
-        RefPtr<Frame> m_frame;
+        // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the objects.
+        JSC::JSObject* m_customResolver;
+        JSDOMWindow* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 109308c..49ef5e3 100644
--- a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -42,28 +42,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMApplicationCache::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onchecking());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onnoupdate());
-    markIfNotNull(markStack, m_impl->ondownloading());
-    markIfNotNull(markStack, m_impl->onprogress());
-    markIfNotNull(markStack, m_impl->onupdateready());
-    markIfNotNull(markStack, m_impl->oncached());
-    markIfNotNull(markStack, m_impl->onobsolete());
-
-    typedef DOMApplicationCache::EventListenersMap EventListenersMap;
-    typedef DOMApplicationCache::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 #if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
 
 JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
@@ -112,10 +90,12 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,10 +104,12 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 566b986..515c088 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -28,6 +28,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLNames.h"
@@ -42,6 +43,8 @@
 #include "RangeException.h"
 #include "ScriptController.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 #include <wtf/StdLibExtras.h>
 
@@ -264,18 +267,48 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     Node* node = jsNode->impl();
 
     if (node->inDocument()) {
-        // 1. If a node is in the document, and its wrapper has custom properties,
+        // If a node is in the document, and its wrapper has custom properties,
         // the wrapper is observable because future access to the node through the
         // DOM must reflect those properties.
         if (jsNode->hasCustomProperties())
             return true;
 
-        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // If a node is in the document, and has event listeners, its wrapper is
         // observable because its wrapper is responsible for marking those event listeners.
-        if (node->eventListeners().size())
+        if (node->hasEventListeners())
             return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+
+        // If a node owns another object with a wrapper with custom properties,
+        // the wrapper must be treated as observable, because future access to
+        // those objects through the DOM must reflect those properties.
+        // FIXME: It would be better if this logic could be in the node next to
+        // the custom markChildren functions rather than here.
+        if (node->isElementNode()) {
+            if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
+                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                    if (wrapper->hasCustomProperties())
+                        return true;
+                }
+            }
+            if (node->isStyledElement()) {
+                if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+            if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
+                if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+        }
     } else {
-        // 3. If a wrapper is the last reference to an image or script element
+        // If a wrapper is the last reference to an image or script element
         // that is loading but not in the document, the wrapper is observable
         // because it is the only thing keeping the image element alive, and if
         // the image element is destroyed, its load event will not fire.
@@ -290,6 +323,11 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
 #endif
     }
 
+    // If a node is firing event listeners, its wrapper is observable because
+    // its wrapper is responsible for marking those event listeners.
+    if (node->isFiringEventListeners())
+        return true;
+
     return false;
 }
 
@@ -348,6 +386,9 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
 
 void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
 {
+    // FIXME: This could be changed to only mark wrappers that are "observable"
+    // as markDOMNodesForDocument does, allowing us to collect more wrappers,
+    // but doing this correctly would be challenging.
     if (!object)
         return;
     DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
@@ -559,7 +600,7 @@ Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInf
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
     JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
@@ -571,7 +612,7 @@ Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
     return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(ExecState* exec, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
     return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
 }
@@ -589,4 +630,33 @@ void cacheDOMConstructor(ExecState* exec, const ClassInfo* classInfo, JSObject*
     constructors.set(classInfo, constructor);
 }
 
+JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
+{
+    JSObject* object = value.getObject();
+    if (!object) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+    JSValue lengthValue = object->get(exec, exec->propertyNames().length);
+    if (exec->hadException())
+        return 0;
+
+    if (lengthValue.isUndefinedOrNull()) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+
+    length = lengthValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return object;
+}
+
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index 64cfc3a..9c0ad7e 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -26,7 +26,6 @@
 #include "Document.h" // For DOMConstructorWithDocument
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
-#include <runtime/JSFunction.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -51,17 +50,19 @@ namespace WebCore {
     // Base class for all objects in this binding except Window.
     class DOMObject : public JSC::JSObject {
     protected:
-        explicit DOMObject(PassRefPtr<JSC::Structure> structure) 
+        explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
             : JSObject(structure)
         {
         }
 
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
 #ifndef NDEBUG
         virtual ~DOMObject();
 #endif
     };
 
-    // FIXME: This class should colapse into DOMObject once all DOMObjects are
+    // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
@@ -73,8 +74,13 @@ namespace WebCore {
             return m_globalObject->scriptExecutionContext();
         }
 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        {
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+        }
+
     protected:
-        DOMObjectWithGlobalPointer(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
             , m_globalObject(globalObject)
         {
@@ -83,7 +89,7 @@ namespace WebCore {
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
         }
-        virtual ~DOMObjectWithGlobalPointer() {}
+        virtual ~DOMObjectWithGlobalPointer() { }
 
         void markChildren(JSC::MarkStack& markStack)
         {
@@ -104,7 +110,7 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorObject(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObjectWithGlobalPointer(structure, globalObject)
         {
         }
@@ -120,7 +126,7 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorWithDocument(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorWithDocument(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMConstructorObject(structure, globalObject)
         {
             ASSERT(globalObject->scriptExecutionContext()->isDocument());
@@ -141,9 +147,9 @@ namespace WebCore {
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
@@ -277,6 +283,9 @@ namespace WebCore {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    // Validates that the passed object is a sequence type per section 4.1.13 of the WebIDL spec.
+    JSC::JSObject* toJSSequence(JSC::ExecState*, JSC::JSValue, unsigned&);
+
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
     // Helpers for Window, History, and Location classes to implement cross-domain policy.
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.cpp b/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 68a1db9..372684c 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -40,24 +40,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData()
-    : evt(0)
-{
-}
-
-JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
+JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
     : JSGlobalObject(structure, data, thisValue)
 {
 }
 
-JSDOMGlobalObject::~JSDOMGlobalObject()
-{
-    JSListenersMap::iterator it = d()->jsEventListeners.begin();
-    JSListenersMap::iterator end = d()->jsEventListeners.end();
-    for (; it != end; ++it)
-        it->second->clearGlobalObject();
-}
-
 void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
@@ -71,37 +58,12 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
         markStack.append(it2->second);
 }
 
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return d()->jsEventListeners.get(asObject(val));
-}
-
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
-{
-    if (JSEventListener* listener = findJSEventListener(val))
-        return listener;
-
-    if (!val.isObject())
-        return 0;
-
-    // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, false).get();
-}
-
 PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
     if (!val.isObject())
         return 0;
 
-    return JSEventListener::create(asObject(val), this, true).get();
-}
-
-JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
-{
-    return d()->jsEventListeners;
+    return JSEventListener::create(asObject(val), true).get();
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -114,6 +76,11 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
+{
+    delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
+}
+
 JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
 {
     return toJSDOMWindow(document->frame());
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index 855691c..ce26857 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -45,8 +45,7 @@ namespace WebCore {
     protected:
         struct JSDOMGlobalObjectData;
 
-        JSDOMGlobalObject(PassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
-        virtual ~JSDOMGlobalObject();
+        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
 
     public:
         JSDOMStructureMap& structures() { return d()->structures; }
@@ -54,20 +53,10 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValue);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
-
-        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
-        // These listeners cannot be removed through the removeEventListener API.
+        // Creates a JS EventListener for an "onXXX" event attribute. These
+        // listeners cannot be removed through the removeEventListener API.
         PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
-
-        JSListenersMap& jsEventListeners();
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
@@ -78,17 +67,27 @@ namespace WebCore {
 
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData();
+            JSDOMGlobalObjectData()
+                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
+                , evt(0)
+            {
+            }
+
+            JSDOMGlobalObjectData(Destructor destructor)
+                : JSGlobalObjectData(destructor)
+                , evt(0)
+            {
+            }
 
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::JSListenersMap jsEventListeners;
-
             Event* evt;
         };
 
     private:
+        static void destroyJSDOMGlobalObjectData(void*);
+
         JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index df6068a..a04ef89 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,13 +42,7 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : impl(window)
-    , shell(shell)
-{
-}
-
-JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
     GlobalPropertyInfo staticGlobals[] = {
@@ -113,7 +107,7 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
-#if !ENABLE(JAVASCRIPT_DEBUGGER)
+#if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
     return false;
 #else
     Frame* frame = impl()->frame();
@@ -167,11 +161,19 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
         globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
+#ifndef NDEBUG
+        globalData->mainThreadOnly = true;
+#endif
     }
 
     return globalData;
 }
 
+void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
+{
+    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
+}
+
 // JSDOMGlobalObject* is ignored, accesing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index 84cc81f..52c3c1d 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -43,7 +43,7 @@ namespace WebCore {
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     protected:
-        JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+        JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
         void updateDocument();
@@ -76,7 +76,12 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
+                , impl(window)
+                , shell(shell)
+            {
+            }
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -85,6 +90,8 @@ namespace WebCore {
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
+        static void destroyJSDOMWindowBaseData(void*);
+
         JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 9798972..47339d4 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -38,29 +38,53 @@
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
 #include "JSLocation.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSMessagePortCustom.h"
 #include "JSOptionConstructor.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "JSSharedWorkerConstructor.h"
+#endif
+
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArrayConstructor.h"
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSCanvasIntArrayConstructor.h"
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSCanvasShortArrayConstructor.h"
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSCanvasFloatArrayConstructor.h"
+#endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocketConstructor.h"
+#endif
 #include "JSWorkerConstructor.h"
 #include "JSXMLHttpRequestConstructor.h"
 #include "JSXSLTProcessorConstructor.h"
 #include "Location.h"
 #include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RegisteredEventListener.h"
 #include "ScheduledAction.h"
 #include "ScriptController.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "SharedWorkerRepository.h"
 #include "WindowFeatures.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSObject.h>
 #include <runtime/PrototypeFunction.h>
 
@@ -72,7 +96,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markEventListeners(markStack, impl()->eventListeners());
+    impl()->markEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -271,6 +295,150 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+    
+    const HashEntry* entry;
+    
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            descriptor.setDescriptor(jsBoolean(true), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            PropertySlot slot;
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        descriptor.setUndefined();
+        return true;
+    }
+
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    descriptor.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                PropertySlot slot;
+                slot.setCustom(this, objectToStringFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                return true;
+            }
+        }
+    }
+    
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, childFrameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                descriptor.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, i, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            PropertySlot slot;
+            slot.setCustom(this, namedItemGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!impl()->frame())
@@ -306,6 +474,14 @@ void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyN
     Base::getPropertyNames(exec, propertyNames);
 }
 
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    // Only allow the window to enumerated by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::getOwnPropertyNames(exec, propertyNames);
+}
+
 bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     // Only allow getting property attributes properties by frames in the same origin.
@@ -314,7 +490,7 @@ bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& prope
     return Base::getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -324,15 +500,23 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     if (propertyName == "location")
         return;
 
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
     // Only allow defining setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::defineSetter(exec, propertyName, setterFunction);
+    Base::defineSetter(exec, propertyName, setterFunction, attributes);
+}
+
+bool JSDOMWindow::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    // Only allow defining properties in this way by frames in the same origin, as it allows setters to be introduced.
+    if (!allowsAccessFrom(exec))
+        return false;
+    return Base::defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
 }
 
 JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
@@ -398,16 +582,16 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
@@ -424,6 +608,13 @@ JSValue JSDOMWindow::event(ExecState* exec) const
     return toJS(exec, event);
 }
 
+#if ENABLE(EVENTSOURCE)
+JSValue JSDOMWindow::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSDOMWindow::image(ExecState* exec) const
 {
     return getDOMConstructor<JSImageConstructor>(exec, this);
@@ -453,6 +644,48 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
+#if ENABLE(3D_CANVAS)
+JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+}
+#endif
+ 
 JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -482,7 +715,24 @@ JSValue JSDOMWindow::worker(ExecState* exec) const
 #if ENABLE(SHARED_WORKERS)
 JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 {
-    return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    if (SharedWorkerRepository::isAvailable())
+        return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+JSValue JSDOMWindow::webSocket(ExecState* exec) const
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Settings* settings = frame->settings();
+    if (!settings)
+        return jsUndefined();
+    if (!settings->experimentalWebSocketsEnabled())
+        return jsUndefined();
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
 }
 #endif
 
@@ -521,7 +771,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
 
@@ -529,13 +779,13 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
 
     if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        KURL completedURL = url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(exec, url);
         bool userGesture = processingUserGesture(exec);
 
         if (created)
             newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
     }
 
     return newFrame;
@@ -543,6 +793,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
 
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -555,9 +809,6 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     Page* page = frame->page();
 
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
-
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
     if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
@@ -575,13 +826,13 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
         topOrParent = true;
     }
     if (topOrParent) {
-        if (!shouldAllowNavigation(exec, frame))
-            return jsUndefined();
-
         String completedURL;
         if (!urlString.isEmpty())
             completedURL = completeURL(exec, urlString).string();
 
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
         const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
             bool userGesture = processingUserGesture(exec);
@@ -591,13 +842,12 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
             // here.
             String referrer = dynamicFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
         }
         return toJS(exec, frame->domWindow());
     }
 
     // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
     FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
                          windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
     DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
@@ -617,6 +867,10 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -630,10 +884,6 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
         return jsUndefined();
 
-    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    JSValue dialogArgs = args.at(1);
-    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
-
     HashMap<String, String> features;
     DOMWindow::parseModalDialogFeatures(featureArgs, features);
 
@@ -687,7 +937,15 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
     dialogFrame->page()->chrome()->runModal();
 
-    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
+    Identifier returnValue(exec, "returnValue");
+    if (dialogWindow->allowsAccessFromNoErrorMessage(exec)) {
+        PropertySlot slot;
+        // This is safe, we have already performed the origin security check and we are
+        // not interested in any of the DOM properties of the window.
+        if (dialogWindow->JSGlobalObject::getOwnPropertySlot(exec, returnValue, slot))
+            return slot.getValue(exec, returnValue);
+    }
+    return jsUndefined();
 }
 
 JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
@@ -695,19 +953,23 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     DOMWindow* window = impl();
 
     DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
-    String message = args.at(0).toString(exec);
+    PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
 
     if (exec->hadException())
         return jsUndefined();
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+    MessagePortArray messagePorts;
+    if (args.size() > 2)
+        fillMessagePortArray(exec, args.at(1), messagePorts);
+    if (exec->hadException())
+        return jsUndefined();
 
     String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
     if (exec->hadException())
         return jsUndefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    window->postMessage(message, &messagePorts, targetOrigin, source, ec);
     setDOMException(exec, ec);
 
     return jsUndefined();
@@ -788,9 +1050,11 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -800,9 +1064,11 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(1)))
-        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index efffd42..3c3ff4c 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -88,6 +88,11 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindowShell::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return m_window->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
@@ -98,6 +103,11 @@ void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& prop
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
 
+bool JSDOMWindowShell::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    return m_window->defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
+}
+
 bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->deleteProperty(exec, propertyName);
@@ -108,19 +118,24 @@ void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& prop
     m_window->getPropertyNames(exec, propertyNames);
 }
 
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_window->getOwnPropertyNames(exec, propertyNames);
+}
+
 bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     return m_window->getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    m_window->defineGetter(exec, propertyName, getterFunction);
+    m_window->defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    m_window->defineSetter(exec, propertyName, setterFunction);
+    m_window->defineSetter(exec, propertyName, setterFunction, attributes);
 }
 
 JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 0506283..23af340 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -67,13 +67,16 @@ namespace WebCore {
         virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
-        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
-        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
+        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
+        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
         virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
diff --git a/WebCore/bindings/js/JSDatabaseCustom.cpp b/WebCore/bindings/js/JSDatabaseCustom.cpp
index af3b066..0932cca 100644
--- a/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -52,17 +52,13 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     String oldVersion = args.at(0).toString(exec);
     String newVersion = args.at(1).toString(exec);
 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
     JSObject* object;
     if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
     
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     if (!args.at(3).isNull()) {
@@ -71,24 +67,25 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<VoidCallback> successCallback;
     if (!args.at(4).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(4));
-        if (!successCallback) {
+        if (!(object = args.at(4).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
-    
+
     m_impl->changeVersion(oldVersion, newVersion, callback.release(), errorCallback.release(), successCallback.release());
     
     return jsUndefined();
 }
 
-JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+static JSValue createTransaction(ExecState* exec, const ArgList& args, Database* database, JSDOMGlobalObject* globalObject, bool readOnly)
 {
     JSObject* object;
     
@@ -96,12 +93,8 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
- 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+     
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, globalObject));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
     if (args.size() > 1 && !args.at(1).isNull()) {
@@ -110,22 +103,33 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
 
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, globalObject);
     }
 
     RefPtr<VoidCallback> successCallback;
     if (args.size() > 2 && !args.at(2).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(2));
-        if (!successCallback) {
+        if (!(object = args.at(2).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, globalObject);
     }
     
-    m_impl->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return jsUndefined();
 }
+
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), false);
+}
     
+JSValue JSDatabase::readTransaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), true);
+}
+
 }
+
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp b/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
index 657f9b3..fbee5ef 100644
--- a/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
@@ -35,15 +35,16 @@
 
 #include "JSDedicatedWorkerContext.h"
 
+#include "JSDOMBinding.h"
+#include "JSMessagePortCustom.h"
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDedicatedWorkerContext::markChildren(MarkStack& markStack)
+JSC::JSValue JSDedicatedWorkerContext::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
 {
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, impl()->onmessage());
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
new file mode 100644
index 0000000..493d7bd
--- /dev/null
+++ b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Document.h"
+#include "JSCustomVoidCallback.h"
+#include "JSEventListener.h"
+#include "JSNotification.h"
+#include "JSNotificationCenter.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList& args)
+{
+    // Permission request is only valid from page context.
+    ScriptExecutionContext* context = impl()->context();
+    if (context->isWorkerContext())
+        return throwError(exec, SyntaxError);
+
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError);
+
+    PassRefPtr<JSCustomVoidCallback> callback = JSCustomVoidCallback::create(args.at(0).getObject(), static_cast<Document*>(context)->frame());
+
+    impl()->requestPermission(callback);
+    return jsUndefined();
+}
+
+JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+
+} // namespace
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index 39a1fc5..d7f8725 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -24,6 +24,10 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
@@ -35,6 +39,8 @@
 #include "SVGDocument.h"
 #endif
 
+#include <wtf/GetPtr.h>
+
 using namespace JSC;
 
 namespace WebCore {
@@ -42,8 +48,14 @@ namespace WebCore {
 void JSDocument::markChildren(MarkStack& markStack)
 {
     JSNode::markChildren(markStack);
-    markDOMNodesForDocument(markStack, impl());
-    markActiveObjectsForContext(markStack, *Heap::heap(this)->globalData(), impl());
+
+    Document* document = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMNodesForDocument(markStack, document);
+    markActiveObjectsForContext(markStack, globalData, document);
+    markDOMObjectWrapper(markStack, globalData, document->implementation());
+    markDOMObjectWrapper(markStack, globalData, document->styleSheets());
 }
 
 JSValue JSDocument::location(ExecState* exec) const
@@ -76,7 +88,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* document)
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index 47793d0..fb64ff2 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,15 +51,27 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+void JSElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    Element* element = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, element->attributeMap());
+    if (element->isStyledElement())
+        markDOMObjectWrapper(markStack, globalData, static_cast<StyledElement*>(element)->inlineStyleDecl());
+}
+
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
     if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
-        HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
-        if (!checkNodeSecurity(exec, frame->contentDocument()))
+        Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
-} 
+}
 
 JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index 804c529..c64ddc9 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSMouseEvent.h"
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
+#include "JSPageTransitionEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -51,6 +52,7 @@
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
+#include "PageTransitionEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -120,6 +122,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, OverflowEvent, event);
     else if (event->isMessageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, MessageEvent, event);
+    else if (event->isPageTransitionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PageTransitionEvent, event);
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 42e0281..4f273fe 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -31,22 +31,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
-    : m_jsFunction(function)
-    , m_globalObject(globalObject)
+JSEventListener::JSEventListener(JSObject* function, bool isAttribute)
+    : EventListener(JSEventListenerType)
+    , m_jsFunction(function)
     , m_isAttribute(isAttribute)
 {
-    if (!m_isAttribute && m_jsFunction)
-        globalObject->jsEventListeners().set(m_jsFunction, this);
 }
 
 JSEventListener::~JSEventListener()
 {
-    if (!m_isAttribute && m_jsFunction && m_globalObject)
-        m_globalObject->jsEventListeners().remove(m_jsFunction);
 }
 
-JSObject* JSEventListener::jsFunction() const
+JSObject* JSEventListener::jsFunction(ScriptExecutionContext*) const
 {
     return m_jsFunction;
 }
@@ -55,30 +51,24 @@ void JSEventListener::markJSFunction(MarkStack& markStack)
 {
     if (m_jsFunction)
         markStack.append(m_jsFunction);
-    if (m_globalObject)
-        markStack.append(m_globalObject);
 }
 
-void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
 {
+    ASSERT(scriptExecutionContext);
+    if (!scriptExecutionContext)
+        return;
+
     JSLock lock(SilenceAssertionsOnly);
 
-    JSObject* jsFunction = this->jsFunction();
+    JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = m_globalObject;
-    // Null check as clearGlobalObject() can clear this and we still get called back by
-    // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
-    // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
-    ASSERT(globalObject);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext);
     if (!globalObject)
         return;
 
-    ScriptExecutionContext* scriptExecutionContext = globalObject->scriptExecutionContext();
-    if (!scriptExecutionContext)
-        return;
-
     if (scriptExecutionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
@@ -113,26 +103,14 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         Event* savedEvent = globalObject->currentEvent();
         globalObject->setCurrentEvent(event);
 
-        // If this event handler is the first JavaScript to execute, then the
-        // dynamic global object should be set to the global object of the
-        // window in which the event occurred.
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValue retval;
-        if (handleEventFunction) {
-            globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
-        } else {
-            JSValue thisValue;
-            if (isWindowEvent)
-                thisValue = globalObject->toThisObject(exec);
-            else
-                thisValue = toJS(exec, globalObject, event->currentTarget());
-            globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, jsFunction, callType, callData, thisValue, args);
-        }
-        globalObject->globalData()->timeoutChecker.stop();
+        globalData->timeoutChecker.start();
+        JSValue retval = handleEventFunction
+            ? call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
+        globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
@@ -154,18 +132,15 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
     }
 }
 
-bool JSEventListener::reportError(const String& message, const String& url, int lineNumber)
+bool JSEventListener::reportError(ScriptExecutionContext* context, const String& message, const String& url, int lineNumber)
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    JSObject* jsFunction = this->jsFunction();
+    JSObject* jsFunction = this->jsFunction(context);
     if (!jsFunction)
         return false;
 
-    JSDOMGlobalObject* globalObject = m_globalObject;
-    if (!globalObject)
-        return false;
-
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context);
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -179,17 +154,14 @@ bool JSEventListener::reportError(const String& message, const String& url, int
     args.append(jsString(exec, url));
     args.append(jsNumber(exec, lineNumber));
 
-    // If this event handler is the first JavaScript to execute, then the
-    // dynamic global object should be set to the global object of the
-    // window in which the event occurred.
     JSGlobalData* globalData = globalObject->globalData();
     DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);    
 
     JSValue thisValue = globalObject->toThisObject(exec);
 
-    globalObject->globalData()->timeoutChecker.start();
+    globalData->timeoutChecker.start();
     JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
     if (exec->hadException()) {
@@ -206,4 +178,11 @@ bool JSEventListener::virtualisAttribute() const
     return m_isAttribute;
 }
 
+bool JSEventListener::operator==(const EventListener& listener)
+{
+    if (const JSEventListener* jsEventListener = JSEventListener::cast(&listener))
+        return m_jsFunction == jsEventListener->m_jsFunction && m_isAttribute == jsEventListener->m_isAttribute;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventListener.h b/WebCore/bindings/js/JSEventListener.h
index 7929169..285a9c4 100644
--- a/WebCore/bindings/js/JSEventListener.h
+++ b/WebCore/bindings/js/JSEventListener.h
@@ -30,30 +30,38 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute)
         {
-            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
+            return adoptRef(new JSEventListener(listener, isAttribute));
         }
+
+        static const JSEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const JSEventListener*>(listener)
+                : 0;
+        }
+
         virtual ~JSEventListener();
-        void clearGlobalObject() { m_globalObject = 0; }
+
+        virtual bool operator==(const EventListener& other);
 
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
 
-        virtual JSC::JSObject* jsFunction() const;
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
 
     private:
         virtual void markJSFunction(JSC::MarkStack&);
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual bool reportError(const String& message, const String& url, int lineNumber);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
+        virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
         void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
+        JSEventListener(JSC::JSObject* function, bool isAttribute);
 
         mutable JSC::JSObject* m_jsFunction;
-        JSDOMGlobalObject* m_globalObject;
         bool m_isAttribute;
     };
 
diff --git a/WebCore/bindings/js/JSEventSourceConstructor.cpp b/WebCore/bindings/js/JSEventSourceConstructor.cpp
new file mode 100644
index 0000000..c6e4825
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceConstructor.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSourceConstructor.h"
+
+#include "EventSource.h"
+#include "ExceptionCode.h"
+#include "JSEventSource.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSEventSourceConstructor);
+
+const ClassInfo JSEventSourceConstructor::s_info = { "EventSourceContructor", 0, 0, 0 };
+
+JSEventSourceConstructor::JSEventSourceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSEventSourceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSEventSourcePrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructEventSource(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString url = args.at(0).toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    JSEventSourceConstructor* jsConstructor =  static_cast<JSEventSourceConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "EventSource constructor associated document is unavailable");
+
+    ExceptionCode ec = 0;
+    RefPtr<EventSource> eventSource = EventSource::create(url, context, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
+
+    return asObject(toJS(exec, jsConstructor->globalObject(), eventSource.release()));
+}
+
+ConstructType JSEventSourceConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructEventSource;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/bindings/js/JSEventSourceConstructor.h b/WebCore/bindings/js/JSEventSourceConstructor.h
new file mode 100644
index 0000000..b2f3cb5
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceConstructor.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSEventSourceConstructor_h
+#define JSEventSourceConstructor_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSEventSourceConstructor : public DOMConstructorObject {
+    public:
+        JSEventSourceConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // JSEventSourceConstructor_h
diff --git a/WebCore/bindings/js/JSEventSourceCustom.cpp b/WebCore/bindings/js/JSEventSourceCustom.cpp
new file mode 100644
index 0000000..404bf11
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSource.h"
+
+#include "EventSource.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/bindings/js/JSEventTarget.cpp b/WebCore/bindings/js/JSEventTarget.cpp
index c34e10e..0421d10 100644
--- a/WebCore/bindings/js/JSEventTarget.cpp
+++ b/WebCore/bindings/js/JSEventTarget.cpp
@@ -33,16 +33,29 @@
 #include "JSEventListener.h"
 #include "JSMessagePort.h"
 #include "JSNode.h"
+#if ENABLE(SHARED_WORKERS)
+
 #include "JSSharedWorker.h"
 #include "JSSharedWorkerContext.h"
+#endif
+
 #include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "MessagePort.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "SharedWorker.h"
 #include "SharedWorkerContext.h"
+#endif
+
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestUpload.h"
 
+#if ENABLE(EVENTSOURCE)
+#include "EventSource.h"
+#include "JSEventSource.h"
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 #include "DOMApplicationCache.h"
 #include "JSDOMApplicationCache.h"
@@ -60,6 +73,16 @@
 #include "Worker.h"
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#include "JSNotification.h"
+#include "Notification.h"
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocket.h"
+#include "WebSocket.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -69,6 +92,11 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
     if (!target)
         return jsNull();
     
+#if ENABLE(EVENTSOURCE)
+    if (EventSource* eventSource = target->toEventSource())
+        return toJS(exec, globalObject, eventSource);
+#endif
+
 #if ENABLE(SVG)
     // SVGElementInstance supports both toSVGElementInstance and toNode since so much mouse handling code depends on toNode returning a valid node.
     if (SVGElementInstance* instance = target->toSVGElementInstance())
@@ -111,6 +139,16 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJSDOMGlobalObject(workerContext);
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    if (Notification* notification = target->toNotification())
+        return toJS(exec, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    if (WebSocket* webSocket = target->toWebSocket())
+        return toJS(exec, webSocket);
+#endif
+
     ASSERT_NOT_REACHED();
     return jsNull();
 }
@@ -118,7 +156,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 EventTarget* toEventTarget(JSC::JSValue value)
 {
     #define CONVERT_TO_EVENT_TARGET(type) \
-        if (value.isObject(&JS##type::s_info)) \
+        if (value.inherits(&JS##type::s_info)) \
             return static_cast<JS##type*>(asObject(value))->impl();
 
     CONVERT_TO_EVENT_TARGET(Node)
@@ -126,9 +164,13 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
     CONVERT_TO_EVENT_TARGET(MessagePort)
 
-    if (value.isObject(&JSDOMWindowShell::s_info))
+    if (value.inherits(&JSDOMWindowShell::s_info))
         return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
 
+#if ENABLE(EVENTSOURCE)
+    CONVERT_TO_EVENT_TARGET(EventSource)
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
 #endif
@@ -147,6 +189,14 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(SharedWorkerContext)
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    CONVERT_TO_EVENT_TARGET(Notification)
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    CONVERT_TO_EVENT_TARGET(WebSocket)
+#endif
+
     return 0;
 }
 
diff --git a/WebCore/bindings/js/JSGeolocationCustom.cpp b/WebCore/bindings/js/JSGeolocationCustom.cpp
index 280fd2f..23a4c00 100644
--- a/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -41,34 +41,58 @@ using namespace std;
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
 static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSValue value)
+=======
+static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 {
     // The spec specifies 'FunctionOnly' for this object.
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (!value.isObject(&InternalFunction::info)) {
+=======
+    if (!value.inherits(&InternalFunction::info)) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
 
     JSObject* object = asObject(value);
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
     return JSCustomPositionCallback::create(object, frame);
+=======
+    return JSCustomPositionCallback::create(object, globalObject);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 }
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
 static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSValue value)
+=======
+static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 {
     // Argument is optional (hence undefined is allowed), and null is allowed.
     if (value.isUndefinedOrNull())
         return 0;
 
     // The spec specifies 'FunctionOnly' for this object.
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (!value.isObject(&InternalFunction::info)) {
+=======
+    if (!value.inherits(&InternalFunction::info)) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
 
     JSObject* object = asObject(value);
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
     return JSCustomPositionErrorCallback::create(object, frame);
+=======
+    return JSCustomPositionErrorCallback::create(object, globalObject);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 }
 
 static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
@@ -139,12 +163,20 @@ JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, args.at(0));
+=======
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, args.at(1));
+=======
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
 
@@ -161,12 +193,20 @@ JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, args.at(0));
+=======
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, args.at(1));
+=======
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.h b/WebCore/bindings/js/JSHTMLAllCollection.h
index 7363e5c..e6fe7f5 100644
--- a/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
     class JSHTMLAllCollection : public JSHTMLCollection {
     public:
-        JSHTMLAllCollection(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
+        JSHTMLAllCollection(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
             : JSHTMLCollection(structure, globalObject, collection)
         {
         }
diff --git a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 37561af..30892e0 100644
--- a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
new file mode 100644
index 0000000..8ecd287
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLCanvasElement.h"
+
+#include "HTMLCanvasElement.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd9af74..8ffddf7 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -23,12 +23,13 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "JSDOMBinding.h"
 #include "JSHTMLAllCollection.h"
 #include "JSHTMLOptionsCollection.h"
-#include "JSNamedNodesCollection.h"
 #include "JSNode.h"
+#include "JSNodeList.h"
 #include "Node.h"
-#include "JSDOMBinding.h"
+#include "StaticNodeList.h"
 #include <wtf/Vector.h>
 
 using namespace JSC;
@@ -42,11 +43,13 @@ static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, cons
 
     if (namedItems.isEmpty())
         return jsUndefined();
-
     if (namedItems.size() == 1)
         return toJS(exec, collection->globalObject(), namedItems[0].get());
 
-    return new (exec) JSNamedNodesCollection(exec, collection->globalObject(), namedItems);
+    // FIXME: HTML5 specifies that this should be a DynamicNodeList.
+    // FIXME: HTML5 specifies that non-HTMLOptionsCollection collections should return
+    // the first matching item instead of a NodeList.
+    return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 // HTMLCollections are strange objects, they support both get and call,
diff --git a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2570bc6..bce3ffb 100644
--- a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Ident
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index ffa2d57..de9ec4a 100644
--- a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -30,7 +30,8 @@
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "JSDOMWindowCustom.h"
-#include "JSNamedNodesCollection.h"
+#include "JSNodeList.h"
+#include "StaticNodeList.h"
 
 using namespace JSC;
 
@@ -47,15 +48,17 @@ JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propert
 {
     JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
-    
+
     Vector<RefPtr<Node> > namedItems;
     form->getNamedElements(propertyName, namedItems);
     
+    if (namedItems.isEmpty())
+        return jsUndefined();
     if (namedItems.size() == 1)
         return toJS(exec, namedItems[0].get());
-    if (namedItems.size() > 1) 
-        return new (exec) JSNamedNodesCollection(exec, jsForm->globalObject(), namedItems);
-    return jsUndefined();
+
+    // FIXME: HTML5 specifies that this should be a RadioNodeList.
+    return toJS(exec, jsForm->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index c8aea9f..6e01513 100644
--- a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -32,16 +32,20 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
     if (protocolIsJavaScript(deprecatedParseURL(value))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
@@ -55,8 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
     if (!allowSettingJavascriptURL(exec, imp, srcValue))
         return;
 
-    imp->setSrc(srcValue);
-    return;
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
@@ -68,7 +71,6 @@ void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
         return;
 
     imp->setLocation(locationValue);
-    return;
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 8e32381..60ea45e 100644
--- a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -32,12 +32,15 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
@@ -45,11 +48,12 @@ void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
     String srcValue = valueToStringWithNullCheck(exec, value);
 
     if (protocolIsJavaScript(deprecatedParseURL(srcValue))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return;
     }
 
-    imp->setSrc(srcValue);
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index 6b47622..e5166ee 100644
--- a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "HTMLInputElement.h"
 #include "Settings.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index a99e46c..1bfb51f 100644
--- a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
index a3b15e1..b24b1ff 100644
--- a/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Frame.h"
 #include "History.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -92,6 +93,52 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing History cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, impl()->frame(), message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        // Allow access to back(), forward() and go() from any frame.
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHistoryPrototypeFunctionBack) {
+                slot.setCustom(this, nonCachingStaticBackFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionForward) {
+                slot.setCustom(this, nonCachingStaticForwardFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionGo) {
+                slot.setCustom(this, nonCachingStaticGoFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            PropertySlot slot;
+            slot.setCustom(this, objectToStringFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    printErrorMessageForFrame(impl()->frame(), message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
@@ -108,12 +155,12 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSImageConstructor.cpp b/WebCore/bindings/js/JSImageConstructor.cpp
index faaaf41..0f4a991 100644
--- a/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/WebCore/bindings/js/JSImageConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index fff7aee..ed79427 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectedObjectWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectorCallbackWrapper.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/StdLibExtras.h>
@@ -69,7 +71,7 @@ JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrapp
     return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
 }
 
-JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
 {
     WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
@@ -125,3 +127,5 @@ JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.h b/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 201feb6..ad97035 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -38,7 +38,7 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
     private:
-        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual bool allowsGetProperty() const { return true; }
         virtual bool allowsSetProperty() const { return true; }
diff --git a/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index b2eb2d1..73fa268 100644
--- a/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -33,6 +33,8 @@
 #include "config.h"
 #include "JSInspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Console.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -51,6 +53,10 @@
 #include "JSRange.h"
 #include "Node.h"
 #include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
 #include "TextIterator.h"
 #include "VisiblePosition.h"
 #include <runtime/JSArray.h>
@@ -70,21 +76,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    impl()->highlight(node);
-
+    impl()->highlight(args.at(0).toInt32(exec));
     return jsUndefined();
 }
 
@@ -125,27 +122,20 @@ JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseTableNames(ExecState* exec, const ArgList& args)
+JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
         return jsUndefined();
 
-    Database* database = toDatabase(wrapper->unwrappedObject());
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-
-    MarkedArgumentBuffer result;
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i)
-        result.append(jsString(exec, tableNames[i]));
-
-    return constructArray(exec, result);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
 
@@ -257,7 +247,7 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
@@ -280,4 +270,94 @@ JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
 
 #endif
 
+JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
+}
+
+JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    bool selectInUI = args.at(1).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Storage* storage = toStorage(wrapper->unwrappedObject());
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 0e14109..9c4330d 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectorCallbackWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectedObjectWrapper.h"
 #include <wtf/StdLibExtras.h>
 
@@ -73,10 +75,10 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, asObject(wrap(unwrappedExec, prototype))->inheritorID());
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
 }
 
-JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
 {
     ASSERT(!wrappers().contains(unwrappedObject));
@@ -105,3 +107,5 @@ JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExe
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index cfc2fb6..be28063 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -40,7 +40,7 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
     protected:
-        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual bool allowsCallAsFunction() const { return true; }
 
diff --git a/WebCore/bindings/js/JSLazyEventListener.cpp b/WebCore/bindings/js/JSLazyEventListener.cpp
index 7caff2b..0d6cb57 100644
--- a/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -23,6 +23,7 @@
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -34,12 +35,13 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSEventListener(0, globalObject, true)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
+    : JSEventListener(0, true)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
     , m_parsed(false)
+    , m_sourceURL(sourceURL)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
 {
@@ -66,23 +68,43 @@ JSLazyEventListener::~JSLazyEventListener()
 #endif
 }
 
-JSObject* JSLazyEventListener::jsFunction() const
+JSObject* JSLazyEventListener::jsFunction(ScriptExecutionContext* executionContext) const
 {
-    parseCode();
+    parseCode(executionContext);
     return m_jsFunction;
 }
 
-void JSLazyEventListener::parseCode() const
+void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) const
 {
+    ASSERT(executionContext);
+    ASSERT(executionContext->isDocument());
+    if (!executionContext)
+        return;
+
     if (m_parsed)
         return;
 
-    ScriptExecutionContext* executionContext = m_globalObject->scriptExecutionContext();
-    ASSERT(executionContext);
-    if (!executionContext)
+    Frame* frame = static_cast<Document*>(executionContext)->frame();
+    if (!frame)
         return;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return;
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext);
+    if (!globalObject)
+        return;
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    if (m_originalNode) {
+        JSLock lock(SilenceAssertionsOnly);
+        // FIXME: Should pass the global object associated with the node
+        toJS(globalObject->globalExec(), globalObject, m_originalNode);
+    }
+
     if (executionContext->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
             return;
@@ -94,16 +116,13 @@ void JSLazyEventListener::parseCode() const
 
     m_parsed = true;
 
-    ExecState* exec = m_globalObject->globalExec();
+    ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
-    UString sourceURL(executionContext->url().string());
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
-    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
-    // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
 
     JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
 
@@ -117,7 +136,7 @@ void JSLazyEventListener::parseCode() const
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
 
-        JSValue thisObj = toJS(exec, m_globalObject, m_originalNode);
+        JSValue thisObj = toJS(exec, globalObject, m_originalNode);
         if (thisObj.isObject()) {
             static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
             listenerAsFunction->setScope(scope);
@@ -128,6 +147,7 @@ void JSLazyEventListener::parseCode() const
     m_functionName = String();
     m_code = String();
     m_eventParameterName = String();
+    m_sourceURL = String();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSLazyEventListener.h b/WebCore/bindings/js/JSLazyEventListener.h
index a5304cf..e3137b8 100644
--- a/WebCore/bindings/js/JSLazyEventListener.h
+++ b/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,24 +29,25 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber);
 
-        virtual JSC::JSObject* jsFunction() const;
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        void parseCode() const;
+        void parseCode(ScriptExecutionContext*) const;
 
         mutable String m_functionName;
         mutable String m_eventParameterName;
         mutable String m_code;
         mutable bool m_parsed;
+        mutable String m_sourceURL;
         int m_lineNumber;
         Node* m_originalNode;
     };
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index d7d32f4..c76a2b1 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include "Location.h"
 #include "ScriptController.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -93,6 +94,51 @@ bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& p
     return true;
 }
 
+bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    Frame* frame = impl()->frame();
+    if (!frame) {
+        descriptor.setUndefined();
+        return true;
+    }
+    
+    // When accessing Location cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, frame, message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    PropertySlot slot;
+    if (entry && (entry->attributes() & Function)) {
+        if (entry->function() == jsLocationPrototypeFunctionReplace) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionReload) {
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
+            slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
+    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
+    // such cases when normally the string form of Location would be the URL.
+    
+    printErrorMessageForFrame(frame, message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
@@ -128,19 +174,19 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
-void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
@@ -150,7 +196,7 @@ static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bo
         return;
 
     if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
-        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
 }
 
 void JSLocation::setHref(ExecState* exec, JSValue value)
@@ -158,13 +204,13 @@ void JSLocation::setHref(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
@@ -262,13 +308,13 @@ JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
@@ -280,7 +326,7 @@ JSValue JSLocation::reload(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
@@ -290,13 +336,13 @@ JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     // We want a new history item if this JS was called via a user gesture
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
@@ -316,11 +362,11 @@ bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propert
     return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
 }
 
-void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 25a5cb2..9721ba3 100644
--- a/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -30,6 +30,7 @@
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
 #include "MessageChannel.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSMessageEventCustom.cpp b/WebCore/bindings/js/JSMessageEventCustom.cpp
new file mode 100644
index 0000000..2e7b2d0
--- /dev/null
+++ b/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSMessageEvent.h"
+
+#include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "JSEventTarget.h"
+#include "JSMessagePortCustom.h"
+#include "MessageEvent.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSMessageEvent::ports(ExecState* exec) const
+{
+    MessagePortArray* ports = static_cast<MessageEvent*>(impl())->ports();
+    if (!ports || ports->isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    for (size_t i = 0; i < ports->size(); i++)
+        list.append(toJS(exec, globalObject(), (*ports)[i].get()));
+    return constructArray(exec, list);
+}
+
+JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, args.at(3));
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    OwnPtr<MessagePortArray> messagePorts;
+    if (!args.at(7).isUndefinedOrNull()) {
+        messagePorts = new MessagePortArray();
+        fillMessagePortArray(exec, args.at(7), *messagePorts);
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    MessageEvent* event = static_cast<MessageEvent*>(this->impl());
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePorts.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.cpp
index c3316c5..210c93e 100644
--- a/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -28,11 +28,14 @@
 
 #include "AtomicString.h"
 #include "Event.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSMessagePortCustom.h"
 #include "MessagePort.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -42,8 +45,6 @@ void JSMessagePort::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markIfNotNull(markStack, m_impl->onmessage());
-
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
@@ -51,13 +52,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    typedef MessagePort::EventListenersMap EventListenersMap;
-    typedef MessagePort::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
@@ -65,10 +60,12 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -77,11 +74,54 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSC::JSValue JSMessagePort::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
+}
+
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+{
+    // Convert from the passed-in JS array-like object to a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    if (value.isUndefinedOrNull()) {
+        portArray.resize(0);
+        return;
+    }
+
+    // Validation of sequence types, per WebIDL spec 4.1.13.
+    unsigned length;
+    JSObject* object = toJSSequence(exec, value, length);
+    if (exec->hadException())
+        return;
+
+    portArray.resize(length);
+    for (unsigned i = 0 ; i < length; ++i) {
+        JSValue value = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (value.isUndefinedOrNull()) {
+            setDOMException(exec, INVALID_STATE_ERR);
+            return;
+        }
+
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        RefPtr<MessagePort> port = toMessagePort(value);
+        if (!port) {
+            throwError(exec, TypeError);
+            return;
+        }
+        portArray[i] = port.release();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.h
index dca3536..17b1eae 100644
--- a/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSMessagePortCustom.h
@@ -28,23 +28,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef JSMessagePortCustom_h
+#define JSMessagePortCustom_h
 
-#if ENABLE(SHARED_WORKERS)
+#include "MessagePort.h"
+#include <runtime/JSValue.h>
 
-#include "JSSharedWorkerContext.h"
+namespace WebCore {
 
-using namespace JSC;
+    typedef int ExceptionCode;
 
-namespace WebCore {
+    class String;
 
-void JSSharedWorkerContext::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    // May generate an exception via the passed ExecState.
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
 
-    markIfNotNull(markStack, impl()->onconnect());
-}
+    // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
+    template <typename T>
+    inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
+    {
+        PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
+        MessagePortArray portArray;
+        fillMessagePortArray(exec, args.at(1), portArray);
+        if (exec->hadException())
+            return JSC::jsUndefined();
 
-} // namespace WebCore
+        ExceptionCode ec = 0;
+        impl->postMessage(message, &portArray, ec);
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
 
-#endif // ENABLE(SHARED_WORKERS)
+}
+#endif // JSMessagePortCustom_h
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 7bd95b4..1974ab0 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,9 @@
 #include "JSNamedNodeMap.h"
 
 #include "JSNode.h"
+
+#include "Element.h"
 #include "NamedNodeMap.h"
-#include "Node.h"
-#include "PlatformString.h"
-#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -47,4 +46,16 @@ JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyNa
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
+void JSNamedNodeMap::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->element()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.cpp b/WebCore/bindings/js/JSNamedNodesCollection.cpp
deleted file mode 100644
index f36a7d6..0000000
--- a/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSNamedNodesCollection.h"
-
-#include "AtomicString.h"
-#include "Element.h"
-#include "JSNode.h"
-#include "NamedNodeMap.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
-
-const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
-
-// Such a collection is usually very short-lived, it only exists
-// for constructs like document.forms.<name>[1],
-// so it shouldn't be a problem that it's storing all the nodes (with the same name). (David)
-JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<RefPtr<Node> >& nodes)
-    : DOMObjectWithGlobalPointer(getDOMStructure<JSNamedNodesCollection>(exec, globalObject), globalObject)
-    , m_nodes(new Vector<RefPtr<Node> >(nodes))
-{
-}
-
-JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return jsNumber(exec, thisObj->m_nodes->size());
-}
-
-JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
-}
-
-bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
-        return true;
-    }
-
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok);
-    if (ok && index < m_nodes->size()) {
-        slot.setCustomIndex(this, index, indexGetter);
-        return true;
-    }
-
-    // For IE compatibility, we need to be able to look up elements in a
-    // document.formName.name result by id as well as be index.
-
-    AtomicString atomicPropertyName = propertyName;
-    for (unsigned i = 0; i < m_nodes->size(); i++) {
-        Node* node = (*m_nodes)[i].get();
-        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
-            slot.setCustomIndex(this, i, indexGetter);
-            return true;
-        }
-    }
-
-    return DOMObjectWithGlobalPointer::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index cf884b9..52f21e7 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -110,25 +110,37 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->document());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+        
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->document());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -138,10 +150,10 @@ void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
 
 void JSNode::markChildren(MarkStack& markStack)
 {
-    Node* node = m_impl.get();
-
     Base::markChildren(markStack);
-    markEventListeners(markStack, node->eventListeners());
+
+    Node* node = m_impl.get();
+    node->markEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
diff --git a/WebCore/bindings/js/JSNodeFilterCustom.cpp b/WebCore/bindings/js/JSNodeFilterCustom.cpp
index 09fd110..2a99a93 100644
--- a/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -48,7 +48,7 @@ JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 
 PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value.isObject(&JSNodeFilter::s_info))
+    if (value.inherits(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/WebCore/bindings/js/JSOptionConstructor.cpp b/WebCore/bindings/js/JSOptionConstructor.cpp
index 2b8bd5d..7da0666 100644
--- a/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.cpp b/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 56b0eca..ada2a77 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -86,6 +86,22 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    if (!runtimeObject)
+        return false;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    PropertySlot slot;
+    slot.setCustom(element, runtimeObjectPropertyGetter);
+    // While we don't know what the plugin allows, we do know that we prevent
+    // enumeration or deletion of properties, so we mark plugin properties
+    // as DontEnum | DontDelete
+    descriptor.setDescriptor(slot.getValue(exec, propertyName), DontEnum | DontDelete);
+    return true;
+}
+
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.h b/WebCore/bindings/js/JSPluginElementFunctions.h
index 8c9dfa7..a5a323a 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -33,6 +33,7 @@ namespace WebCore {
     JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 5f4dfd4..a0551a1 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -56,7 +56,7 @@ JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifi
     return v;
 }
 
-JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
     , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
     , m_unwrappedObject(unwrappedObject)
@@ -138,6 +138,26 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
+bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
+{
+    if (!allowsGetProperty()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    PropertyDescriptor unwrappedDescriptor;
+    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
+
+    if (unwrappedDescriptor.isAccessorDescriptor()) {
+        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
+                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
+                                         unwrappedDescriptor.attributes());
+    } else
+        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
@@ -158,6 +178,33 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSVal
     transferExceptionToExecState(exec);
 }
 
+bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    if (!allowsSetProperty())
+        return false;
+
+    PropertyDescriptor wrappedDescriptor;
+    if (descriptor.isDataDescriptor()) {
+        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
+        if (wrappedDescriptor.writablePresent())
+            wrappedDescriptor.setWritable(descriptor.writable());
+    } else if (descriptor.isAccessorDescriptor()) {
+        if (descriptor.getter())
+            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
+        if (descriptor.setter())
+            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
+    }
+    if (wrappedDescriptor.enumerablePresent())
+        wrappedDescriptor.setEnumerable(descriptor.enumerable());
+    if (wrappedDescriptor.configurablePresent())
+        wrappedDescriptor.setConfigurable(descriptor.configurable());
+    
+    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
+    
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
     if (!allowsDeleteProperty())
@@ -270,8 +317,16 @@ void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray&
 {
     if (!allowsGetPropertyNames())
         return;
-
+    
     m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
 }
 
+void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
+{
+    if (!allowsGetPropertyNames())
+        return;
+
+    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 08935e7..94a92bd 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -51,16 +51,18 @@ namespace WebCore {
         }
 
     protected:
-        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual void markChildren(JSC::MarkStack&);
 
     private:
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -69,8 +71,9 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
         virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-
+        
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual JSC::UString className() const { return m_unwrappedObject->className(); }
 
diff --git a/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index dbe8e3c..e022401 100644
--- a/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -95,8 +95,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            callback = JSCustomSQLStatementCallback::create(object, frame);
+        callback = JSCustomSQLStatementCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
@@ -107,8 +106,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            errorCallback = JSCustomSQLStatementErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLStatementErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     ExceptionCode ec = 0;
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 6e77f9b..571e302 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -54,9 +54,11 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -66,9 +68,11 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
index e2f1136..c05b3d2 100644
--- a/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSSharedWorker.h"
 #include "SharedWorker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -56,11 +57,14 @@ static JSObject* constructSharedWorker(ExecState* exec, JSObject* constructor, c
 {
     JSSharedWorkerConstructor* jsConstructor = static_cast<JSSharedWorkerConstructor*>(constructor);
 
-    if (args.size() < 2)
+    if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     UString scriptURL = args.at(0).toString(exec);
-    UString name = args.at(1).toString(exec);
+    UString name;
+    if (args.size() > 1)
+        name = args.at(1).toString(exec);
+
     if (exec->hadException())
         return 0;
 
diff --git a/WebCore/bindings/js/JSStorageCustom.cpp b/WebCore/bindings/js/JSStorageCustom.cpp
index 07cf2f8..e416d35 100644
--- a/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/WebCore/bindings/js/JSStorageCustom.cpp
@@ -64,13 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 43249dc..d711b6f 100644
--- a/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -56,12 +56,19 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
+    StyleSheet* sheet = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = sheet->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, sheet->item(i));
+
     // This prevents us from having a style sheet with a dangling ownerNode pointer.
     // A better solution would be to handle this on the DOM side -- if the style sheet
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = impl()->ownerNode()) {
+    if (Node* ownerNode = sheet->ownerNode()) {
         if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
             markStack.append(ownerNodeWrapper);
     }
diff --git a/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 1da6418..7bf9389 100644
--- a/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
+void JSStyleSheetList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    StyleSheetList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
 bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
 {
     return styleSheetList->getNamedItem(propertyName);
diff --git a/WebCore/bindings/js/JSWebSocketConstructor.cpp b/WebCore/bindings/js/JSWebSocketConstructor.cpp
index ca2e104..5b34765 100644
--- a/WebCore/bindings/js/JSWebSocketConstructor.cpp
+++ b/WebCore/bindings/js/JSWebSocketConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSWebSocket.h"
 #include "ScriptExecutionContext.h"
 #include "WebSocket.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index 3aa4b8b..d305502 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,19 +38,12 @@
 #include "KURL.h"
 #include "WebSocket.h"
 #include "NotImplemented.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSWebSocket::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-    if (m_impl->readyState() != WebSocket::CLOSED)
-        markIfNotNull(markStack, m_impl->onmessage());
-    // FIXME: mark if EventListeners is registered.
-}
-
 // Custom functions
 JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
 {
diff --git a/WebCore/bindings/js/JSWorkerConstructor.cpp b/WebCore/bindings/js/JSWorkerConstructor.cpp
index 9943cfb..69c05e7 100644
--- a/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSWorker.h"
 #include "Worker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSWorkerContextBase.cpp b/WebCore/bindings/js/JSWorkerContextBase.cpp
index 1e4df42..741a269 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
-JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
+JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
     , m_impl(impl)
 {
diff --git a/WebCore/bindings/js/JSWorkerContextBase.h b/WebCore/bindings/js/JSWorkerContextBase.h
index a9a6e63..45238f1 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/WebCore/bindings/js/JSWorkerContextBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class JSWorkerContextBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     public:
-        JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
+        JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
diff --git a/WebCore/bindings/js/JSWorkerContextCustom.cpp b/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 919c81f..e1c8a8c 100644
--- a/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -43,6 +43,10 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
+#if ENABLE(EVENTSOURCE)
+#include "JSEventSourceConstructor.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -58,15 +62,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    markIfNotNull(markStack, impl()->onerror());
-
-    typedef WorkerContext::EventListenersMap EventListenersMap;
-    typedef WorkerContext::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = impl()->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    impl()->markEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -77,6 +73,21 @@ bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifi
     return false;
 }
 
+bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    return false;
+}
+
+#if ENABLE(EVENTSOURCE)
+JSValue JSWorkerContext::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -107,19 +118,21 @@ JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSEventListener* listener = findJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSWorkerCustom.cpp b/WebCore/bindings/js/JSWorkerCustom.cpp
index f5c394b..09b881a 100644
--- a/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -30,17 +30,16 @@
 #include "JSWorker.h"
 
 #include "JSDOMGlobalObject.h"
+#include "JSMessagePortCustom.h"
 #include "Worker.h"
 
 using namespace JSC;
 
 namespace WebCore {
-    
-void JSWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
 
-    markIfNotNull(markStack, static_cast<Worker*>(impl())->onmessage());
+JSC::JSValue JSWorker::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index a644c9e..91fff9a 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -23,6 +23,7 @@
 #include "JSXMLHttpRequest.h"
 #include "ScriptExecutionContext.h"
 #include "XMLHttpRequest.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index a591fae..4b44db2 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -59,20 +59,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onreadystatechange());
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequest::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequest::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 // Custom functions
@@ -123,9 +110,9 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
         JSValue val = args.at(0);
         if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val.isObject(&JSDocument::s_info))
+        else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.isObject(&JSFile::s_info))
+        else if (val.inherits(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
             impl()->send(val.toString(exec), ec);
@@ -168,10 +155,12 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -180,10 +169,12 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index cb6d5f2..dab0a3e 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -51,19 +51,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
@@ -71,10 +59,12 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -83,10 +73,12 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index 01e53a6..441bbc9 100644
--- a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -49,7 +49,7 @@ namespace WebCore {
 JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -62,7 +62,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 {
     JSValue nodeVal = args.at(0);
     JSValue docVal = args.at(1);
-    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info) && docVal.inherits(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -74,7 +74,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 8852611..77b8ca4 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -86,7 +86,7 @@ void ScriptCachedFrameData::clear()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_window) {
+    if (m_window) {
         m_window = 0;
         gcController().garbageCollectSoon();
     }
diff --git a/WebCore/bindings/js/ScriptCallFrame.cpp b/WebCore/bindings/js/ScriptCallFrame.cpp
index 58168d0..09752d1 100644
--- a/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index 8908155..6de9b75 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -33,6 +33,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -84,12 +85,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
     
-    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
-        // This JavaScript URL is not safe to be evaluated.
-        return JSValue();
-    }
-    
-    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
     }
@@ -130,6 +126,14 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
+void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+{
+    // FIXME: Actually support isolated worlds!
+    unsigned size = sourceCode.size();
+    for (unsigned i = 0; i < size; ++i)
+        evaluate(sourceCode[i]);
+}
+
 void ScriptController::clearWindowShell()
 {
     if (!m_windowShell)
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 4528495..56e8f0c 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -81,6 +81,7 @@ public:
     }
 
     ScriptValue evaluate(const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/WebCore/bindings/js/ScriptControllerHaiku.cpp b/WebCore/bindings/js/ScriptControllerHaiku.cpp
index b573b97..3fe471d 100644
--- a/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -28,8 +28,8 @@
 #include "ScriptController.h"
 
 #include "PluginView.h"
-#include "runtime_root.h"
 #include "runtime.h"
+#include "runtime_root.h"
 
 
 namespace WebCore {
diff --git a/WebCore/bindings/js/ScriptEventListener.cpp b/WebCore/bindings/js/ScriptEventListener.cpp
index 878c535..0b0047b 100644
--- a/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/WebCore/bindings/js/ScriptEventListener.cpp
@@ -33,12 +33,11 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "EventListener.h"
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
 
-#include <runtime/JSLock.h>
-
 using namespace JSC;
 
 namespace WebCore {
@@ -54,29 +53,25 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 {
     ASSERT(node);
 
-    Frame* frame = node->document()->frame();
-    if (!frame)
-        return 0;
-
-    ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
-        return 0;
-
-    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
-    }
+    int lineNumber = 1;
+    String sourceURL;
     
-    JSDOMWindow* globalObject = scriptController->globalObject();
-
-    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        // FIXME: Should pass the global object associated with the node
-        toJS(globalObject->globalExec(), globalObject, node);
+    // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
+    if (Frame* frame = node->document()->frame()) {
+        ScriptController* scriptController = frame->script();
+        if (!scriptController->isEnabled())
+            return 0;
+
+        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+            // This script is not safe to execute.
+            return 0;
+        }
+
+        lineNumber = scriptController->eventHandlerLineNumber();
+        sourceURL = node->document()->url().string();
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber);
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -84,19 +79,29 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    int lineNumber = 1;
+    String sourceURL;
+    
     ScriptController* scriptController = frame->script();
     if (!scriptController->isEnabled())
         return 0;
-    
+
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
         // This script is not safe to execute.
         return 0;
     }
 
-    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
-    JSDOMWindow* globalObject = scriptController->globalObject();
+    lineNumber = scriptController->eventHandlerLineNumber();
+    sourceURL = frame->document()->url().string();
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber);
+}
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
+{
+    JSC::JSObject* functionObject = eventListener->jsFunction(context);
+    if (!functionObject)
+        return "";
+    return functionObject->toString(scriptState);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptEventListener.h b/WebCore/bindings/js/ScriptEventListener.h
index 8299d29..3396541 100644
--- a/WebCore/bindings/js/ScriptEventListener.h
+++ b/WebCore/bindings/js/ScriptEventListener.h
@@ -32,17 +32,20 @@
 #define ScriptEventListener_h
 
 #include "JSLazyEventListener.h"
+#include "ScriptState.h"
 
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
     class Attribute;
+    class EventListener;
     class Frame;
     class Node;
 
     PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
     PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState*, EventListener*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index beadc4a..aaf4163 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -106,6 +106,14 @@ bool ScriptObject::set(const char* name, int value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -127,7 +135,11 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return handleException(scriptState);
 }
 
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+=======
+#if ENABLE(INSPECTOR)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/ScriptObject.cpp
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -135,7 +147,11 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
 #endif
+=======
+#endif // ENABLE(INSPECTOR)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/ScriptObject.cpp
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
diff --git a/WebCore/bindings/js/ScriptObject.h b/WebCore/bindings/js/ScriptObject.h
index 50b63ad..31381f3 100644
--- a/WebCore/bindings/js/ScriptObject.h
+++ b/WebCore/bindings/js/ScriptObject.h
@@ -52,6 +52,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -63,7 +64,9 @@ namespace WebCore {
     class ScriptGlobalObject {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
+#if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+#endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 89553ef..b48556e 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScriptObjectQuarantine.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Document.h"
 #include "Frame.h"
 #include "JSDOMBinding.h"
@@ -38,6 +40,7 @@
 #include "JSNode.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include <runtime/JSLock.h>
 
@@ -80,10 +83,11 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
 #endif
 
 #if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
     JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
     ExecState* exec = globalObject->globalExec();
@@ -123,3 +127,5 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
 
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.h b/WebCore/bindings/js/ScriptObjectQuarantine.h
index d70acd7..df52379 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -49,7 +48,7 @@ namespace WebCore {
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
 #endif
 #if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
 #endif
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
diff --git a/WebCore/bindings/js/ScriptValue.cpp b/WebCore/bindings/js/ScriptValue.cpp
index d427cee..6eac102 100644
--- a/WebCore/bindings/js/ScriptValue.cpp
+++ b/WebCore/bindings/js/ScriptValue.cpp
@@ -74,4 +74,11 @@ bool ScriptValue::isUndefined() const
     return m_value.get().isUndefined();
 }
 
+bool ScriptValue::isObject() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isObject();
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptValue.h b/WebCore/bindings/js/ScriptValue.h
index 209ce06..19bb693 100644
--- a/WebCore/bindings/js/ScriptValue.h
+++ b/WebCore/bindings/js/ScriptValue.h
@@ -50,6 +50,7 @@ public:
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
diff --git a/WebCore/bindings/js/SerializedScriptValue.cpp b/WebCore/bindings/js/SerializedScriptValue.cpp
new file mode 100644
index 0000000..48cd92d
--- /dev/null
+++ b/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -0,0 +1,839 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "SerializedScriptValue.h"
+
+#include <runtime/DateInstance.h>
+#include <runtime/ExceptionHelpers.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/HashTraits.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+class SerializedObject : public SharedSerializedData
+{
+public:
+    typedef Vector<RefPtr<StringImpl> > PropertyNameList;
+    typedef Vector<SerializedScriptValueData> ValueList;
+
+    void set(const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        ASSERT(m_names.size() == m_values.size());
+        m_names.append(String(propertyName.ustring()).crossThreadString().impl());
+        m_values.append(value);
+    }
+
+    PropertyNameList& names() { return m_names; }
+
+    ValueList& values() { return m_values; }
+
+    static PassRefPtr<SerializedObject> create()
+    {
+        return adoptRef(new SerializedObject);
+    }
+
+    void clear()
+    {
+        m_names.clear();
+        m_values.clear();
+    }
+
+private:
+    SerializedObject() { }
+    PropertyNameList m_names;
+    ValueList m_values;
+};
+
+class SerializedArray : public SharedSerializedData
+{
+    typedef HashMap<unsigned, SerializedScriptValueData, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned> > SparseMap;
+public:
+    void setIndex(unsigned index, const SerializedScriptValueData& value)
+    {
+        ASSERT(index < m_length);
+        if (index == m_compactStorage.size())
+            m_compactStorage.append(value);
+        else
+            m_sparseStorage.set(index, value);
+    }
+
+    bool canDoFastRead(unsigned index) const
+    {
+        ASSERT(index < m_length);
+        return index < m_compactStorage.size();
+    }
+
+    const SerializedScriptValueData& getIndex(unsigned index)
+    {
+        ASSERT(index < m_compactStorage.size());
+        return m_compactStorage[index];
+    }
+
+    SerializedScriptValueData getSparseIndex(unsigned index, bool& hasIndex)
+    {
+        ASSERT(index >= m_compactStorage.size());
+        ASSERT(index < m_length);
+        SparseMap::iterator iter = m_sparseStorage.find(index);
+        if (iter == m_sparseStorage.end()) {
+            hasIndex = false;
+            return SerializedScriptValueData();
+        }
+        hasIndex = true;
+        return iter->second;
+    }
+
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    static PassRefPtr<SerializedArray> create(unsigned length)
+    {
+        return adoptRef(new SerializedArray(length));
+    }
+
+    void clear()
+    {
+        m_compactStorage.clear();
+        m_sparseStorage.clear();
+        m_length = 0;
+    }
+private:
+    SerializedArray(unsigned length)
+        : m_length(length)
+    {
+    }
+
+    Vector<SerializedScriptValueData> m_compactStorage;
+    SparseMap m_sparseStorage;
+    unsigned m_length;
+};
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
+    : m_type(ObjectType)
+    , m_sharedData(data)
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> data)
+    : m_type(ArrayType)
+    , m_sharedData(data)
+{
+}
+
+SerializedArray* SharedSerializedData::asArray()
+{
+    return static_cast<SerializedArray*>(this);
+}
+
+SerializedObject* SharedSerializedData::asObject()
+{
+    return static_cast<SerializedObject*>(this);
+}
+
+static const unsigned maximumFilterRecursion = 40000;
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
+    ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+template <typename TreeWalker> typename TreeWalker::OutputType walk(TreeWalker& context, typename TreeWalker::InputType in)
+{
+    typedef typename TreeWalker::InputObject InputObject;
+    typedef typename TreeWalker::InputArray InputArray;
+    typedef typename TreeWalker::OutputObject OutputObject;
+    typedef typename TreeWalker::OutputArray OutputArray;
+    typedef typename TreeWalker::InputType InputType;
+    typedef typename TreeWalker::OutputType OutputType;
+    typedef typename TreeWalker::PropertyList PropertyList;
+
+    Vector<uint32_t, 16> indexStack;
+    Vector<uint32_t, 16> lengthStack;
+    Vector<PropertyList, 16> propertyStack;
+    Vector<InputObject, 16> inputObjectStack;
+    Vector<InputArray, 16> inputArrayStack;
+    Vector<OutputObject, 16> outputObjectStack;
+    Vector<OutputArray, 16> outputArrayStack;
+    Vector<WalkerState, 16> stateStack;
+    WalkerState state = StateUnknown;
+    InputType inValue = in;
+    OutputType outValue = context.null();
+
+    unsigned tickCount = context.ticksUntilNextCheck();
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(context.isArray(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+
+                InputArray inArray = context.asInputArray(inValue);
+                unsigned length = context.length(inArray);
+                OutputArray outArray = context.createOutputArray(length);
+                if (!context.startArray(inArray, outArray))
+                    return context.null();
+                inputArrayStack.append(inArray);
+                outputArrayStack.append(outArray);
+                indexStack.append(0);
+                lengthStack.append(length);
+                // fallthrough
+            }
+            arrayStartVisitMember:
+            case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputArray array = inputArrayStack.last();
+                uint32_t index = indexStack.last();
+                if (index == lengthStack.last()) {
+                    InputArray inArray = inputArrayStack.last();
+                    OutputArray outArray = outputArrayStack.last();
+                    context.endArray(inArray, outArray);
+                    outValue = outArray;
+                    inputArrayStack.removeLast();
+                    outputArrayStack.removeLast();
+                    indexStack.removeLast();
+                    lengthStack.removeLast();
+                    break;
+                }
+                if (context.canDoFastRead(array, index))
+                    inValue = context.getIndex(array, index);
+                else {
+                    bool hasIndex = false;
+                    inValue = context.getSparseIndex(array, index, hasIndex);
+                    if (!hasIndex) {
+                        indexStack.last()++;
+                        goto arrayStartVisitMember;
+                    }
+                }
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ArrayEndVisitMember: {
+                OutputArray outArray = outputArrayStack.last();
+                context.putProperty(outArray, indexStack.last(), outValue);
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(context.isObject(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+                InputObject inObject = context.asInputObject(inValue);
+                OutputObject outObject = context.createOutputObject();
+                if (!context.startObject(inObject, outObject))
+                    return context.null();
+                inputObjectStack.append(inObject);
+                outputObjectStack.append(outObject);
+                indexStack.append(0);
+                context.getPropertyNames(inObject, propertyStack);
+                // fallthrough
+            }
+            objectStartVisitMember:
+            case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputObject object = inputObjectStack.last();
+                uint32_t index = indexStack.last();
+                PropertyList& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    InputObject inObject = inputObjectStack.last();
+                    OutputObject outObject = outputObjectStack.last();
+                    context.endObject(inObject, outObject);
+                    outValue = outObject;
+                    inputObjectStack.removeLast();
+                    outputObjectStack.removeLast();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                inValue = context.getProperty(object, properties[index], index);
+
+                if (context.shouldTerminate())
+                    return context.null();
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ObjectEndVisitMember: {
+                context.putProperty(outputObjectStack.last(), propertyStack.last()[indexStack.last()], outValue);
+                if (context.shouldTerminate())
+                    return context.null();
+
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (OutputType transformed = context.convertIfTerminal(inValue)) {
+                    outValue = transformed;
+                    break;
+                }
+                if (context.isArray(inValue))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+
+        state = stateStack.last();
+        stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (context.didTimeOut()) {
+                context.throwInterruptedException();
+                return context.null();
+            }
+            tickCount = context.ticksUntilNextCheck();
+        }
+    }
+    return outValue;
+}
+
+struct BaseWalker {
+    BaseWalker(ExecState* exec)
+        : m_exec(exec)
+        , m_timeoutChecker(exec->globalData().timeoutChecker)
+    {
+        m_timeoutChecker.reset();
+    }
+    ExecState* m_exec;
+    TimeoutChecker m_timeoutChecker;
+    MarkedArgumentBuffer m_gcBuffer;
+
+    bool shouldTerminate()
+    {
+        return m_exec->hadException();
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return m_timeoutChecker.ticksUntilNextCheck();
+    }
+
+    bool didTimeOut()
+    {
+        return m_timeoutChecker.didTimeOut(m_exec);
+    }
+
+    void throwStackOverflow()
+    {
+        m_exec->setException(createStackOverflowError(m_exec));
+    }
+
+    void throwInterruptedException()
+    {
+        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+    }
+};
+
+struct SerializingTreeWalker : public BaseWalker {
+    typedef JSValue InputType;
+    typedef JSArray* InputArray;
+    typedef JSObject* InputObject;
+    typedef SerializedScriptValueData OutputType;
+    typedef RefPtr<SerializedArray> OutputArray;
+    typedef RefPtr<SerializedObject> OutputObject;
+    typedef PropertyNameArray PropertyList;
+
+    SerializingTreeWalker(ExecState* exec)
+        : BaseWalker(exec)
+    {
+    }
+
+    OutputType null() { return SerializedScriptValueData(); }
+
+    bool isArray(JSValue value)
+    {
+        if (!value.isObject())
+            return false;
+        JSObject* object = asObject(value);
+        return isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info);
+    }
+
+    bool isObject(JSValue value)
+    {
+        return value.isObject();
+    }
+
+    JSArray* asInputArray(JSValue value)
+    {
+        return asArray(value);
+    }
+
+    JSObject* asInputObject(JSValue value)
+    {
+        return asObject(value);
+    }
+
+    PassRefPtr<SerializedArray> createOutputArray(unsigned length)
+    {
+        return SerializedArray::create(length);
+    }
+
+    PassRefPtr<SerializedObject> createOutputObject()
+    {
+        return SerializedObject::create();
+    }
+
+    uint32_t length(JSValue array)
+    {
+        ASSERT(array.isObject());
+        JSObject* object = asObject(array);
+        return object->get(m_exec, m_exec->propertyNames().length).toUInt32(m_exec);
+    }
+
+    bool canDoFastRead(JSArray* array, unsigned index)
+    {
+        return isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index);
+    }
+
+    JSValue getIndex(JSArray* array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    JSValue getSparseIndex(JSObject* object, unsigned propertyName, bool& hasIndex)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot)) {
+            hasIndex = true;
+            return slot.getValue(m_exec, propertyName);
+        }
+        hasIndex = false;
+        return jsNull();
+    }
+
+    JSValue getProperty(JSObject* object, const Identifier& propertyName, unsigned)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot))
+            return slot.getValue(m_exec, propertyName);
+        return jsNull();
+    }
+
+    SerializedScriptValueData convertIfTerminal(JSValue value)
+    {
+        if (!value.isCell())
+            return SerializedScriptValueData(value);
+
+        if (value.isString())
+            return SerializedScriptValueData(asString(value)->value());
+
+        if (value.isNumber())
+            return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
+
+        if (value.isObject() && asObject(value)->inherits(&DateInstance::info))
+            return SerializedScriptValueData(SerializedScriptValueData::DateType, asDateInstance(value)->internalNumber());
+
+        if (isArray(value))
+            return SerializedScriptValueData();
+
+        CallData unusedData;
+        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
+            return SerializedScriptValueData();
+
+        // Any other types are expected to serialize as null.
+        return SerializedScriptValueData(jsNull());
+    }
+
+    void getPropertyNames(JSObject* object, Vector<PropertyNameArray, 16>& propertyStack)
+    {
+        propertyStack.append(PropertyNameArray(m_exec));
+        object->getOwnPropertyNames(m_exec, propertyStack.last());
+    }
+
+    void putProperty(RefPtr<SerializedArray> array, unsigned propertyName, const SerializedScriptValueData& value)
+    {
+        array->setIndex(propertyName, value);
+    }
+
+    void putProperty(RefPtr<SerializedObject> object, const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        object->set(propertyName, value);
+    }
+
+    bool startArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inArray).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inArray);
+        return true;
+    }
+
+    void endArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        m_cycleDetector.remove(inArray);
+        m_gcBuffer.removeLast();
+    }
+
+    bool startObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inObject).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inObject);
+        return true;
+    }
+
+    void endObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        m_cycleDetector.remove(inObject);
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    HashSet<JSObject*> m_cycleDetector;
+};
+
+SerializedScriptValueData SerializedScriptValueData::serialize(ExecState* exec, JSValue inValue)
+{
+    SerializingTreeWalker context(exec);
+    return walk<SerializingTreeWalker>(context, inValue);
+}
+
+
+struct DeserializingTreeWalker : public BaseWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef JSValue OutputType;
+    typedef JSArray* OutputArray;
+    typedef JSObject* OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+        : BaseWalker(exec)
+        , m_mustCopy(mustCopy)
+    {
+    }
+
+    OutputType null() { return jsNull(); }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    JSArray* createOutputArray(unsigned length)
+    {
+        JSArray* array = constructEmptyArray(m_exec);
+        array->setLength(length);
+        return array;
+    }
+
+    JSObject* createOutputObject()
+    {
+        return constructEmptyObject(m_exec);
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    JSValue convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return JSValue();
+            case SerializedScriptValueData::StringType:
+                return jsString(m_exec, value.asString().crossThreadString());
+            case SerializedScriptValueData::ImmediateType:
+                return value.asImmediate();
+            case SerializedScriptValueData::NumberType:
+                return jsNumber(m_exec, value.asDouble());
+            case SerializedScriptValueData::DateType:
+                return new (m_exec) DateInstance(m_exec, value.asDouble());
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(JSArray* array, unsigned propertyName, JSValue value)
+    {
+        array->put(m_exec, propertyName, value);
+    }
+
+    void putProperty(JSObject* object, const RefPtr<StringImpl> propertyName, JSValue value)
+    {
+        object->putDirect(Identifier(m_exec, String(propertyName)), value);
+    }
+
+    bool startArray(RefPtr<SerializedArray>, JSArray* outArray)
+    {
+        m_gcBuffer.append(outArray);
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray>, JSArray*)
+    {
+        m_gcBuffer.removeLast();
+    }
+    bool startObject(RefPtr<SerializedObject>, JSObject* outObject)
+    {
+        m_gcBuffer.append(outObject);
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject>, JSObject*)
+    {
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    bool m_mustCopy;
+};
+
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+{
+    DeserializingTreeWalker context(exec, mustCopy);
+    return walk<DeserializingTreeWalker>(context, *this);
+}
+
+struct TeardownTreeWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef bool OutputType;
+    typedef bool OutputArray;
+    typedef bool OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    bool shouldTerminate()
+    {
+        return false;
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return 0xFFFFFFFF;
+    }
+
+    bool didTimeOut()
+    {
+        return false;
+    }
+
+    void throwStackOverflow()
+    {
+    }
+
+    void throwInterruptedException()
+    {
+    }
+
+    bool null() { return false; }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    bool createOutputArray(unsigned)
+    {
+        return false;
+    }
+
+    bool createOutputObject()
+    {
+        return false;
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    bool convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return false;
+            case SerializedScriptValueData::StringType:
+            case SerializedScriptValueData::ImmediateType:
+            case SerializedScriptValueData::NumberType:
+                return true;
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(bool, unsigned, bool)
+    {
+    }
+
+    void putProperty(bool, const RefPtr<StringImpl>&, bool)
+    {
+    }
+
+    bool startArray(RefPtr<SerializedArray>, bool)
+    {
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray> array, bool)
+    {
+        array->clear();
+    }
+    bool startObject(RefPtr<SerializedObject>, bool)
+    {
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject> object, bool)
+    {
+        object->clear();
+    }
+};
+
+void SerializedScriptValueData::tearDownSerializedData()
+{
+    if (m_sharedData && m_sharedData->refCount() > 1)
+        return;
+    TeardownTreeWalker context;
+    walk<TeardownTreeWalker>(context, *this);
+}
+
+}
diff --git a/WebCore/bindings/js/SerializedScriptValue.h b/WebCore/bindings/js/SerializedScriptValue.h
new file mode 100644
index 0000000..f8a126f
--- /dev/null
+++ b/WebCore/bindings/js/SerializedScriptValue.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+
+namespace WebCore {
+    class SerializedObject;
+    class SerializedArray;
+
+    class SharedSerializedData : public RefCounted<SharedSerializedData> {
+    public:
+        virtual ~SharedSerializedData() { }
+        SerializedArray* asArray();
+        SerializedObject* asObject();
+    };
+
+    class SerializedScriptValue;
+
+    class SerializedScriptValueData {
+    public:
+        enum SerializedType {
+            EmptyType,
+            DateType,
+            NumberType,
+            ImmediateType,
+            ObjectType,
+            ArrayType,
+            StringType
+        };
+
+        SerializedType type() const { return m_type; }
+        static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
+        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+
+        ~SerializedScriptValueData()
+        {
+            if (m_sharedData)
+                tearDownSerializedData();
+        }
+
+        SerializedScriptValueData()
+            : m_type(EmptyType)
+        {
+        }
+
+        explicit SerializedScriptValueData(const String& string)
+            : m_type(StringType)
+            , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
+        {
+        }
+
+        explicit SerializedScriptValueData(JSC::JSValue value)
+            : m_type(ImmediateType)
+        {
+            ASSERT(!value.isCell());
+            m_data.m_immediate = JSC::JSValue::encode(value);
+        }
+
+        SerializedScriptValueData(SerializedType type, double value)
+            : m_type(type)
+        {
+            m_data.m_double = value;
+        }
+
+        SerializedScriptValueData(RefPtr<SerializedObject>);
+        SerializedScriptValueData(RefPtr<SerializedArray>);
+
+        JSC::JSValue asImmediate() const
+        {
+            ASSERT(m_type == ImmediateType);
+            return JSC::JSValue::decode(m_data.m_immediate);
+        }
+
+        double asDouble() const
+        {
+            ASSERT(m_type == NumberType || m_type == DateType);
+            return m_data.m_double;
+        }
+
+        String asString() const
+        {
+            ASSERT(m_type == StringType);
+            return m_string;
+        }
+
+        SerializedObject* asObject() const
+        {
+            ASSERT(m_type == ObjectType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asObject();
+        }
+
+        SerializedArray* asArray() const
+        {
+            ASSERT(m_type == ArrayType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asArray();
+        }
+
+        operator bool() const { return m_type != EmptyType; }
+
+        SerializedScriptValueData release()
+        {
+            SerializedScriptValueData result = *this;
+            *this = SerializedScriptValueData();
+            return result;
+        }
+
+    private:
+        void tearDownSerializedData();
+        SerializedType m_type;
+        RefPtr<SharedSerializedData> m_sharedData;
+        String m_string;
+        union {
+            double m_double;
+            JSC::EncodedJSValue m_immediate;
+        } m_data;
+    };
+
+    class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+    public:
+        static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create(String string)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create()
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData()));
+        }
+
+        PassRefPtr<SerializedScriptValue> release()
+        {
+            PassRefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_value));
+            m_value = SerializedScriptValueData();
+            result->m_mustCopy = true;
+            return result;
+        }
+
+        String toString()
+        {
+            if (m_value.type() != SerializedScriptValueData::StringType)
+                return "";
+            return m_value.asString();
+        }
+
+        JSC::JSValue deserialize(JSC::ExecState* exec)
+        {
+            if (!m_value)
+                return JSC::jsNull();
+            return m_value.deserialize(exec, m_mustCopy);
+        }
+
+        ~SerializedScriptValue() {}
+
+    private:
+        SerializedScriptValue(SerializedScriptValueData value)
+            : m_value(value)
+            , m_mustCopy(false)
+        {
+        }
+
+        SerializedScriptValueData m_value;
+        bool m_mustCopy;
+    };
+}
+
+#endif // SerializedScriptValue_h