auto import from //depot/cupcake/@135843

148 files changed, 15836 insertions, 0 deletions

diff --git a/WebCore/bindings/js/GCController.cpp b/WebCore/bindings/js/GCController.cpp
new file mode 100644
index 0000000..fc8a778
--- /dev/null
+++ b/WebCore/bindings/js/GCController.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GCController.h"
+
+#include "JSDOMWindow.h"
+#include <runtime/JSGlobalData.h>
+#include <runtime/JSLock.h>
+#include <kjs/collector.h>
+
+#if USE(PTHREADS)
+#include <pthread.h>
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+#if USE(PTHREADS)
+
+static void* collect(void*)
+{
+    JSLock lock(false);
+    JSDOMWindow::commonJSGlobalData()->heap.collect();
+    return 0;
+}
+
+#endif
+
+GCController& gcController()
+{
+    static GCController staticGCController;
+    return staticGCController;
+}
+
+GCController::GCController()
+    : m_GCTimer(this, &GCController::gcTimerFired)
+{
+}
+
+void GCController::garbageCollectSoon()
+{
+    if (!m_GCTimer.isActive())
+        m_GCTimer.startOneShot(0);
+}
+
+void GCController::gcTimerFired(Timer<GCController>*)
+{
+    JSLock lock(false);
+    JSDOMWindow::commonJSGlobalData()->heap.collect();
+}
+
+void GCController::garbageCollectNow()
+{
+    JSLock lock(false);
+    JSDOMWindow::commonJSGlobalData()->heap.collect();
+}
+
+void GCController::garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone)
+{
+#if USE(PTHREADS)
+    pthread_t thread;
+    pthread_create(&thread, NULL, collect, NULL);
+
+    if (waitUntilDone)
+        pthread_join(thread, NULL);
+#endif
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/GCController.h b/WebCore/bindings/js/GCController.h
new file mode 100644
index 0000000..452019a
--- /dev/null
+++ b/WebCore/bindings/js/GCController.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GCController_h
+#define GCController_h
+
+#include <wtf/Noncopyable.h>
+#include "Timer.h"
+
+namespace WebCore {
+
+    class GCController : Noncopyable {
+        friend GCController& gcController();
+
+    public:
+        void garbageCollectSoon();
+        void garbageCollectNow(); // It's better to call garbageCollectSoon, unless you have a specific reason not to.
+
+        void garbageCollectOnAlternateThreadForDebugging(bool waitUntilDone); // Used for stress testing.
+
+    private:
+        GCController(); // Use gcController() instead
+        void gcTimerFired(Timer<GCController>*);
+        
+        Timer<GCController> m_GCTimer;
+    };
+
+    // Function to obtain the global GC controller.
+    GCController& gcController();
+
+} // namespace WebCore
+
+#endif // GCController_h
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
new file mode 100644
index 0000000..0cf5705
--- /dev/null
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSAttr.h"
+
+#include "CSSHelper.h"
+#include "Document.h"
+#include "HTMLFrameElementBase.h"
+#include "HTMLNames.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void JSAttr::setValue(ExecState* exec, JSValue* value)
+{
+    Attr* imp = static_cast<Attr*>(impl());
+    String attrValue = valueToStringWithNullCheck(exec, value);
+
+    Element* ownerElement = imp->ownerElement();
+    if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
+        if (equalIgnoringCase(imp->name(), "src") && protocolIs(parseURL(attrValue), "javascript")) {
+            if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
+                return;
+        }
+    }
+
+    ExceptionCode ec = 0;
+    imp->setValue(attrValue, ec);
+    setDOMException(exec, ec);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSAudioConstructor.cpp b/WebCore/bindings/js/JSAudioConstructor.cpp
new file mode 100644
index 0000000..f342cea
--- /dev/null
+++ b/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+
+#include "JSAudioConstructor.h"
+
+#include "HTMLAudioElement.h"
+#include "JSHTMLAudioElement.h"
+#include "ScriptExecutionContext.h"
+#include "Text.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", 0, 0, 0 };
+
+JSAudioConstructor::JSAudioConstructor(ExecState* exec, ScriptExecutionContext* context)
+    : DOMObject(JSAudioConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    ASSERT(context->isDocument());
+    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
+
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(static_cast<JSAudioConstructor*>(constructor)->document());
+    if (args.size() > 0) {
+        audio->setSrc(args.at(exec, 0)->toString(exec));
+        audio->scheduleLoad();
+    }
+    return asObject(toJS(exec, audio.release()));
+}
+
+ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructAudio;
+    return ConstructTypeHost;
+}
+
+void JSAudioConstructor::mark()
+{
+    DOMObject::mark();
+    if (!m_document->marked())
+        m_document->mark();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
diff --git a/WebCore/bindings/js/JSAudioConstructor.h b/WebCore/bindings/js/JSAudioConstructor.h
new file mode 100644
index 0000000..cdff10f
--- /dev/null
+++ b/WebCore/bindings/js/JSAudioConstructor.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSAudioConstructor_h
+#define JSAudioConstructor_h
+
+#if ENABLE(VIDEO)
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class JSAudioConstructor : public DOMObject {
+    public:
+        JSAudioConstructor(JSC::ExecState*, ScriptExecutionContext*);
+
+        Document* document() const { return m_document->impl(); }
+
+        static const JSC::ClassInfo s_info;
+
+        virtual void mark();
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+
+        JSDocument* m_document;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
+
+#endif // JSAudioConstructor_h
diff --git a/WebCore/bindings/js/JSCSSRuleCustom.cpp b/WebCore/bindings/js/JSCSSRuleCustom.cpp
new file mode 100644
index 0000000..1e0fac3
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCSSRule.h"
+
+#include "CSSCharsetRule.h"
+#include "CSSFontFaceRule.h"
+#include "CSSImportRule.h"
+#include "CSSMediaRule.h"
+#include "CSSPageRule.h"
+#include "CSSStyleRule.h"
+#include "CSSVariablesRule.h"
+#include "JSCSSCharsetRule.h"
+#include "JSCSSFontFaceRule.h"
+#include "JSCSSImportRule.h"
+#include "JSCSSMediaRule.h"
+#include "JSCSSPageRule.h"
+#include "JSCSSStyleRule.h"
+#include "JSCSSVariablesRule.h"
+#include "JSWebKitCSSKeyframeRule.h"
+#include "JSWebKitCSSKeyframesRule.h"
+#include "WebKitCSSKeyframeRule.h"
+#include "WebKitCSSKeyframesRule.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJS(ExecState* exec, CSSRule* rule)
+{
+    if (!rule)
+        return jsNull();
+
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), rule);
+
+    if (wrapper)
+        return wrapper;
+
+    switch (rule->type()) {
+        case CSSRule::STYLE_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSStyleRule, rule);
+            break;
+        case CSSRule::MEDIA_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSMediaRule, rule);
+            break;
+        case CSSRule::FONT_FACE_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSFontFaceRule, rule);
+            break;
+        case CSSRule::PAGE_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSPageRule, rule);
+            break;
+        case CSSRule::IMPORT_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSImportRule, rule);
+            break;
+        case CSSRule::CHARSET_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSCharsetRule, rule);
+            break;
+        case CSSRule::VARIABLES_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSVariablesRule, rule);
+            break;
+        case CSSRule::WEBKIT_KEYFRAME_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, WebKitCSSKeyframeRule, rule);
+            break;
+        case CSSRule::WEBKIT_KEYFRAMES_RULE:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, WebKitCSSKeyframesRule, rule);
+            break;
+        default:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSRule, rule);
+    }
+
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
new file mode 100644
index 0000000..13b6379
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -0,0 +1,175 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCSSStyleDeclarationCustom.h"
+
+#include "AtomicString.h"
+#include "CSSPrimitiveValue.h"
+#include "CSSStyleDeclaration.h"
+#include "CSSValue.h"
+#include "PlatformString.h"
+#include <runtime/StringObjectThatMasqueradesAsUndefined.h>
+#include <runtime/StringPrototype.h>
+#include <wtf/ASCIICType.h>
+
+using namespace JSC;
+using namespace WTF;
+
+namespace WebCore {
+
+// Check for a CSS prefix.
+// Passed prefix is all lowercase.
+// First character of the prefix within the property name may be upper or lowercase.
+// Other characters in the prefix within the property name must be lowercase.
+// The prefix within the property name must be followed by a capital letter.
+static bool hasCSSPropertyNamePrefix(const Identifier& propertyName, const char* prefix)
+{
+#ifndef NDEBUG
+    ASSERT(*prefix);
+    for (const char* p = prefix; *p; ++p)
+        ASSERT(isASCIILower(*p));
+    ASSERT(propertyName.size());
+#endif
+
+    if (toASCIILower(propertyName.data()[0]) != prefix[0])
+        return false;
+
+    unsigned length = propertyName.size();
+    for (unsigned i = 1; i < length; ++i) {
+        if (!prefix[i])
+            return isASCIIUpper(propertyName.data()[i]);
+        if (propertyName.data()[i] != prefix[i])
+            return false;
+    }
+    return false;
+}
+
+static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
+{
+    if (hadPixelOrPosPrefix)
+        *hadPixelOrPosPrefix = false;
+
+    unsigned length = propertyName.size();
+    if (!length)
+        return String();
+
+    Vector<UChar> name;
+    name.reserveCapacity(length);
+
+    unsigned i = 0;
+
+    if (hasCSSPropertyNamePrefix(propertyName, "css"))
+        i += 3;
+    else if (hasCSSPropertyNamePrefix(propertyName, "pixel")) {
+        i += 5;
+        if (hadPixelOrPosPrefix)
+            *hadPixelOrPosPrefix = true;
+    } else if (hasCSSPropertyNamePrefix(propertyName, "pos")) {
+        i += 3;
+        if (hadPixelOrPosPrefix)
+            *hadPixelOrPosPrefix = true;
+    } else if (hasCSSPropertyNamePrefix(propertyName, "webkit")
+            || hasCSSPropertyNamePrefix(propertyName, "khtml")
+            || hasCSSPropertyNamePrefix(propertyName, "apple"))
+        name.append('-');
+    else {
+        if (isASCIIUpper(propertyName.data()[0]))
+            return String();
+    }
+
+    name.append(toASCIILower(propertyName.data()[i++]));
+
+    for (; i < length; ++i) {
+        UChar c = propertyName.data()[i];
+        if (!isASCIIUpper(c))
+            name.append(c);
+        else {
+            name.append('-');
+            name.append(toASCIILower(c));
+        }
+    }
+
+    return String::adopt(name);
+}
+
+static bool isCSSPropertyName(const Identifier& propertyName)
+{
+    return CSSStyleDeclaration::isPropertyName(cssPropertyName(propertyName));
+}
+
+bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*, const Identifier& propertyName)
+{
+    return isCSSPropertyName(propertyName);
+}
+
+// FIXME: You can get these properties, and set them (see customPut below),
+// but you should also be able to enumerate them.
+JSValue* JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
+
+    // Set up pixelOrPos boolean to handle the fact that
+    // pixelTop returns "CSS Top" as number value in unit pixels
+    // posTop returns "CSS top" as number value in unit pixels _if_ its a
+    // positioned element. if it is not a positioned element, return 0
+    // from MSIE documentation FIXME: IMPLEMENT THAT (Dirk)
+    bool pixelOrPos;
+    String prop = cssPropertyName(propertyName, &pixelOrPos);
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValue(prop);
+    if (v) {
+        if (pixelOrPos && v->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE)
+            return jsNumber(exec, static_pointer_cast<CSSPrimitiveValue>(v)->getFloatValue(CSSPrimitiveValue::CSS_PX));
+        return jsStringOrNull(exec, v->cssText());
+    }
+
+    // If the property is a shorthand property (such as "padding"), 
+    // it can only be accessed using getPropertyValue.
+
+    // Make the SVG 'filter' attribute undetectable, to avoid confusion with the IE 'filter' attribute.
+    if (propertyName == "filter")
+        return StringObjectThatMasqueradesAsUndefined::create(exec, thisObj->impl()->getPropertyValue(prop));
+
+    return jsString(exec, thisObj->impl()->getPropertyValue(prop));
+}
+
+
+bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot&)
+{
+    if (!isCSSPropertyName(propertyName))
+        return false;
+
+    bool pixelOrPos;
+    String prop = cssPropertyName(propertyName, &pixelOrPos);
+    String propValue = valueToStringWithNullCheck(exec, value);
+    if (pixelOrPos)
+        propValue += "px";
+    ExceptionCode ec = 0;
+    impl()->setProperty(prop, propValue, ec);
+    setDOMException(exec, ec);
+    return true;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.h b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.h
new file mode 100644
index 0000000..32ecbe0
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCSSStyleDeclarationCustom_h
+#define JSCSSStyleDeclarationCustom_h
+
+#include "JSCSSStyleDeclaration.h"
+
+#endif // JSCSSStyleDeclarationCustom_h
diff --git a/WebCore/bindings/js/JSCSSValueCustom.cpp b/WebCore/bindings/js/JSCSSValueCustom.cpp
new file mode 100644
index 0000000..85868c3
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCSSValue.h"
+
+#include "CSSPrimitiveValue.h"
+#include "CSSValueList.h"
+#include "JSCSSPrimitiveValue.h"
+#include "JSCSSValueList.h"
+#include "JSWebKitCSSTransformValue.h"
+#include "WebKitCSSTransformValue.h"
+
+#if ENABLE(SVG)
+#include "JSSVGColor.h"
+#include "JSSVGPaint.h"
+#include "SVGColor.h"
+#include "SVGPaint.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJS(ExecState* exec, CSSValue* value)
+{
+    if (!value)
+        return jsNull();
+
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), value);
+
+    if (wrapper)
+        return wrapper;
+
+    if (value->isWebKitCSSTransformValue())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, WebKitCSSTransformValue, value);
+    else if (value->isValueList())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSValueList, value);
+#if ENABLE(SVG)
+    else if (value->isSVGPaint())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, SVGPaint, value);
+    else if (value->isSVGColor())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, SVGColor, value);
+#endif
+    else if (value->isPrimitiveValue())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSPrimitiveValue, value);
+    else
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSValue, value);
+
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasPixelArrayCustom.h b/WebCore/bindings/js/JSCanvasPixelArrayCustom.h
new file mode 100644
index 0000000..9bdcccd
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasPixelArrayCustom.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "JSCanvasPixelArray.h"
+
+#include "CanvasPixelArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+    inline JSValue* JSCanvasPixelArray::getByIndex(ExecState* exec, unsigned index)
+    {
+        unsigned char result;
+        if (!impl()->get(index, result))
+            return jsUndefined();
+        return JSImmediate::from(result);
+    }
+    
+    inline void JSCanvasPixelArray::indexSetter(ExecState* exec, unsigned index, JSValue* value)
+    {
+        double pixelValue = value->toNumber(exec);
+        if (exec->hadException())
+            return;
+        m_impl->set(index, pixelValue); 
+    }
+    
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
new file mode 100644
index 0000000..a2f4f65
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -0,0 +1,389 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSCanvasRenderingContext2D.h"
+
+#include "CanvasGradient.h"
+#include "CanvasPattern.h"
+#include "CanvasRenderingContext2D.h"
+#include "CanvasStyle.h"
+#include "ExceptionCode.h"
+#include "FloatRect.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageData.h"
+#include "JSCanvasGradient.h"
+#include "JSCanvasPattern.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSImageData.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static JSValue* toJS(ExecState* exec, CanvasStyle* style)
+{
+    if (style->canvasGradient())
+        return toJS(exec, style->canvasGradient());
+    if (style->canvasPattern())
+        return toJS(exec, style->canvasPattern());
+    return jsString(exec, style->color());
+}
+
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState* exec, JSValue* value)
+{
+    if (value->isString())
+        return CanvasStyle::create(asString(value)->value());
+    if (!value->isObject())
+        return 0;
+    JSObject* object = asObject(value);
+    if (object->inherits(&JSCanvasGradient::s_info))
+        return CanvasStyle::create(static_cast<JSCanvasGradient*>(object)->impl());
+    if (object->inherits(&JSCanvasPattern::s_info))
+        return CanvasStyle::create(static_cast<JSCanvasPattern*>(object)->impl());
+    return 0;
+}
+
+JSValue* JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
+{
+    return toJS(exec, impl()->strokeStyle());        
+}
+
+void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue* value)
+{
+    impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
+}
+
+JSValue* JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
+{
+    return toJS(exec, impl()->fillStyle());
+}
+
+void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue* value)
+{
+    impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
+}
+
+JSValue* JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
+{
+    CanvasRenderingContext2D* context = impl();
+
+    // string arg = named color
+    // number arg = gray color
+    // string arg, number arg = named color, alpha
+    // number arg, number arg = gray color, alpha
+    // 4 args = r, g, b, a
+    // 5 args = c, m, y, k, a
+    switch (args.size()) {
+        case 1:
+            if (args.at(exec, 0)->isString())
+                context->setFillColor(asString(args.at(exec, 0))->value());
+            else
+                context->setFillColor(args.at(exec, 0)->toFloat(exec));
+            break;
+        case 2:
+            if (args.at(exec, 0)->isString())
+                context->setFillColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            else
+                context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+            break;
+        case 4:
+            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            break;
+        case 5:
+            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            break;
+        default:
+            return throwError(exec, SyntaxError);
+    }
+    return jsUndefined();
+}    
+
+JSValue* JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+
+    // string arg = named color
+    // number arg = gray color
+    // string arg, number arg = named color, alpha
+    // number arg, number arg = gray color, alpha
+    // 4 args = r, g, b, a
+    // 5 args = c, m, y, k, a
+    switch (args.size()) {
+        case 1:
+            if (args.at(exec, 0)->isString())
+                context->setStrokeColor(asString(args.at(exec, 0))->value());
+            else
+                context->setStrokeColor(args.at(exec, 0)->toFloat(exec));
+            break;
+        case 2:
+            if (args.at(exec, 0)->isString())
+                context->setStrokeColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            else
+                context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+            break;
+        case 4:
+            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            break;
+        case 5:
+            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            break;
+        default:
+            return throwError(exec, SyntaxError);
+    }
+    
+    return jsUndefined();
+}
+
+JSValue* JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+    
+    if (args.size() <= 4)
+        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+    else
+        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+
+    return jsUndefined();    
+}
+
+JSValue* JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+
+    // DrawImage has three variants:
+    //     drawImage(img, dx, dy)
+    //     drawImage(img, dx, dy, dw, dh)
+    //     drawImage(img, sx, sy, sw, sh, dx, dy, dw, dh)
+    // Composite operation is specified with globalCompositeOperation.
+    // The img parameter can be a <img> or <canvas> element.
+    JSValue* value = args.at(exec, 0);
+    if (!value->isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        switch (args.size()) {
+            case 3:
+                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                break;
+            case 5:
+                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
+                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                setDOMException(exec, ec);
+                break;
+            case 9:
+                context->drawImage(imgElt, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
+                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
+                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
+                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                setDOMException(exec, ec);
+                break;
+            default:
+                return throwError(exec, SyntaxError);
+        }
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        switch (args.size()) {
+            case 3:
+                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                break;
+            case 5:
+                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
+                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                setDOMException(exec, ec);
+                break;
+            case 9:
+                context->drawImage(canvas, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
+                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
+                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
+                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                setDOMException(exec, ec);
+                break;
+            default:
+                return throwError(exec, SyntaxError);
+        }
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+JSValue* JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+    
+    JSValue* value = args.at(exec, 0);
+    if (!value->isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    if (!o->inherits(&JSHTMLImageElement::s_info))
+        return throwError(exec, TypeError);
+    context->drawImageFromRect(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
+                               args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
+                               args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec),
+                               args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
+                               args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec),
+                               args.at(exec, 9)->toString(exec));    
+    return jsUndefined();    
+}
+
+JSValue* JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+
+    switch (args.size()) {
+        case 3:
+            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                               args.at(exec, 2)->toFloat(exec));
+            break;
+        case 4:
+            if (args.at(exec, 3)->isString())
+                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value());
+            else
+                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            break;
+        case 5:
+            if (args.at(exec, 3)->isString())
+                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value(),
+                                   args.at(exec, 4)->toFloat(exec));
+            else
+                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
+                                   args.at(exec, 4)->toFloat(exec));
+            break;
+        case 7:
+            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
+                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
+                               args.at(exec, 6)->toFloat(exec));
+            break;
+        case 8:
+            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
+                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
+                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
+                               args.at(exec, 6)->toFloat(exec), args.at(exec, 7)->toFloat(exec));
+            break;
+        default:
+            return throwError(exec, SyntaxError);
+    }
+    
+    return jsUndefined();    
+}
+
+JSValue* JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+
+    JSValue* value = args.at(exec, 0);
+    if (!value->isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        ExceptionCode ec;
+        JSValue* pattern = toJS(exec,
+            context->createPattern(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
+                                   valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+        setDOMException(exec, ec);
+        return pattern;
+    }
+    if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        ExceptionCode ec;
+        JSValue* pattern = toJS(exec,
+            context->createPattern(static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl()),
+                valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+        setDOMException(exec, ec);
+        return pattern;
+    }
+    setDOMException(exec, TYPE_MISMATCH_ERR);
+    return jsUndefined();
+}
+
+JSValue* JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
+{
+    // putImageData has two variants
+    // putImageData(ImageData, x, y)
+    // putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
+    CanvasRenderingContext2D* context = impl();
+
+    ExceptionCode ec = 0;
+    if (args.size() >= 7)
+        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), 
+                              args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec), ec);
+    else
+        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), ec);
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+
+    // string arg = text to draw
+    // number arg = x
+    // number arg = y
+    // optional number arg = maxWidth
+    if (args.size() < 3 || args.size() > 4)
+        return throwError(exec, SyntaxError);
+    
+    if (args.size() == 4)
+        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+    else
+        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+    return jsUndefined();
+}
+
+JSValue* JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
+{ 
+    CanvasRenderingContext2D* context = impl();
+
+    // string arg = text to draw
+    // number arg = x
+    // number arg = y
+    // optional number arg = maxWidth
+    if (args.size() < 3 || args.size() > 4)
+        return throwError(exec, SyntaxError);
+    
+    if (args.size() == 4)
+        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+    else
+        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSClipboardCustom.cpp b/WebCore/bindings/js/JSClipboardCustom.cpp
new file mode 100644
index 0000000..bdcb074
--- /dev/null
+++ b/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSClipboard.h"
+
+#include "Clipboard.h"
+#include "Element.h"
+#include "HTMLImageElement.h"
+#include "HTMLNames.h"
+#include "IntPoint.h"
+#include "JSNode.h"
+#include "Node.h"
+#include "PlatformString.h"
+#include "StringHash.h"
+#include <runtime/ArrayPrototype.h>
+#include <runtime/Error.h>
+#include <wtf/HashSet.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+JSValue* JSClipboard::types(ExecState* exec) const
+{
+    Clipboard* clipboard = impl();
+
+    HashSet<String> types = clipboard->types();
+    if (types.isEmpty())
+        return jsNull();
+
+    ArgList list;
+    HashSet<String>::const_iterator end = types.end();
+    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
+        list.append(jsString(exec, UString(*it)));
+    return constructArray(exec, list);
+}
+
+JSValue* JSClipboard::clearData(ExecState* exec, const ArgList& args)
+{
+    Clipboard* clipboard = impl();
+
+    if (args.size() == 0) {
+        clipboard->clearAllData();
+        return jsUndefined();
+    }
+
+    if (args.size() == 1) {
+        clipboard->clearData(args.at(exec, 0)->toString(exec));
+        return jsUndefined();
+    }
+
+    // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments. 
+    return throwError(exec, SyntaxError, "clearData: Invalid number of arguments");
+}
+
+JSValue* JSClipboard::getData(ExecState* exec, const ArgList& args)
+{
+    // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
+    if (args.size() != 1)
+        return throwError(exec, SyntaxError, "getData: Invalid number of arguments");
+
+    Clipboard* clipboard = impl();
+
+    bool success;
+    String result = clipboard->getData(args.at(exec, 0)->toString(exec), success);
+    if (!success)
+        return jsUndefined();
+
+    return jsString(exec, result);
+}
+
+JSValue* JSClipboard::setData(ExecState* exec, const ArgList& args)
+{
+    Clipboard* clipboard = impl();
+
+    // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments. 
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError, "setData: Invalid number of arguments");
+
+    return jsBoolean(clipboard->setData(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec)));
+}
+
+JSValue* JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
+{
+    Clipboard* clipboard = impl();
+
+    if (!clipboard->isForDragging())
+        return jsUndefined();
+
+    // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments. 
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError, "setDragImage: Invalid number of arguments");
+
+    int x = args.at(exec, 1)->toInt32(exec);
+    int y = args.at(exec, 2)->toInt32(exec);
+
+    // See if they passed us a node
+    Node* node = toNode(args.at(exec, 0));
+    if (!node)
+        return throwError(exec, TypeError);
+
+    // FIXME: This should probably be a TypeError. 
+    if (!node->isElementNode())
+        return throwError(exec, SyntaxError, "setDragImageFromElement: Invalid first argument");
+
+    if (static_cast<Element*>(node)->hasLocalName(imgTag) && !node->inDocument())
+        clipboard->setDragImage(static_cast<HTMLImageElement*>(node)->cachedImage(), IntPoint(x, y));
+    else
+        clipboard->setDragImageElement(node, IntPoint(x, y));
+
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSConsoleCustom.cpp b/WebCore/bindings/js/JSConsoleCustom.cpp
new file mode 100644
index 0000000..6131cb6
--- /dev/null
+++ b/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSConsole.h"
+#include "JavaScriptProfile.h"
+#include <runtime/JSArray.h>
+
+#include "Console.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
+
+JSValue* JSConsole::profiles(ExecState* exec) const
+{
+    const ProfilesArray& profiles = impl()->profiles();
+    ArgList list;
+
+    ProfilesArray::const_iterator end = profiles.end();
+    for (ProfilesArray::const_iterator iter = profiles.begin(); iter != end; ++iter)
+        list.append(toJS(exec, iter->get()));
+
+    return constructArray(exec, list);
+}
+
+JSValue* JSConsole::debug(ExecState* exec, const ArgList& arguments)
+{
+    impl()->debug(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::error(ExecState* exec, const ArgList& arguments)
+{
+    impl()->error(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::info(ExecState* exec, const ArgList& arguments)
+{
+    impl()->info(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::log(ExecState* exec, const ArgList& arguments)
+{
+    impl()->log(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::warn(ExecState* exec, const ArgList& arguments)
+{
+    impl()->warn(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::dir(ExecState* exec, const ArgList& arguments)
+{
+    impl()->dir(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::dirxml(ExecState* exec, const ArgList& arguments)
+{
+    impl()->dirxml(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::trace(ExecState* exec, const ArgList&)
+{
+    impl()->trace(exec);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::assertCondition(ExecState* exec, const ArgList& arguments)
+{
+    ArgList messageParameters;
+    arguments.getSlice(1, messageParameters);
+
+    impl()->assertCondition(arguments.at(exec, 0)->toBoolean(exec), exec, messageParameters);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::count(ExecState* exec, const ArgList& arguments)
+{
+    impl()->count(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::timeEnd(ExecState* exec, const ArgList& arguments)
+{
+    impl()->timeEnd(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::profile(ExecState* exec, const ArgList& arguments)
+{
+    impl()->profile(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::profileEnd(ExecState* exec, const ArgList& arguments)
+{
+    impl()->profileEnd(exec, arguments);
+    return jsUndefined();
+}
+
+JSValue* JSConsole::group(ExecState* exec, const ArgList& arguments)
+{
+    impl()->group(exec, arguments);
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.cpp b/WebCore/bindings/js/JSCustomPositionCallback.cpp
new file mode 100644
index 0000000..5a5e6b0
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCustomPositionCallback.h"
+
+#include "Console.h"
+#include "CString.h"
+#include "Frame.h"
+#include "JSGeoposition.h"
+#include "Page.h"
+#include "ScriptController.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, Frame* frame)
+    : m_callback(callback)
+    , m_frame(frame)
+{
+}
+
+void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raisedException)
+{
+    ASSERT(m_callback);
+    ASSERT(m_frame);
+    
+    if (!m_frame->script()->isEnabled())
+        return;
+    
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+    
+    JSC::JSLock lock(false);
+    
+    JSValue* function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function->getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = m_callback->getCallData(callData);
+        if (callType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return;
+        }
+        function = m_callback;
+    }
+    
+    RefPtr<JSCustomPositionCallback> protect(this);
+    
+    ArgList args;
+    args.append(toJS(exec, geoposition));
+    
+    globalObject->startTimeoutCheck();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->stopTimeoutCheck();
+    
+    if (exec->hadException()) {
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+        raisedException = true;
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.h b/WebCore/bindings/js/JSCustomPositionCallback.h
new file mode 100644
index 0000000..96e6177
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCustomPositionCallback_h
+#define JSCustomPositionCallback_h
+
+#include "PositionCallback.h"
+#include <runtime/JSObject.h>
+#include <kjs/protect.h>
+#include <wtf/Forward.h>
+
+namespace JSC {
+    class JSObject;
+}
+
+namespace WebCore {
+
+class Frame;
+class Geoposition;
+
+class JSCustomPositionCallback : public PositionCallback {
+public:
+    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionCallback(callback, frame)); }
+    
+    virtual void handleEvent(Geoposition*, bool& raisedException);
+
+private:
+    JSCustomPositionCallback(JSC::JSObject* callback, Frame*);
+
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    RefPtr<Frame> m_frame;
+};
+    
+} // namespace WebCore
+
+#endif // JSCustomPositionCallback_h
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
new file mode 100644
index 0000000..2cd41d7
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCustomPositionErrorCallback.h"
+
+#include "Console.h"
+#include "CString.h"
+#include "Frame.h"
+#include "JSPositionError.h"
+#include "Page.h"
+#include "ScriptController.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+    
+using namespace JSC;
+
+JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, Frame* frame)
+    : m_callback(callback)
+    , m_frame(frame)
+{
+}
+
+void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
+{
+    ASSERT(m_callback);
+    ASSERT(m_frame);
+    
+    if (!m_frame->script()->isEnabled())
+        return;
+    
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+    
+    JSC::JSLock lock(false);
+    
+    JSValue* function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function->getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = m_callback->getCallData(callData);
+        if (callType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return;
+        }
+        function = m_callback;
+    }
+    
+    RefPtr<JSCustomPositionErrorCallback> protect(this);
+    
+    ArgList args;
+    args.append(toJS(exec, positionError));
+    
+    globalObject->startTimeoutCheck();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->stopTimeoutCheck();
+    
+    if (exec->hadException())
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+}
+    
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
new file mode 100644
index 0000000..190e5a4
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCustomPositionErrorCallback_h
+#define JSCustomPositionErrorCallback_h
+
+#include "PositionErrorCallback.h"
+#include <runtime/JSObject.h>
+#include <kjs/protect.h>
+#include <wtf/Forward.h>
+
+namespace JSC {
+    class JSObject;
+}
+
+namespace WebCore {
+    
+class Frame;
+class PositionError;
+
+class JSCustomPositionErrorCallback : public PositionErrorCallback {
+public:
+    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionErrorCallback(callback, frame)); }
+    
+    virtual void handleEvent(PositionError*);
+
+private:
+    JSCustomPositionErrorCallback(JSC::JSObject* callback, Frame*);
+
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    RefPtr<Frame> m_frame;
+};
+    
+} // namespace WebCore
+
+#endif // JSCustomPositionErrorCallback_h
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
new file mode 100644
index 0000000..4787440
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCustomSQLStatementCallback.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "ScriptController.h"
+#include "JSSQLResultSet.h"
+#include "JSSQLTransaction.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+    
+using namespace JSC;
+    
+JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, Frame* frame)
+    : m_callback(callback)
+    , m_frame(frame)
+{
+}
+    
+void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+{
+    ASSERT(m_callback);
+    ASSERT(m_frame);
+        
+    if (!m_frame->script()->isEnabled())
+        return;
+
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+        
+    JSC::JSLock lock(false);
+        
+    JSValue* function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function->getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = m_callback->getCallData(callData);
+        if (callType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return;
+        }
+        function = m_callback;
+    }
+        
+    RefPtr<JSCustomSQLStatementCallback> protect(this);
+        
+    ArgList args;
+    args.append(toJS(exec, transaction));
+    args.append(toJS(exec, resultSet));
+        
+    globalObject->startTimeoutCheck();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->stopTimeoutCheck();
+        
+    if (exec->hadException()) {
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+        
+        raisedException = true;
+    }
+        
+    Document::updateDocumentsRendering();
+}
+    
+}
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
new file mode 100644
index 0000000..d4fd6ec
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCustomSQLStatementCallback_h
+#define JSCustomSQLStatementCallback_h
+
+#include "SQLStatementCallback.h"
+
+#include <runtime/JSObject.h>
+#include <kjs/protect.h>
+#include <wtf/Forward.h>
+
+namespace JSC {
+    class JSObject;
+}
+
+namespace WebCore {
+
+class Frame;
+class SQLResultSet;
+
+class JSCustomSQLStatementCallback : public SQLStatementCallback {
+public:
+    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementCallback(callback, frame)); }
+
+    virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
+
+private:
+    JSCustomSQLStatementCallback(JSC::JSObject* callback, Frame*);
+
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    RefPtr<Frame> m_frame;
+};
+
+}
+
+#endif // JSCustomSQLStatementCallback_h
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
new file mode 100644
index 0000000..f301704
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCustomSQLStatementErrorCallback.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "ScriptController.h"
+#include "JSSQLError.h"
+#include "JSSQLTransaction.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+    
+using namespace JSC;
+    
+JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, Frame* frame)
+    : m_callback(callback)
+    , m_frame(frame)
+{
+}
+    
+bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+{
+    ASSERT(m_callback);
+    ASSERT(m_frame);
+        
+    if (!m_frame->script()->isEnabled())
+        return true;
+        
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+        
+    JSC::JSLock lock(false);
+        
+    JSValue* handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    CallData handleEventCallData;
+    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallData callbackCallData;
+    CallType callbackCallType = CallTypeNone;
+
+    if (handleEventCallType == CallTypeNone) {
+        callbackCallType = m_callback->getCallData(callbackCallData);
+        if (callbackCallType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return true;
+        }
+    }
+        
+    RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
+        
+    ArgList args;
+    args.append(toJS(exec, transaction));
+    args.append(toJS(exec, error));
+        
+    JSValue* result;
+    globalObject->startTimeoutCheck();
+    if (handleEventCallType != CallTypeNone)
+        result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
+    else
+        result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
+    globalObject->stopTimeoutCheck();
+        
+    if (exec->hadException()) {
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+            
+        // The spec says:
+        // "If the error callback returns false, then move on to the next statement..."
+        // "Otherwise, the error callback did not return false, or there was no error callback"
+        // Therefore an exception and returning true are the same thing - so, return true on an exception
+        return true;
+    }
+        
+    Document::updateDocumentsRendering();
+
+    return result->toBoolean(exec);
+}
+
+}
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
new file mode 100644
index 0000000..e235f23
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCustomSQLStatementErrorCallback_h
+#define JSCustomSQLStatementErrorCallback_h
+
+#include "SQLStatementErrorCallback.h"
+
+#include <runtime/JSObject.h>
+#include <kjs/protect.h>
+#include <wtf/Forward.h>
+
+namespace JSC {
+    class JSObject;
+}
+
+namespace WebCore {
+    
+class Frame;
+class SQLError;
+    
+class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
+public:
+    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementErrorCallback(callback, frame)); }
+        
+    virtual bool handleEvent(SQLTransaction*, SQLError*);
+
+private:
+    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, Frame*);
+
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    RefPtr<Frame> m_frame;
+};
+    
+}
+
+#endif // JSCustomSQLStatementErrorCallback_h
+
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
new file mode 100644
index 0000000..3e3bcce
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCustomSQLTransactionCallback.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "Logging.h"
+#include "ScriptController.h"
+#include "JSSQLTransaction.h"
+#include "Page.h"
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+#include <wtf/RefCountedLeakCounter.h>
+
+namespace WebCore {
+    
+using namespace JSC;
+    
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
+#endif
+
+// We have to clean up the data on the main thread for two reasons:
+//
+//     1) Can't deref a Frame on a non-main thread.
+//     2) Unprotecting the JSObject on a non-main thread would register that thread
+//        for JavaScript garbage collection, which could unnecessarily slow things down.
+
+class JSCustomSQLTransactionCallback::Data {
+public:
+    Data(JSObject* callback, Frame* frame) : m_callback(callback), m_frame(frame) { }
+    JSObject* callback() { return m_callback; }
+    Frame* frame() { return m_frame.get(); }
+
+private:
+    ProtectedPtr<JSObject> m_callback;
+    RefPtr<Frame> m_frame;
+};
+
+JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, Frame* frame)
+    : m_data(new Data(callback, frame))
+{
+#ifndef NDEBUG
+    counter.increment();
+#endif
+}
+
+void JSCustomSQLTransactionCallback::deleteData(void* context)
+{
+    delete static_cast<Data*>(context);
+}
+
+JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
+{
+    callOnMainThread(deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+    counter.decrement();
+#endif
+}
+
+void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bool& raisedException)
+{
+    ASSERT(m_data);
+    ASSERT(m_data->callback());
+    ASSERT(m_data->frame());
+
+    if (!m_data->frame()->script()->isEnabled())
+        return;
+        
+    JSGlobalObject* globalObject = m_data->frame()->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+        
+    JSC::JSLock lock(false);
+        
+    JSValue* handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
+    CallData handleEventCallData;
+    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallData callbackCallData;
+    CallType callbackCallType = CallTypeNone;
+
+    if (handleEventCallType == CallTypeNone) {
+        callbackCallType = m_data->callback()->getCallData(callbackCallData);
+        if (callbackCallType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return;
+        }
+    }
+        
+    RefPtr<JSCustomSQLTransactionCallback> protect(this);
+        
+    ArgList args;
+    args.append(toJS(exec, transaction));
+
+    globalObject->startTimeoutCheck();
+    if (handleEventCallType != CallTypeNone)
+        call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
+    else
+        call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
+    globalObject->stopTimeoutCheck();
+        
+    if (exec->hadException()) {
+        m_data->frame()->domWindow()->console()->reportCurrentException(exec);
+        
+        raisedException = true;
+    }
+        
+    Document::updateDocumentsRendering();
+}
+    
+}
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
new file mode 100644
index 0000000..0a21c1a
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCustomSQLTransactionCallback_h
+#define JSCustomSQLTransactionCallback_h
+
+#include "SQLTransactionCallback.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace JSC {
+    class JSObject;
+}
+
+namespace WebCore {
+
+class Frame;
+
+class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
+public:
+    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionCallback(callback, frame)); }
+
+    virtual ~JSCustomSQLTransactionCallback();
+    
+    virtual void handleEvent(SQLTransaction*, bool& raisedException);
+
+private:
+    JSCustomSQLTransactionCallback(JSC::JSObject* callback, Frame*);
+
+    static void deleteData(void*);
+
+    class Data;
+    Data* m_data;
+};
+
+}
+
+#endif // JSCustomSQLTransactionCallback_h
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
new file mode 100644
index 0000000..097f809
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCustomSQLTransactionErrorCallback.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "ScriptController.h"
+#include "JSSQLError.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+    
+using namespace JSC;
+    
+JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, Frame* frame)
+    : m_callback(callback)
+    , m_frame(frame)
+{
+}
+    
+bool JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+{
+    ASSERT(m_callback);
+    ASSERT(m_frame);
+        
+    if (!m_frame->script()->isEnabled())
+        return true;
+        
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+        
+    JSC::JSLock lock(false);
+        
+    JSValue* function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function->getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = m_callback->getCallData(callData);
+        if (callType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return true;
+        }
+        function = m_callback;
+    }
+
+    RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
+        
+    ArgList args;
+    args.append(toJS(exec, error));
+
+    JSValue* result;
+    globalObject->startTimeoutCheck();
+    result = call(exec, function, callType, callData, m_callback, args);
+    globalObject->stopTimeoutCheck();
+        
+    if (exec->hadException())
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+        
+    Document::updateDocumentsRendering();
+    
+    return result->toBoolean(exec);
+}
+    
+}
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
new file mode 100644
index 0000000..bfbb1e2
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCustomSQLTransactionErrorCallback_h
+#define JSCustomSQLTransactionErrorCallback_h
+
+#include "SQLTransactionErrorCallback.h"
+
+#include <runtime/JSObject.h>
+#include <kjs/protect.h>
+#include <wtf/Forward.h>
+
+namespace JSC {
+    class JSObject;
+}
+
+namespace WebCore {
+
+class Frame;
+class SQLError;
+
+class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
+public:
+    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
+    
+    virtual bool handleEvent(SQLError*);
+
+private:
+    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
+
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    RefPtr<Frame> m_frame;
+};
+
+}
+
+#endif // JSCustomSQLTransactionErrorCallback_h
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.cpp b/WebCore/bindings/js/JSCustomVoidCallback.cpp
new file mode 100644
index 0000000..a838e95
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCustomVoidCallback.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "JSDOMWindowCustom.h"
+#include "JSDOMBinding.h"
+#include "ScriptController.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+    
+using namespace JSC;
+    
+JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, Frame* frame)
+    : m_callback(callback)
+    , m_frame(frame)
+{
+}
+    
+void JSCustomVoidCallback::handleEvent()
+{
+    ASSERT(m_callback);
+    ASSERT(m_frame);
+       
+    if (!m_frame->script()->isEnabled())
+        return;
+        
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+        
+    JSC::JSLock lock(false);
+        
+    JSValue* function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function->getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = m_callback->getCallData(callData);
+        if (callType == CallTypeNone) {
+            // FIXME: Should an exception be thrown here?
+            return;
+        }
+        function = m_callback;
+    }
+        
+    RefPtr<JSCustomVoidCallback> protect(this);
+        
+    ArgList args;
+    
+    globalObject->startTimeoutCheck();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->stopTimeoutCheck();
+        
+    if (exec->hadException())
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+        
+    Document::updateDocumentsRendering();
+}
+ 
+PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue* value)
+{
+    JSObject* object = value->getObject();
+    if (!object)
+        return 0;
+    
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!frame)
+        return 0;
+    
+    return JSCustomVoidCallback::create(object, frame);
+}
+
+}
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.h b/WebCore/bindings/js/JSCustomVoidCallback.h
new file mode 100644
index 0000000..9931631
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCustomVoidCallback_h
+#define JSCustomVoidCallback_h
+
+#include "VoidCallback.h"
+
+#include <runtime/JSObject.h>
+#include <kjs/protect.h>
+#include <wtf/Forward.h>
+
+namespace WebCore {
+    
+    class Frame;
+    
+    class JSCustomVoidCallback : public VoidCallback {
+    public: 
+        static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, Frame* frame)
+        {
+            return adoptRef(new JSCustomVoidCallback(callback, frame));
+        }
+        
+        virtual void handleEvent();
+        
+    private:
+        JSCustomVoidCallback(JSC::JSObject* callback, Frame*);
+
+        JSC::ProtectedPtr<JSC::JSObject> m_callback;
+        RefPtr<Frame> m_frame;
+    };
+
+    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue*);
+
+} // namespace WebCore
+
+#endif // JSCustomVoidCallback_h
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
new file mode 100644
index 0000000..45c2c18
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2007 Alexey Proskuryakov (ap@nypop.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCustomXPathNSResolver.h"
+
+#if ENABLE(XPATH)
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "JSDOMWindowCustom.h"
+#include "JSDOMBinding.h"
+#include "ScriptController.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValue* value)
+{
+    if (value->isUndefinedOrNull())
+        return 0;
+
+    JSObject* resolverObject = value->getObject();
+    if (!resolverObject) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return 0;
+    }
+    
+    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()));
+}
+
+JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, Frame* frame)
+    : m_customResolver(customResolver)
+    , m_frame(frame)
+{
+}
+
+JSCustomXPathNSResolver::~JSCustomXPathNSResolver()
+{
+}
+
+String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
+{
+    ASSERT(m_customResolver);
+
+    if (!m_frame)
+        return String();
+    if (!m_frame->script()->isEnabled())
+        return String();
+
+    JSLock lock(false);
+
+    JSGlobalObject* globalObject = m_frame->script()->globalObject();
+    ExecState* exec = globalObject->globalExec();
+        
+    JSValue* function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
+    CallData callData;
+    CallType callType = function->getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = m_customResolver->getCallData(callData);
+        if (callType == CallTypeNone) {
+            // FIXME: Pass actual line number and source URL.
+            m_frame->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
+            return String();
+        }
+        function = m_customResolver;
+    }
+
+    RefPtr<JSCustomXPathNSResolver> selfProtector(this);
+
+    ArgList args;
+    args.append(jsString(exec, prefix));
+
+    globalObject->startTimeoutCheck();
+    JSValue* retval = call(exec, function, callType, callData, m_customResolver, args);
+    globalObject->stopTimeoutCheck();
+
+    String result;
+    if (exec->hadException())
+        m_frame->domWindow()->console()->reportCurrentException(exec);
+    else {
+        if (!retval->isUndefinedOrNull())
+            result = retval->toString(exec);
+    }
+
+    Document::updateDocumentsRendering();
+
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XPATH)
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.h b/WebCore/bindings/js/JSCustomXPathNSResolver.h
new file mode 100644
index 0000000..bb8aed8
--- /dev/null
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2007 Alexey Proskuryakov (ap@nypop.com)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCustomXPathNSResolver_h
+#define JSCustomXPathNSResolver_h
+
+#if ENABLE(XPATH)
+
+#include "XPathNSResolver.h"
+#include <runtime/JSValue.h>
+#include <wtf/Forward.h>
+#include <wtf/RefPtr.h>
+
+namespace JSC {
+    class ExecState;
+    class JSObject;
+}
+
+namespace WebCore {
+
+    class Frame;
+
+    class JSCustomXPathNSResolver : public XPathNSResolver {
+    public:
+        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValue*);
+        
+        virtual ~JSCustomXPathNSResolver();
+
+        virtual String lookupNamespaceURI(const String& prefix);
+
+    private:
+        JSCustomXPathNSResolver(JSC::JSObject*, Frame*);
+
+        JSC::JSObject* m_customResolver; // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the object.
+        RefPtr<Frame> m_frame;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(XPATH)
+
+#endif // JSCustomXPathNSResolver_h
diff --git a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
new file mode 100644
index 0000000..c79b0d9
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDOMApplicationCache.h"
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+
+#include "AtomicString.h"
+#include "DOMApplicationCache.h"
+#include "DOMWindow.h"
+#include "Event.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "JSDOMWindowCustom.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSDOMApplicationCache::mark()
+{
+    DOMObject::mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onchecking()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onnoupdate()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->ondownloading()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onupdateready()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->oncached()))
+        listener->mark();
+
+    typedef DOMApplicationCache::EventListenersMap EventListenersMap;
+    typedef DOMApplicationCache::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
+            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
+            listener->mark();
+        }
+    }
+}
+
+JSValue* JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    
+    ExceptionCode ec = 0;
+    impl()->add(url, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    
+    ExceptionCode ec = 0;
+    impl()->remove(url, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue* JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
new file mode 100644
index 0000000..8676146
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -0,0 +1,548 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+// gcc 3.x can't handle including the HashMap pointer specialization in this file
+#if defined __GNUC__ && !defined __GLIBCXX__ // less than gcc 3.4
+#define HASH_MAP_PTR_SPEC_WORKAROUND 1
+#endif
+
+#include "config.h"
+#include "JSDOMBinding.h"
+
+#include "ActiveDOMObject.h"
+#include "DOMCoreException.h"
+#include "Document.h"
+#include "EventException.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "HTMLImageElement.h"
+#include "HTMLNames.h"
+#include "JSDOMCoreException.h"
+#include "JSDOMWindowCustom.h"
+#include "JSEventException.h"
+#include "JSNode.h"
+#include "JSRangeException.h"
+#include "JSXMLHttpRequestException.h"
+#include "KURL.h"
+#include "MessagePort.h"
+#include "RangeException.h"
+#include "ScriptController.h"
+#include "XMLHttpRequestException.h"
+#include <runtime/PrototypeFunction.h>
+
+#if ENABLE(SVG)
+#include "JSSVGException.h"
+#include "SVGException.h"
+#endif
+
+#if ENABLE(XPATH)
+#include "JSXPathException.h"
+#include "XPathException.h"
+#endif
+
+#if ENABLE(WORKERS)
+#include <wtf/ThreadSpecific.h>
+using namespace WTF;
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+typedef Document::JSWrapperCache JSWrapperCache;
+
+// For debugging, keep a set of wrappers currently registered, and check that
+// all are unregistered before they are destroyed. This has helped us fix at
+// least one bug.
+
+static void addWrapper(DOMObject* wrapper);
+static void removeWrapper(DOMObject* wrapper);
+static void removeWrappers(const JSWrapperCache& wrappers);
+
+#ifdef NDEBUG
+
+static inline void addWrapper(DOMObject*)
+{
+}
+
+static inline void removeWrapper(DOMObject*)
+{
+}
+
+static inline void removeWrappers(const JSWrapperCache&)
+{
+}
+
+#else
+
+static HashSet<DOMObject*>& wrapperSet()
+{
+#if ENABLE(WORKERS)
+    static ThreadSpecific<HashSet<DOMObject*> > staticWrapperSet;
+    return *staticWrapperSet;
+#else
+    static HashSet<DOMObject*> staticWrapperSet;
+    return staticWrapperSet;
+#endif
+}
+
+static void addWrapper(DOMObject* wrapper)
+{
+    ASSERT(!wrapperSet().contains(wrapper));
+    wrapperSet().add(wrapper);
+}
+
+static void removeWrapper(DOMObject* wrapper)
+{
+    if (!wrapper)
+        return;
+    ASSERT(wrapperSet().contains(wrapper));
+    wrapperSet().remove(wrapper);
+}
+
+static void removeWrappers(const JSWrapperCache& wrappers)
+{
+    for (JSWrapperCache::const_iterator it = wrappers.begin(); it != wrappers.end(); ++it)
+        removeWrapper(it->second);
+}
+
+DOMObject::~DOMObject()
+{
+    ASSERT(!wrapperSet().contains(this));
+}
+
+#endif
+
+class DOMObjectWrapperMap {
+public:
+    static DOMObjectWrapperMap& mapFor(JSGlobalData&);
+
+    DOMObject* get(void* objectHandle)
+    {
+        return m_map.get(objectHandle);
+    }
+
+    void set(void* objectHandle, DOMObject* wrapper)
+    {
+        addWrapper(wrapper);
+        m_map.set(objectHandle, wrapper);
+    }
+
+    void remove(void* objectHandle)
+    {
+        removeWrapper(m_map.take(objectHandle));
+    }
+
+private:
+    HashMap<void*, DOMObject*> m_map;
+};
+
+// Map from static HashTable instances to per-GlobalData ones.
+class DOMObjectHashTableMap {
+public:
+    static DOMObjectHashTableMap& mapFor(JSGlobalData&);
+
+    ~DOMObjectHashTableMap()
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator mapEnd = m_map.end();
+        for (HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.begin(); iter != m_map.end(); ++iter)
+            iter->second.deleteTable();
+    }
+
+    const JSC::HashTable* get(const JSC::HashTable* staticTable)
+    {
+        HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
+        if (iter != m_map.end())
+            return &iter->second;
+        return &m_map.set(staticTable, JSC::HashTable(*staticTable)).first->second;
+    }
+
+private:
+    HashMap<const JSC::HashTable*, JSC::HashTable> m_map;
+};
+
+class WebCoreJSClientData : public JSGlobalData::ClientData {
+public:
+    DOMObjectHashTableMap hashTableMap;
+    DOMObjectWrapperMap wrapperMap;
+};
+
+DOMObjectHashTableMap& DOMObjectHashTableMap::mapFor(JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    if (!clientData) {
+        clientData = new WebCoreJSClientData;
+        globalData.clientData = clientData;
+    }
+    return static_cast<WebCoreJSClientData*>(clientData)->hashTableMap;
+}
+
+const JSC::HashTable* getHashTableForGlobalData(JSGlobalData& globalData, const JSC::HashTable* staticTable)
+{
+    return DOMObjectHashTableMap::mapFor(globalData).get(staticTable);
+}
+
+inline DOMObjectWrapperMap& DOMObjectWrapperMap::mapFor(JSGlobalData& globalData)
+{
+    JSGlobalData::ClientData* clientData = globalData.clientData;
+    if (!clientData) {
+        clientData = new WebCoreJSClientData;
+        globalData.clientData = clientData;
+    }
+    return static_cast<WebCoreJSClientData*>(clientData)->wrapperMap;
+}
+
+DOMObject* getCachedDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle) 
+{
+    return DOMObjectWrapperMap::mapFor(globalData).get(objectHandle);
+}
+
+void cacheDOMObjectWrapper(JSGlobalData& globalData, void* objectHandle, DOMObject* wrapper) 
+{
+    DOMObjectWrapperMap::mapFor(globalData).set(objectHandle, wrapper);
+}
+
+void forgetDOMObject(JSGlobalData& globalData, void* objectHandle)
+{
+    DOMObjectWrapperMap::mapFor(globalData).remove(objectHandle);
+}
+
+JSNode* getCachedDOMNodeWrapper(Document* document, Node* node)
+{
+    if (!document)
+        return static_cast<JSNode*>(DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).get(node));
+    return document->wrapperCache().get(node);
+}
+
+void forgetDOMNode(Document* document, Node* node)
+{
+    if (!document) {
+        DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).remove(node);
+        return;
+    }
+    removeWrapper(document->wrapperCache().take(node));
+}
+
+void cacheDOMNodeWrapper(Document* document, Node* node, JSNode* wrapper)
+{
+    if (!document) {
+        DOMObjectWrapperMap::mapFor(*JSDOMWindow::commonJSGlobalData()).set(node, wrapper);
+        return;
+    }
+    addWrapper(wrapper);
+    document->wrapperCache().set(node, wrapper);
+}
+
+void forgetAllDOMNodesForDocument(Document* document)
+{
+    ASSERT(document);
+    removeWrappers(document->wrapperCache());
+}
+
+void markDOMNodesForDocument(Document* doc)
+{
+    // If a node's JS wrapper holds custom properties, those properties must
+    // persist every time the node is fetched from the DOM. So, we keep JS
+    // wrappers like that from being garbage collected.
+
+    JSWrapperCache& nodeDict = doc->wrapperCache();
+    JSWrapperCache::iterator nodeEnd = nodeDict.end();
+    for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
+        JSNode* jsNode = nodeIt->second;
+        Node* node = jsNode->impl();
+
+        if (jsNode->marked())
+            continue;
+
+        // No need to preserve a wrapper that has no custom properties or is no
+        // longer fetchable through the DOM.
+        if (!jsNode->hasCustomProperties() || !node->inDocument()) {
+            //... unless the wrapper wraps a loading image, since the "new Image"
+            // syntax allows an orphan image wrapper to be the last reference
+            // to a loading image, whose load event might have important side-effects.
+            if (!node->hasTagName(imgTag) || static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
+                continue;
+        }
+
+        jsNode->mark();
+    }
+}
+
+void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
+{
+    // If an element has pending activity that may result in listeners being called
+    // (e.g. an XMLHttpRequest), we need to keep all JS wrappers alive.
+
+    const HashMap<ActiveDOMObject*, void*>& activeObjects = scriptExecutionContext->activeDOMObjects();
+    HashMap<ActiveDOMObject*, void*>::const_iterator activeObjectsEnd = activeObjects.end();
+    for (HashMap<ActiveDOMObject*, void*>::const_iterator iter = activeObjects.begin(); iter != activeObjectsEnd; ++iter) {
+        if (iter->first->hasPendingActivity()) {
+            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, iter->second);
+            // An object with pending activity must have a wrapper to mark its listeners, so no null check.
+            if (!wrapper->marked())
+                wrapper->mark();
+        }
+    }
+
+    const HashSet<MessagePort*>& messagePorts = scriptExecutionContext->messagePorts();
+    HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end();
+    for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) {
+        if ((*iter)->hasPendingActivity()) {
+            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
+            // An object with pending activity must have a wrapper to mark its listeners, so no null check.
+            if (!wrapper->marked())
+                wrapper->mark();
+        }
+    }
+}
+
+void markCrossHeapDependentObjectsForContext(JSGlobalData& globalData, ScriptExecutionContext* scriptExecutionContext)
+{
+    const HashSet<MessagePort*>& messagePorts = scriptExecutionContext->messagePorts();
+    HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end();
+    for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) {
+        MessagePort* port = *iter;
+        RefPtr<MessagePort> entangledPort = port->entangledPort();
+        if (entangledPort) {
+            // No wrapper, or wrapper is already marked - no need to examine cross-heap dependencies.
+            DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, port);
+            if (!wrapper || wrapper->marked())
+                continue;
+
+            // Don't use cross-heap model of marking on same-heap pairs. Otherwise, they will never be destroyed, because a port will mark its entangled one,
+            // and it will never get a chance to be marked as inaccessible. So, the port will keep getting marked in this function.
+            if ((port->scriptExecutionContext() == entangledPort->scriptExecutionContext()) || (port->scriptExecutionContext()->isDocument() && entangledPort->scriptExecutionContext()->isDocument()))
+                continue;
+
+            // If the wrapper hasn't been marked during the mark phase of GC, then the port shouldn't protect its entangled one.
+            // It's important not to call this when there is no wrapper. E.g., if GC is triggered after a MessageChannel is created, but before its ports are used from JS,
+            // irreversibly telling the object that its (not yet existing) wrapper is inaccessible would be wrong. Similarly, ports posted via postMessage() may not
+            // have wrappers until delivered.
+            port->setJSWrapperIsInaccessible();
+
+            // If the port is protected by its entangled one, mark it.
+            // This is an atomic read of a boolean value, no synchronization between threads is required (at least on platforms that guarantee cache coherency).
+            if (!entangledPort->jsWrapperIsInaccessible())
+                wrapper->mark();
+        }
+    }
+}
+
+void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocument)
+{
+    ASSERT(oldDocument != newDocument);
+    JSNode* wrapper = getCachedDOMNodeWrapper(oldDocument, node);
+    if (!wrapper)
+        return;
+    removeWrapper(wrapper);
+    cacheDOMNodeWrapper(newDocument, node, wrapper);
+    forgetDOMNode(oldDocument, node);
+    addWrapper(wrapper);
+}
+
+void markDOMObjectWrapper(JSGlobalData& globalData, void* object)
+{
+    if (!object)
+        return;
+    DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
+    if (!wrapper || wrapper->marked())
+        return;
+    wrapper->mark();
+}
+
+JSValue* jsStringOrNull(ExecState* exec, const String& s)
+{
+    if (s.isNull())
+        return jsNull();
+    return jsString(exec, s);
+}
+
+JSValue* jsOwnedStringOrNull(ExecState* exec, const UString& s)
+{
+    if (s.isNull())
+        return jsNull();
+    return jsOwnedString(exec, s);
+}
+
+JSValue* jsStringOrUndefined(ExecState* exec, const String& s)
+{
+    if (s.isNull())
+        return jsUndefined();
+    return jsString(exec, s);
+}
+
+JSValue* jsStringOrFalse(ExecState* exec, const String& s)
+{
+    if (s.isNull())
+        return jsBoolean(false);
+    return jsString(exec, s);
+}
+
+JSValue* jsStringOrNull(ExecState* exec, const KURL& url)
+{
+    if (url.isNull())
+        return jsNull();
+    return jsString(exec, url.string());
+}
+
+JSValue* jsStringOrUndefined(ExecState* exec, const KURL& url)
+{
+    if (url.isNull())
+        return jsUndefined();
+    return jsString(exec, url.string());
+}
+
+JSValue* jsStringOrFalse(ExecState* exec, const KURL& url)
+{
+    if (url.isNull())
+        return jsBoolean(false);
+    return jsString(exec, url.string());
+}
+
+UString valueToStringWithNullCheck(ExecState* exec, JSValue* value)
+{
+    if (value->isNull())
+        return UString();
+    return value->toString(exec);
+}
+
+UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue* value)
+{
+    if (value->isUndefinedOrNull())
+        return UString();
+    return value->toString(exec);
+}
+
+void setDOMException(ExecState* exec, ExceptionCode ec)
+{
+    if (!ec || exec->hadException())
+        return;
+
+    ExceptionCodeDescription description;
+    getExceptionCodeDescription(ec, description);
+
+    JSValue* errorObject = noValue();
+    switch (description.type) {
+        case DOMExceptionType:
+            errorObject = toJS(exec, DOMCoreException::create(description));
+            break;
+        case RangeExceptionType:
+            errorObject = toJS(exec, RangeException::create(description));
+            break;
+        case EventExceptionType:
+            errorObject = toJS(exec, EventException::create(description));
+            break;
+        case XMLHttpRequestExceptionType:
+            errorObject = toJS(exec, XMLHttpRequestException::create(description));
+            break;
+#if ENABLE(SVG)
+        case SVGExceptionType:
+            errorObject = toJS(exec, SVGException::create(description).get(), 0);
+            break;
+#endif
+#if ENABLE(XPATH)
+        case XPathExceptionType:
+            errorObject = toJS(exec, XPathException::create(description));
+            break;
+#endif
+    }
+
+    ASSERT(errorObject);
+    exec->setException(errorObject);
+}
+
+bool checkNodeSecurity(ExecState* exec, Node* node)
+{
+    return node && allowsAccessFromFrame(exec, node->document()->frame());
+}
+
+bool allowsAccessFromFrame(ExecState* exec, Frame* frame)
+{
+    if (!frame)
+        return false;
+    JSDOMWindow* window = toJSDOMWindow(frame);
+    return window && window->allowsAccessFrom(exec);
+}
+
+bool allowsAccessFromFrame(ExecState* exec, Frame* frame, String& message)
+{
+    if (!frame)
+        return false;
+    JSDOMWindow* window = toJSDOMWindow(frame);
+    return window && window->allowsAccessFrom(exec, message);
+}
+
+void printErrorMessageForFrame(Frame* frame, const String& message)
+{
+    if (!frame)
+        return;
+    if (JSDOMWindow* window = toJSDOMWindow(frame))
+        window->printErrorMessage(message);
+}
+
+JSValue* objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+}
+
+ExecState* execStateFromNode(Node* node)
+{
+    if (!node)
+        return 0;
+    Document* document = node->document();
+    if (!document)
+        return 0;
+    Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    if (!frame->script()->isEnabled())
+        return 0;
+    return frame->script()->globalObject()->globalExec();
+}
+
+StructureID* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+{
+    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    return structures.get(classInfo).get();
+}
+
+StructureID* cacheDOMStructure(ExecState* exec, PassRefPtr<StructureID> structureID, const ClassInfo* classInfo)
+{
+    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    ASSERT(!structures.contains(classInfo));
+    return structures.set(classInfo, structureID).first->second.get();
+}
+
+JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
+{
+    JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
+    return constructors.get(classInfo);
+}
+
+void cacheDOMConstructor(ExecState* exec, const ClassInfo* classInfo, JSObject* constructor)
+{
+    JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
+    ASSERT(!constructors.contains(classInfo));
+    constructors.set(classInfo, constructor);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
new file mode 100644
index 0000000..e8040f2
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -0,0 +1,185 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSDOMBinding_h
+#define JSDOMBinding_h
+
+#include "JSDOMGlobalObject.h"
+#include <kjs/interpreter.h>
+#include <kjs/lookup.h>
+#include <runtime/JSFunction.h>
+#include <wtf/Noncopyable.h>
+
+namespace JSC {
+    class JSGlobalData;
+}
+
+namespace WebCore {
+
+    class Document;
+    class Frame;
+    class KURL;
+    class Node;
+    class String;
+    class JSNode;
+
+    typedef int ExceptionCode;
+
+#if ENABLE(SVG)
+    class SVGElement;
+#endif
+
+    // Base class for all objects in this binding except Window.
+    class DOMObject : public JSC::JSObject {
+    protected:
+        explicit DOMObject(PassRefPtr<JSC::StructureID> structureID) 
+            : JSObject(structureID)
+        {
+        }
+
+#ifndef NDEBUG
+        virtual ~DOMObject();
+#endif
+    };
+
+    DOMObject* getCachedDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle);
+    void cacheDOMObjectWrapper(JSC::JSGlobalData&, void* objectHandle, DOMObject* wrapper);
+    void forgetDOMObject(JSC::JSGlobalData&, void* objectHandle);
+
+    JSNode* getCachedDOMNodeWrapper(Document*, Node*);
+    void cacheDOMNodeWrapper(Document*, Node*, JSNode* wrapper);
+    void forgetDOMNode(Document*, Node*);
+    void forgetAllDOMNodesForDocument(Document*);
+    void updateDOMNodeDocument(Node*, Document* oldDocument, Document* newDocument);
+    void markDOMNodesForDocument(Document*);
+    void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
+    void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
+    void markCrossHeapDependentObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
+
+    JSC::StructureID* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
+    JSC::StructureID* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::StructureID>, const JSC::ClassInfo*);
+
+    JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
+    void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
+
+    template<class WrapperClass> inline JSC::StructureID* getDOMStructure(JSC::ExecState* exec)
+    {
+        if (JSC::StructureID* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
+            return structure;
+        return cacheDOMStructure(exec, WrapperClass::createStructureID(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+    }
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    {
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+    }
+    #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
+    template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
+    {
+        ASSERT(object);
+        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec), object);
+        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        return wrapper;
+    }
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue* getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
+    {
+        if (!object)
+            return JSC::jsNull();
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+            return wrapper;
+        return createDOMObjectWrapper<WrapperClass>(exec, object);
+    }
+
+#if ENABLE(SVG)
+    #define CREATE_SVG_OBJECT_WRAPPER(exec, className, object, context) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object), context)
+    template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
+    {
+        ASSERT(object);
+        ASSERT(!getCachedDOMObjectWrapper(exec->globalData(), object));
+        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec), object, context);
+        cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
+        return wrapper;
+    }
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue* getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
+    {
+        if (!object)
+            return JSC::jsNull();
+        if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+            return wrapper;
+        return createDOMObjectWrapper<WrapperClass>(exec, object, context);
+    }
+#endif
+
+    #define CREATE_DOM_NODE_WRAPPER(exec, className, object) createDOMNodeWrapper<JS##className>(exec, static_cast<className*>(object))
+    template<class WrapperClass, class DOMClass> inline JSNode* createDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
+    {
+        ASSERT(node);
+        ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+        WrapperClass* wrapper = new (exec) WrapperClass(getDOMStructure<WrapperClass>(exec), node);
+        cacheDOMNodeWrapper(node->document(), node, wrapper);
+        return wrapper;
+    }
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue* getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
+    {
+        if (!node)
+            return JSC::jsNull();
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node))
+            return wrapper;
+        return createDOMNodeWrapper<WrapperClass>(exec, node);
+    }
+
+    const JSC::HashTable* getHashTableForGlobalData(JSC::JSGlobalData&, const JSC::HashTable* staticTable);
+
+    // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
+    void setDOMException(JSC::ExecState*, ExceptionCode);
+
+    JSC::JSValue* jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
+    JSC::JSValue* jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
+
+    JSC::JSValue* jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
+    JSC::JSValue* jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
+
+    JSC::JSValue* jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
+    JSC::JSValue* jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
+
+    // See JavaScriptCore for explanation: Should be used for any UString that is already owned by another
+    // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
+    JSC::JSValue* jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
+
+    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue*); // null if the value is null
+    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue*); // null if the value is null or undefined
+
+    template <typename T> inline JSC::JSValue* toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
+
+    bool checkNodeSecurity(JSC::ExecState*, Node*);
+
+    // Helpers for Window, History, and Location classes to implement cross-domain policy.
+    // Besides the cross-domain check, they need non-caching versions of staticFunctionGetter for
+    // because we do not want current property values involved at all.
+    bool allowsAccessFromFrame(JSC::ExecState*, Frame*);
+    bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
+    void printErrorMessageForFrame(Frame*, const String& message);
+    JSC::JSValue* objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+
+    JSC::ExecState* execStateFromNode(Node*);
+
+} // namespace WebCore
+
+#endif // JSDOMBinding_h
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.cpp b/WebCore/bindings/js/JSDOMGlobalObject.cpp
new file mode 100644
index 0000000..d9dae37
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "JSDOMGlobalObject.h"
+
+#include "Document.h"
+#include "JSDOMWindow.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData()
+    : evt(0)
+{
+}
+
+JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<StructureID> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
+    : JSGlobalObject(structure, data, thisValue)
+{
+}
+
+JSDOMGlobalObject::~JSDOMGlobalObject()
+{
+    // Clear any backpointers to the window
+    ListenersMap::iterator i1 = d()->jsEventListeners.begin();
+    ListenersMap::iterator e1 = d()->jsEventListeners.end();
+    for (; i1 != e1; ++i1)
+        i1->second->clearGlobalObject();
+
+    i1 = d()->jsInlineEventListeners.begin();
+    e1 = d()->jsInlineEventListeners.end();
+    for (; i1 != e1; ++i1)
+        i1->second->clearGlobalObject();
+
+    UnprotectedListenersMap::iterator i2 = d()->jsUnprotectedEventListeners.begin();
+    UnprotectedListenersMap::iterator e2 = d()->jsUnprotectedEventListeners.end();
+    for (; i2 != e2; ++i2)
+        i2->second->clearGlobalObject();
+
+    i2 = d()->jsUnprotectedInlineEventListeners.begin();
+    e2 = d()->jsUnprotectedInlineEventListeners.end();
+    for (; i2 != e2; ++i2)
+        i2->second->clearGlobalObject();
+}
+
+void JSDOMGlobalObject::mark()
+{
+    Base::mark();
+
+    JSDOMStructureMap::iterator end = structures().end();
+    for (JSDOMStructureMap::iterator it = structures().begin(); it != end; ++it)
+        it->second->mark();
+
+    JSDOMConstructorMap::iterator end2 = constructors().end();
+    for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2) {
+        if (!it2->second->marked())
+            it2->second->mark();
+    }
+}
+
+JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue* val, bool isInline)
+{
+    if (!val->isObject())
+        return 0;
+    JSObject* object = asObject(val);
+    ListenersMap& listeners = isInline ? d()->jsInlineEventListeners : d()->jsEventListeners;
+    return listeners.get(object);
+}
+
+PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(ExecState* exec, JSValue* val, bool isInline)
+{
+    if (JSEventListener* listener = findJSEventListener(val, isInline))
+        return listener;
+
+    if (!val->isObject())
+        return 0;
+
+    // The JSEventListener constructor adds it to our jsEventListeners map.
+    return JSEventListener::create(asObject(val), this, isInline).get();
+}
+
+JSUnprotectedEventListener* JSDOMGlobalObject::findJSUnprotectedEventListener(ExecState* exec, JSValue* val, bool isInline)
+{
+    if (!val->isObject())
+        return 0;
+
+    UnprotectedListenersMap& listeners = isInline ? d()->jsUnprotectedInlineEventListeners : d()->jsUnprotectedEventListeners;
+    return listeners.get(asObject(val));
+}
+
+PassRefPtr<JSUnprotectedEventListener> JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener(ExecState* exec, JSValue* val, bool isInline)
+{
+    if (JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, val, isInline))
+        return listener;
+
+    if (!val->isObject())
+        return 0;
+
+    // The JSUnprotectedEventListener constructor adds it to our jsUnprotectedEventListeners map.
+    return JSUnprotectedEventListener::create(asObject(val), this, isInline).get();
+}
+
+JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsEventListeners()
+{
+    return d()->jsEventListeners;
+}
+
+JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsInlineEventListeners()
+{
+    return d()->jsInlineEventListeners;
+}
+
+JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedEventListeners()
+{
+    return d()->jsUnprotectedEventListeners;
+}
+
+JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedInlineEventListeners()
+{
+    return d()->jsUnprotectedInlineEventListeners;
+}
+
+void JSDOMGlobalObject::setCurrentEvent(Event* evt)
+{
+    d()->evt = evt;
+}
+
+Event* JSDOMGlobalObject::currentEvent()
+{
+    return d()->evt;
+}
+
+JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext* scriptExecutionContext)
+{
+    if (scriptExecutionContext->isDocument())
+        return toJSDOMWindow(static_cast<Document*>(scriptExecutionContext)->frame());
+
+    // Not implemented yet.
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
new file mode 100644
index 0000000..3c210bb
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef JSDOMGlobalObject_h
+#define JSDOMGlobalObject_h
+
+#include <runtime/JSGlobalObject.h>
+
+namespace WebCore {
+
+    class Event;
+    class JSEventListener;
+    class JSUnprotectedEventListener;
+    class ScriptExecutionContext;
+
+    typedef HashMap<const JSC::ClassInfo*, RefPtr<JSC::StructureID> > JSDOMStructureMap;
+    typedef HashMap<const JSC::ClassInfo*, JSC::JSObject*> JSDOMConstructorMap;
+
+    class JSDOMGlobalObject : public JSC::JSGlobalObject {
+        typedef JSC::JSGlobalObject Base;
+    protected:
+        struct JSDOMGlobalObjectData;
+
+        JSDOMGlobalObject(PassRefPtr<JSC::StructureID>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
+        virtual ~JSDOMGlobalObject();
+
+    public:
+        JSDOMStructureMap& structures() { return d()->structures; }
+        JSDOMConstructorMap& constructors() const { return d()->constructors; }
+
+        virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
+
+        // Finds a wrapper of a JS EventListener, returns 0 if no existing one.
+        JSEventListener* findJSEventListener(JSC::JSValue*, bool isInline = false);
+
+        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is GC-protected.
+        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::ExecState*, JSC::JSValue*, bool isInline = false);
+
+        // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
+        JSUnprotectedEventListener* findJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValue*, bool isInline = false);
+
+        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
+        PassRefPtr<JSUnprotectedEventListener> findOrCreateJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValue*, bool isInline = false);
+
+        typedef HashMap<JSC::JSObject*, JSEventListener*> ListenersMap;
+        typedef HashMap<JSC::JSObject*, JSUnprotectedEventListener*> UnprotectedListenersMap;
+
+        ListenersMap& jsEventListeners();
+        ListenersMap& jsInlineEventListeners();
+        UnprotectedListenersMap& jsUnprotectedEventListeners();
+        UnprotectedListenersMap& jsUnprotectedInlineEventListeners();
+
+        void setCurrentEvent(Event*);
+        Event* currentEvent();
+
+        virtual void mark();
+
+    protected:
+        struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
+            JSDOMGlobalObjectData();
+
+            JSDOMStructureMap structures;
+            JSDOMConstructorMap constructors;
+
+            JSDOMGlobalObject::ListenersMap jsEventListeners;
+            JSDOMGlobalObject::ListenersMap jsInlineEventListeners;
+            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedEventListeners;
+            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedInlineEventListeners;
+
+            Event* evt;
+        };
+
+    private:
+        JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
+    };
+
+    template<class ConstructorClass>
+    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec)
+    {
+        if (JSC::JSObject* constructor = getCachedDOMConstructor(exec, &ConstructorClass::s_info))
+            return constructor;
+        JSC::JSObject* constructor = new (exec) ConstructorClass(exec);
+        cacheDOMConstructor(exec, &ConstructorClass::s_info, constructor);
+        return constructor;
+    }
+
+    template<class ConstructorClass>
+    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
+    {
+        if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info))
+            return constructor;
+        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, globalObject->scriptExecutionContext());
+        ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
+        globalObject->constructors().set(&ConstructorClass::s_info, constructor);
+        return constructor;
+    }
+
+    JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext*);
+
+} // namespace WebCore
+
+#endif // JSDOMGlobalObject_h
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
new file mode 100644
index 0000000..4ec39cd
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -0,0 +1,1039 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ */
+
+#include "config.h"
+#include "JSDOMWindowBase.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Element.h"
+#include "EventListener.h"
+#include "ExceptionCode.h"
+#include "FloatRect.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "GCController.h"
+#include "HTMLDocument.h"
+#include "InspectorController.h"
+#include "JSAudioConstructor.h"
+#include "JSDedicatedWorkerConstructor.h"
+#include "JSDOMWindowCustom.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+#include "JSHTMLCollection.h"
+#include "JSImageConstructor.h"
+#include "JSMessageChannelConstructor.h"
+#include "JSNode.h"
+#include "JSOptionConstructor.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "JSXSLTProcessorConstructor.h"
+#include "Logging.h"
+#include "MediaPlayer.h"
+#include "Page.h"
+#include "PausedTimeouts.h"
+#include "PlatformScreen.h"
+#include "PluginInfoStore.h"
+#include "RenderView.h"
+#include "ScheduledAction.h"
+#include "ScriptController.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
+#include "WindowFeatures.h"
+#include "htmlediting.h"
+#include <runtime/Error.h>
+#include <runtime/JSLock.h>
+#include <wtf/AlwaysInline.h>
+#include <wtf/MathExtras.h>
+
+using namespace JSC;
+
+static JSValue* windowProtoFuncOpen(ExecState*, JSObject*, JSValue*, const ArgList&);
+static JSValue* windowProtoFuncShowModalDialog(ExecState*, JSObject*, JSValue*, const ArgList&);
+static JSValue* windowProtoFuncNotImplemented(ExecState*, JSObject*, JSValue*, const ArgList&);
+
+static JSValue* jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue* jsDOMWindowBaseEvent(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseEvent(ExecState*, JSObject*, JSValue*);
+
+// Constructors
+static JSValue* jsDOMWindowBaseAudio(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseAudio(ExecState*, JSObject*, JSValue*);
+static JSValue* jsDOMWindowBaseImage(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseImage(ExecState*, JSObject*, JSValue*);
+static JSValue* jsDOMWindowBaseMessageChannel(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseMessageChannel(ExecState*, JSObject*, JSValue*);
+static JSValue* jsDOMWindowBaseWorker(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseWorker(ExecState*, JSObject*, JSValue*);
+static JSValue* jsDOMWindowBaseOption(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseOption(ExecState*, JSObject*, JSValue*);
+static JSValue* jsDOMWindowBaseXMLHttpRequest(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseXMLHttpRequest(ExecState*, JSObject*, JSValue*);
+static JSValue* jsDOMWindowBaseXSLTProcessor(ExecState*, const Identifier&, const PropertySlot&);
+static void setJSDOMWindowBaseXSLTProcessor(ExecState*, JSObject*, JSValue*);
+
+#include "JSDOMWindowBase.lut.h"
+
+namespace WebCore {
+
+static int lastUsedTimeoutId;
+
+static int timerNestingLevel = 0;
+const int cMaxTimerNestingLevel = 5;
+const double cMinimumTimerInterval = 0.010;
+
+class DOMWindowTimer : public TimerBase {
+public:
+    DOMWindowTimer(int timeoutId, int nestingLevel, JSDOMWindowBase* object, ScheduledAction* action)
+        : m_timeoutId(timeoutId)
+        , m_nestingLevel(nestingLevel)
+        , m_object(object)
+        , m_action(action)
+    {
+    }
+
+    virtual ~DOMWindowTimer()
+    {
+        JSLock lock(false);
+        delete m_action;
+    }
+
+    int timeoutId() const { return m_timeoutId; }
+
+    int nestingLevel() const { return m_nestingLevel; }
+    void setNestingLevel(int n) { m_nestingLevel = n; }
+
+    ScheduledAction* action() const { return m_action; }
+    ScheduledAction* takeAction() { ScheduledAction* a = m_action; m_action = 0; return a; }
+
+private:
+    virtual void fired();
+
+    int m_timeoutId;
+    int m_nestingLevel;
+    JSDOMWindowBase* m_object;
+    ScheduledAction* m_action;
+};
+
+////////////////////// JSDOMWindowBase Object ////////////////////////
+
+const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, &JSDOMWindowBaseTable, 0 };
+
+/*
+@begin JSDOMWindowBaseTable
+# -- Functions --
+  open                          windowProtoFuncOpen                         DontDelete|Function 3
+  showModalDialog               windowProtoFuncShowModalDialog              DontDelete|Function 1
+# Not implemented
+  captureEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
+  releaseEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
+# -- Attributes --
+  crypto                        jsDOMWindowBaseCrypto                       DontDelete|ReadOnly
+  event                         jsDOMWindowBaseEvent                        DontDelete
+# -- Constructors --
+  Audio                         jsDOMWindowBaseAudio                        DontDelete
+  Image                         jsDOMWindowBaseImage                        DontDelete
+  MessageChannel                jsDOMWindowBaseMessageChannel               DontDelete
+  Option                        jsDOMWindowBaseOption                       DontDelete
+  Worker                        jsDOMWindowBaseWorker                       DontDelete
+  XMLHttpRequest                jsDOMWindowBaseXMLHttpRequest               DontDelete
+  XSLTProcessor                 jsDOMWindowBaseXSLTProcessor                DontDelete
+@end
+*/
+
+JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : impl(window)
+    , returnValueSlot(0)
+    , shell(shell)
+{
+}
+
+JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<StructureID> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+    : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
+{
+    // Time in milliseconds before the script timeout handler kicks in.
+    setTimeoutTime(10000);
+
+    GlobalPropertyInfo staticGlobals[] = {
+        GlobalPropertyInfo(Identifier(globalExec(), "document"), jsNull(), DontDelete | ReadOnly),
+        GlobalPropertyInfo(Identifier(globalExec(), "window"), d()->shell, DontDelete | ReadOnly)
+    };
+    
+    addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
+}
+
+void JSDOMWindowBase::updateDocument()
+{
+    ASSERT(d()->impl->document());
+    ExecState* exec = globalExec();
+    symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, d()->impl->document()), DontDelete | ReadOnly);
+}
+
+JSDOMWindowBase::~JSDOMWindowBase()
+{
+    if (d()->impl->frame())
+        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
+
+    clearAllTimeouts();
+}
+
+ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
+{
+    return d()->impl->document();
+}
+
+static bool allowPopUp(ExecState* exec)
+{
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+
+    ASSERT(frame);
+    if (frame->script()->processingUserGesture())
+        return true;
+    Settings* settings = frame->settings();
+    return settings && settings->JavaScriptCanOpenWindowsAutomatically();
+}
+
+static HashMap<String, String> parseModalDialogFeatures(const String& featuresArg)
+{
+    HashMap<String, String> map;
+
+    Vector<String> features;
+    featuresArg.split(';', features);
+    Vector<String>::const_iterator end = features.end();
+    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
+        String s = *it;
+        int pos = s.find('=');
+        int colonPos = s.find(':');
+        if (pos >= 0 && colonPos >= 0)
+            continue; // ignore any strings that have both = and :
+        if (pos < 0)
+            pos = colonPos;
+        if (pos < 0) {
+            // null string for value means key without value
+            map.set(s.stripWhiteSpace().lower(), String());
+        } else {
+            String key = s.left(pos).stripWhiteSpace().lower();
+            String val = s.substring(pos + 1).stripWhiteSpace().lower();
+            int spacePos = val.find(' ');
+            if (spacePos != -1)
+                val = val.left(spacePos);
+            map.set(key, val);
+        }
+    }
+
+    return map;
+}
+
+static Frame* createWindow(ExecState* exec, Frame* openerFrame, const String& url,
+    const String& frameName, const WindowFeatures& windowFeatures, JSValue* dialogArgs)
+{
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    ASSERT(activeFrame);
+
+    ResourceRequest request;
+
+    request.setHTTPReferrer(activeFrame->loader()->outgoingReferrer());
+    FrameLoader::addHTTPOriginIfNeeded(request, activeFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL, here where we
+    // know what URL we are going to open. Unfortunately, this code passes the empty string
+    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
+    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
+    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
+    // We'd have to resolve all those issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
+    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = activeFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->loader()->setOpenedByDOM();
+
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+
+    if (dialogArgs)
+        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
+
+    if (!protocolIs(url, "javascript") || newWindow->allowsAccessFrom(exec)) {
+        KURL completedURL = url.isEmpty() ? KURL("") : activeFrame->document()->completeURL(url);
+        bool userGesture = activeFrame->script()->processingUserGesture();
+
+        if (created)
+            newFrame->loader()->changeLocation(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->loader()->scheduleLocationChange(completedURL.string(), activeFrame->loader()->outgoingReferrer(), false, userGesture);
+    }
+
+    return newFrame;
+}
+
+static bool canShowModalDialog(const Frame* frame)
+{
+    if (!frame)
+        return false;
+
+#ifdef ANDROID_FIX
+    // Note for integration: this fix came from Webkit
+    Page* page = frame->page();
+    if (!page)
+        return false;
+
+    return page->chrome()->canRunModal();
+#else
+    return frame->page()->chrome()->canRunModal();
+#endif
+}
+
+static bool canShowModalDialogNow(const Frame* frame)
+{
+    if (!frame)
+        return false;
+
+#ifdef ANDROID_FIX
+    // Note for integration: this fix came from Webkit
+    Page* page = frame->page();
+    if (!page)
+        return false;
+
+    return page->chrome()->canRunModalNow();
+#else
+    return frame->page()->chrome()->canRunModalNow();
+#endif
+}
+
+static JSValue* showModalDialog(ExecState* exec, Frame* frame, const String& url, JSValue* dialogArgs, const String& featureArgs)
+{
+    if (!canShowModalDialogNow(frame) || !allowPopUp(exec))
+        return jsUndefined();
+
+    const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
+
+    const bool trusted = false;
+
+    // The following features from Microsoft's documentation are not implemented:
+    // - default font settings
+    // - width, height, left, and top specified in units other than "px"
+    // - edge (sunken or raised, default is raised)
+    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
+    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
+    // - unadorned: trusted && boolFeature(features, "unadorned");
+
+    if (!frame)
+        return jsUndefined();
+
+    FloatRect screenRect = screenAvailableRect(frame->view());
+
+    WindowFeatures wargs;
+    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
+    wargs.widthSet = true;
+    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
+    wargs.heightSet = true;
+
+    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
+    wargs.xSet = wargs.x > 0;
+    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
+    wargs.ySet = wargs.y > 0;
+
+    if (WindowFeatures::boolFeature(features, "center", true)) {
+        if (!wargs.xSet) {
+            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
+            wargs.xSet = true;
+        }
+        if (!wargs.ySet) {
+            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
+            wargs.ySet = true;
+        }
+    }
+
+    wargs.dialog = true;
+    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
+    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
+    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
+    wargs.menuBarVisible = false;
+    wargs.toolBarVisible = false;
+    wargs.locationBarVisible = false;
+    wargs.fullscreen = false;
+
+    Frame* dialogFrame = createWindow(exec, frame, url, "", wargs, dialogArgs);
+    if (!dialogFrame)
+        return jsUndefined();
+
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+
+    // Get the return value either just before clearing the dialog window's
+    // properties (in JSDOMWindowBase::clear), or when on return from runModal.
+    JSValue* returnValue = noValue();
+    dialogWindow->setReturnValueSlot(&returnValue);
+    dialogFrame->page()->chrome()->runModal();
+    dialogWindow->setReturnValueSlot(0);
+
+    // If we don't have a return value, get it now.
+    // Either JSDOMWindowBase::clear was not called yet, or there was no return value,
+    // and in that case, there's no harm in trying again (no benefit either).
+    if (!returnValue)
+        returnValue = dialogWindow->getDirect(Identifier(exec, "returnValue"));
+
+    return returnValue ? returnValue : jsUndefined();
+}
+
+} // namespace WebCore
+
+using namespace WebCore;
+
+JSValue* jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&)
+{
+    return jsUndefined(); // FIXME: implement this
+}
+
+JSValue* jsDOMWindowBaseEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent())
+        return jsUndefined();
+    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent());
+}
+
+JSValue* jsDOMWindowBaseImage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return getDOMConstructor<JSImageConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
+}
+
+JSValue* jsDOMWindowBaseMessageChannel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return getDOMConstructor<JSMessageChannelConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
+}
+
+JSValue* jsDOMWindowBaseOption(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return getDOMConstructor<JSOptionConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
+}
+
+JSValue* jsDOMWindowBaseXMLHttpRequest(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
+}
+
+JSValue* jsDOMWindowBaseAudio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+#if ENABLE(VIDEO)
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    if (!MediaPlayer::isAvailable())
+        return jsUndefined();
+    return getDOMConstructor<JSAudioConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
+#else
+    return jsUndefined();
+#endif
+}
+
+JSValue* jsDOMWindowBaseWorker(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+#if ENABLE(WORKERS)
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return getDOMConstructor<JSDedicatedWorkerConstructor>(exec);
+#else
+    return jsUndefined();
+#endif
+}
+
+JSValue* jsDOMWindowBaseXSLTProcessor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+#if ENABLE(XSLT)
+    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
+#else
+    return jsUndefined();
+#endif
+}
+
+namespace WebCore {
+
+JSValue* JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
+}
+
+JSValue* JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
+}
+
+JSValue* JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSDOMWindowBase* thisObj = static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()));
+    Document* doc = thisObj->impl()->frame()->document();
+    ASSERT(thisObj->allowsAccessFrom(exec));
+    ASSERT(doc);
+    ASSERT(doc->isHTMLDocument());
+
+    RefPtr<HTMLCollection> collection = doc->windowNamedItems(propertyName);
+    if (collection->length() == 1)
+        return toJS(exec, collection->firstItem());
+    return toJS(exec, collection.get());
+}
+
+void JSDOMWindowBase::markCrossHeapDependentObjects()
+{
+    Document* document = impl()->document();
+    if (!document)
+        return;
+
+    markCrossHeapDependentObjectsForContext(*globalData(), document);
+}
+
+bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        slot.setCustom(this, childFrameGetter);
+        return true;
+    }
+
+    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == windowProtoFuncShowModalDialog) {
+                if (!canShowModalDialog(impl()->frame()))
+                    return false;
+            }
+            if (allowsAccessFrom(exec))
+                setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
+            else
+                slot.setUndefined();
+        } else
+            slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue* proto = prototype();
+    if (proto->isObject()) {
+        if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
+            if (!allowsAccessFrom(exec))
+                slot.setUndefined();
+            return true;
+        }
+    }
+
+    // FIXME: Search the whole frame hierachy somewhere around here.
+    // We need to test the correct priority order.
+
+    // allow window[1] or parent[1] etc. (#56983)
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        slot.setCustomIndex(this, i, indexGetter);
+        return true;
+    }
+
+    if (!allowsAccessFrom(exec)) {
+        slot.setUndefined();
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document && document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            slot.setCustom(this, namedItemGetter);
+            return true;
+        }
+    }
+
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot& slot)
+{
+    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (allowsAccessFrom(exec))
+                Base::put(exec, propertyName, value, slot);
+            return;
+        }
+        if (entry->attributes() & ReadOnly)
+            return;
+
+        // Don't call the put function for replacable properties.
+        if (!(entry->propertyPutter() == setJSDOMWindowBaseEvent
+                || entry->propertyPutter() == setJSDOMWindowBaseAudio
+                || entry->propertyPutter() == setJSDOMWindowBaseImage
+                || entry->propertyPutter() == setJSDOMWindowBaseOption
+                || entry->propertyPutter() == setJSDOMWindowBaseMessageChannel
+                || entry->propertyPutter() == setJSDOMWindowBaseWorker
+                || entry->propertyPutter() == setJSDOMWindowBaseXMLHttpRequest
+                || entry->propertyPutter() == setJSDOMWindowBaseXSLTProcessor)) {
+            entry->propertyPutter()(exec, this, value);
+            return;
+        }
+    }
+
+    if (allowsAccessFrom(exec))
+        Base::put(exec, propertyName, value, slot);
+}
+
+} // namespace WebCore
+
+void setJSDOMWindowBaseEvent(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseAudio(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseImage(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseMessageChannel(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseOption(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseWorker(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseXMLHttpRequest(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void setJSDOMWindowBaseXSLTProcessor(ExecState*, JSObject*, JSValue*)
+{
+    ASSERT_NOT_REACHED();
+}
+
+namespace WebCore {
+
+String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
+{
+    KURL originURL = asJSDOMWindow(other)->impl()->url();
+    KURL targetURL = impl()->frame()->document()->url();
+    if (originURL.isNull() || targetURL.isNull())
+        return String();
+
+    // FIXME: this error message should contain more specifics of why the same origin check has failed.
+    return String::format("Unsafe JavaScript attempt to access frame with URL %s from frame with URL %s. Domains, protocols and ports must match.\n",
+        targetURL.string().utf8().data(), originURL.string().utf8().data());
+}
+
+void JSDOMWindowBase::printErrorMessage(const String& message) const
+{
+    if (message.isEmpty())
+        return;
+
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return;
+
+    Settings* settings = frame->settings();
+    if (!settings)
+        return;
+    
+    if (settings->privateBrowsingEnabled())
+        return;
+
+    impl()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, 1, String()); // FIXME: provide a real line number and source URL.
+}
+
+ExecState* JSDOMWindowBase::globalExec()
+{
+    // We need to make sure that any script execution happening in this
+    // frame does not destroy it
+    if (Frame *frame = impl()->frame())
+        frame->keepAlive();
+    return Base::globalExec();
+}
+
+bool JSDOMWindowBase::supportsProfiling() const
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return false;
+
+    Page* page = frame->page();
+    if (!page)
+        return false;
+
+    return page->inspectorController()->profilerEnabled();
+}
+
+bool JSDOMWindowBase::shouldInterruptScript() const
+{
+    ASSERT(impl()->frame());
+    Page* page = impl()->frame()->page();
+
+    // See <rdar://problem/5479443>. We don't think that page can ever be NULL
+    // in this case, but if it is, we've gotten into a state where we may have
+    // hung the UI, with no way to ask the client whether to cancel execution.
+    // For now, our solution is just to cancel execution no matter what,
+    // ensuring that we never hang. We might want to consider other solutions
+    // if we discover problems with this one.
+    ASSERT(page);
+    if (!page)
+        return true;
+
+    return page->chrome()->shouldInterruptJavaScript();
+}
+
+void JSDOMWindowBase::clearHelperObjectProperties()
+{
+    setCurrentEvent(0);
+}
+
+void JSDOMWindowBase::clear()
+{
+    JSLock lock(false);
+
+    if (d()->returnValueSlot && !*d()->returnValueSlot)
+        *d()->returnValueSlot = getDirect(Identifier(globalExec(), "returnValue"));
+
+    clearAllTimeouts();
+    clearHelperObjectProperties();
+}
+
+JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
+{
+    return shell();
+}
+
+JSDOMWindowShell* JSDOMWindowBase::shell() const
+{
+    return d()->shell;
+}
+
+JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
+{
+    static JSGlobalData* globalData = JSGlobalData::createLeaked().releaseRef();
+    return globalData;
+}
+
+} // namespace WebCore
+
+using namespace WebCore;
+
+JSValue* windowProtoFuncOpen(ExecState* exec, JSObject*, JSValue* thisValue, const ArgList& args)
+{
+    JSDOMWindow* window = toJSDOMWindow(thisValue);
+    if (!window)
+        return throwError(exec, TypeError);
+    if (!window->allowsAccessFrom(exec))
+        return jsUndefined();
+
+    Frame* frame = window->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return  jsUndefined();
+
+    Page* page = frame->page();
+
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    AtomicString frameName = args.at(exec, 1)->isUndefinedOrNull() ? "_blank" : AtomicString(args.at(exec, 1)->toString(exec));
+
+    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
+    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
+    if (!allowPopUp(exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+        return jsUndefined();
+
+    // Get the target frame for the special cases of _top and _parent.  In those
+    // cases, we can schedule a location change right now and return early.
+    bool topOrParent = false;
+    if (frameName == "_top") {
+        frame = frame->tree()->top();
+        topOrParent = true;
+    } else if (frameName == "_parent") {
+        if (Frame* parent = frame->tree()->parent())
+            frame = parent;
+        topOrParent = true;
+    }
+    if (topOrParent) {
+        if (!activeFrame->loader()->shouldAllowNavigation(frame))
+            return jsUndefined();
+
+        String completedURL;
+        if (!urlString.isEmpty())
+            completedURL = activeFrame->document()->completeURL(urlString).string();
+
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        if (!completedURL.isEmpty() && (!protocolIs(completedURL, "javascript") || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
+            bool userGesture = activeFrame->script()->processingUserGesture();
+            frame->loader()->scheduleLocationChange(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+        }
+        return toJS(exec, frame->domWindow());
+    }
+
+    // In the case of a named frame or a new window, we'll use the createWindow() helper
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
+    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
+                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
+    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
+
+    windowFeatures.x = windowRect.x();
+    windowFeatures.y = windowRect.y();
+    windowFeatures.height = windowRect.height();
+    windowFeatures.width = windowRect.width();
+
+    frame = createWindow(exec, frame, urlString, frameName, windowFeatures, noValue());
+
+    if (!frame)
+        return jsUndefined();
+
+    return toJS(exec, frame->domWindow()); // global object
+}
+
+JSValue* windowProtoFuncShowModalDialog(ExecState* exec, JSObject*, JSValue* thisValue, const ArgList& args)
+{
+    JSDOMWindow* window = toJSDOMWindow(thisValue);
+    if (!window)
+        return throwError(exec, TypeError);
+    if (!window->allowsAccessFrom(exec))
+        return jsUndefined();
+
+    Frame* frame = window->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+
+    return showModalDialog(exec, frame, valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0)), args.at(exec, 1), valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
+}
+
+JSValue* windowProtoFuncNotImplemented(ExecState* exec, JSObject*, JSValue* thisValue, const ArgList&)
+{
+    if (!toJSDOMWindow(thisValue))
+        return throwError(exec, TypeError);
+    return jsUndefined();
+}
+
+namespace WebCore {
+
+void JSDOMWindowBase::setReturnValueSlot(JSValue** slot)
+{
+    d()->returnValueSlot = slot;
+}
+
+////////////////////// timeouts ////////////////////////
+
+void JSDOMWindowBase::clearAllTimeouts()
+{
+    deleteAllValues(d()->timeouts);
+    d()->timeouts.clear();
+}
+
+int JSDOMWindowBase::installTimeout(ScheduledAction* a, int t, bool singleShot)
+{
+    int timeoutId = ++lastUsedTimeoutId;
+
+    // avoid wraparound going negative on us
+    if (timeoutId <= 0)
+        timeoutId = 1;
+
+    int nestLevel = timerNestingLevel + 1;
+    DOMWindowTimer* timer = new DOMWindowTimer(timeoutId, nestLevel, this, a);
+    ASSERT(!d()->timeouts.get(timeoutId));
+    d()->timeouts.set(timeoutId, timer);
+    // Use a minimum interval of 10 ms to match other browsers, but only once we've
+    // nested enough to notice that we're repeating.
+    // Faster timers might be "better", but they're incompatible.
+    double interval = max(0.001, t * 0.001);
+    if (interval < cMinimumTimerInterval && nestLevel >= cMaxTimerNestingLevel)
+        interval = cMinimumTimerInterval;
+    if (singleShot)
+        timer->startOneShot(interval);
+    else
+        timer->startRepeating(interval);
+    return timeoutId;
+}
+
+int JSDOMWindowBase::installTimeout(const UString& handler, int t, bool singleShot)
+{
+    return installTimeout(new ScheduledAction(handler), t, singleShot);
+}
+
+int JSDOMWindowBase::installTimeout(ExecState* exec, JSValue* func, const ArgList& args, int t, bool singleShot)
+{
+    return installTimeout(new ScheduledAction(exec, func, args), t, singleShot);
+}
+
+void JSDOMWindowBase::pauseTimeouts(OwnPtr<PausedTimeouts>& result)
+{
+    size_t timeoutsCount = d()->timeouts.size();
+    if (!timeoutsCount) {
+        result.clear();
+        return;
+    }
+
+    PausedTimeout* t = new PausedTimeout[timeoutsCount];
+    result.set(new PausedTimeouts(t, timeoutsCount));
+
+    JSDOMWindowBaseData::TimeoutsMap::iterator it = d()->timeouts.begin();
+    for (size_t i = 0; i != timeoutsCount; ++i, ++it) {
+        int timeoutId = it->first;
+        DOMWindowTimer* timer = it->second;
+        t[i].timeoutId = timeoutId;
+        t[i].nestingLevel = timer->nestingLevel();
+        t[i].nextFireInterval = timer->nextFireInterval();
+        t[i].repeatInterval = timer->repeatInterval();
+        t[i].action = timer->takeAction();
+    }
+    ASSERT(it == d()->timeouts.end());
+
+    deleteAllValues(d()->timeouts);
+    d()->timeouts.clear();
+}
+
+void JSDOMWindowBase::resumeTimeouts(OwnPtr<PausedTimeouts>& timeouts)
+{
+    if (!timeouts)
+        return;
+    size_t count = timeouts->numTimeouts();
+    PausedTimeout* array = timeouts->takeTimeouts();
+    for (size_t i = 0; i != count; ++i) {
+        int timeoutId = array[i].timeoutId;
+        DOMWindowTimer* timer = new DOMWindowTimer(timeoutId, array[i].nestingLevel, this, array[i].action);
+        d()->timeouts.set(timeoutId, timer);
+        timer->start(array[i].nextFireInterval, array[i].repeatInterval);
+    }
+    delete [] array;
+    timeouts.clear();
+}
+
+void JSDOMWindowBase::removeTimeout(int timeoutId, bool delAction)
+{
+    // timeout IDs have to be positive, and 0 and -1 are unsafe to
+    // even look up since they are the empty and deleted value
+    // respectively
+    if (timeoutId <= 0)
+        return;
+
+    delete d()->timeouts.take(timeoutId);
+}
+
+void JSDOMWindowBase::timerFired(DOMWindowTimer* timer)
+{
+    // Simple case for non-one-shot timers.
+    if (timer->isActive()) {
+        int timeoutId = timer->timeoutId();
+
+        timer->action()->execute(shell());
+        // The DOMWindowTimer object may have been deleted or replaced during execution,
+        // so we re-fetch it.
+        timer = d()->timeouts.get(timeoutId);
+        if (!timer)
+            return;
+
+        if (timer->repeatInterval() && timer->repeatInterval() < cMinimumTimerInterval) {
+            timer->setNestingLevel(timer->nestingLevel() + 1);
+            if (timer->nestingLevel() >= cMaxTimerNestingLevel)
+                timer->augmentRepeatInterval(cMinimumTimerInterval - timer->repeatInterval());
+        }
+        return;
+    }
+
+    // Delete timer before executing the action for one-shot timers.
+    ScheduledAction* action = timer->takeAction();
+    d()->timeouts.remove(timer->timeoutId());
+    delete timer;
+    action->execute(shell());
+
+    JSLock lock(false);
+    delete action;
+}
+
+void JSDOMWindowBase::disconnectFrame()
+{
+    clearAllTimeouts();
+}
+
+void DOMWindowTimer::fired()
+{
+    timerNestingLevel = m_nestingLevel;
+    m_object->timerFired(this);
+    timerNestingLevel = 0;
+}
+
+JSValue* toJS(ExecState*, DOMWindow* domWindow)
+{
+    if (!domWindow)
+        return jsNull();
+    Frame* frame = domWindow->frame();
+    if (!frame)
+        return jsNull();
+    return frame->script()->windowShell();
+}
+
+JSDOMWindow* toJSDOMWindow(Frame* frame)
+{
+    if (!frame)
+        return 0;
+    return frame->script()->windowShell()->window();
+}
+
+JSDOMWindow* toJSDOMWindow(JSValue* value)
+{
+    if (!value->isObject())
+        return 0;
+    const ClassInfo* classInfo = asObject(value)->classInfo();
+    if (classInfo == &JSDOMWindow::s_info)
+        return static_cast<JSDOMWindow*>(asObject(value));
+    if (classInfo == &JSDOMWindowShell::s_info)
+        return static_cast<JSDOMWindowShell*>(asObject(value))->window();
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
new file mode 100644
index 0000000..f345f47
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -0,0 +1,144 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSDOMWindowBase_h
+#define JSDOMWindowBase_h
+
+#include "PlatformString.h"
+#include "JSDOMBinding.h"
+#include <kjs/protect.h>
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+    class AtomicString;
+    class DOMWindow;
+    class DOMWindowTimer;
+    class Event;
+    class Frame;
+    class JSDOMWindow;
+    class JSDOMWindowShell;
+    class JSEventListener;
+    class JSLocation;
+    class JSUnprotectedEventListener;
+    class PausedTimeouts;
+    class ScheduledAction;
+    class SecurityOrigin;
+
+    class JSDOMWindowBasePrivate;
+
+    // This is the only WebCore JS binding which does not inherit from DOMObject
+    class JSDOMWindowBase : public JSDOMGlobalObject {
+        typedef JSDOMGlobalObject Base;
+
+        friend class ScheduledAction;
+    protected:
+        JSDOMWindowBase(PassRefPtr<JSC::StructureID>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+
+    public:
+        virtual ~JSDOMWindowBase();
+
+        void updateDocument();
+
+        DOMWindow* impl() const { return d()->impl.get(); }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        void disconnectFrame();
+
+        virtual void markCrossHeapDependentObjects();
+
+        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue*, JSC::PutPropertySlot&);
+
+        int installTimeout(const JSC::UString& handler, int t, bool singleShot);
+        int installTimeout(JSC::ExecState*, JSC::JSValue* function, const JSC::ArgList& args, int t, bool singleShot);
+        void removeTimeout(int timerId, bool delAction = true);
+
+        void pauseTimeouts(OwnPtr<PausedTimeouts>&);
+        void resumeTimeouts(OwnPtr<PausedTimeouts>&);
+
+        void timerFired(DOMWindowTimer*);
+
+        void clear();
+
+        // Set a place to put a dialog return value when the window is cleared.
+        void setReturnValueSlot(JSC::JSValue** slot);
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
+        virtual JSC::ExecState* globalExec();
+        
+        virtual bool supportsProfiling() const;
+
+        virtual bool shouldInterruptScript() const;
+
+        bool allowsAccessFrom(JSC::ExecState*) const;
+        bool allowsAccessFromNoErrorMessage(JSC::ExecState*) const;
+        bool allowsAccessFrom(JSC::ExecState*, String& message) const;
+
+        void printErrorMessage(const String&) const;
+
+        // Don't call this version of allowsAccessFrom -- it's a slightly incorrect implementation used only by WebScriptObject
+        virtual bool allowsAccessFrom(const JSC::JSGlobalObject*) const;
+
+        virtual JSC::JSObject* toThisObject(JSC::ExecState*) const;
+        JSDOMWindowShell* shell() const;
+
+        static JSC::JSGlobalData* commonJSGlobalData();
+
+        void clearAllTimeouts();
+
+    private:
+        struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+
+            RefPtr<DOMWindow> impl;
+
+            JSC::JSValue** returnValueSlot;
+            JSDOMWindowShell* shell;
+
+            typedef HashMap<int, DOMWindowTimer*> TimeoutsMap;
+            TimeoutsMap timeouts;
+        };
+
+        static JSC::JSValue* childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue* indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue* namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+        void clearHelperObjectProperties();
+        int installTimeout(ScheduledAction*, int interval, bool singleShot);
+
+        bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
+        String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
+        
+        JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
+    };
+
+    // Returns a JSDOMWindow or jsNull()
+    JSC::JSValue* toJS(JSC::ExecState*, DOMWindow*);
+
+    // Returns JSDOMWindow or 0
+    JSDOMWindow* toJSDOMWindow(Frame*);
+    JSDOMWindow* toJSDOMWindow(JSC::JSValue*);
+
+} // namespace WebCore
+
+#endif // JSDOMWindowBase_h
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
new file mode 100644
index 0000000..4b5f386
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -0,0 +1,325 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSDOMWindowCustom.h"
+
+#include "AtomicString.h"
+#include "Base64.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameTree.h"
+#include "JSDOMWindowShell.h"
+#include "JSEventListener.h"
+#include "JSMessagePort.h"
+#include "MessagePort.h"
+#include "ScriptController.h"
+#include "Settings.h"
+#include <runtime/JSObject.h>
+#include <runtime/PrototypeFunction.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSDOMWindow::mark()
+{
+    Base::mark();
+
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(globalData, impl()->optionalConsole());
+    markDOMObjectWrapper(globalData, impl()->optionalHistory());
+    markDOMObjectWrapper(globalData, impl()->optionalLocationbar());
+    markDOMObjectWrapper(globalData, impl()->optionalMenubar());
+    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
+    markDOMObjectWrapper(globalData, impl()->optionalPersonalbar());
+    markDOMObjectWrapper(globalData, impl()->optionalScreen());
+    markDOMObjectWrapper(globalData, impl()->optionalScrollbars());
+    markDOMObjectWrapper(globalData, impl()->optionalSelection());
+    markDOMObjectWrapper(globalData, impl()->optionalStatusbar());
+    markDOMObjectWrapper(globalData, impl()->optionalToolbar());
+    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+#if ENABLE(DOM_STORAGE)
+    markDOMObjectWrapper(globalData, impl()->optionalSessionStorage());
+    markDOMObjectWrapper(globalData, impl()->optionalLocalStorage());
+#endif
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    markDOMObjectWrapper(globalData, impl()->optionalApplicationCache());
+#endif
+}
+
+bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    // Only allow deleting properties by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return false;
+    return Base::deleteProperty(exec, propertyName);
+}
+
+bool JSDOMWindow::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+{
+    // Only allow the window to enumerated by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return true;
+    return false;
+}
+
+bool JSDOMWindow::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+{
+    // Only allow getting property attributes properties by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return false;
+    return Base::getPropertyAttributes(exec, propertyName, attributes);
+}
+
+void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    // Only allow defining getters by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
+}
+
+void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+{
+    // Only allow defining setters by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::defineSetter(exec, propertyName, setterFunction);
+}
+
+JSValue* JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
+{
+    // Only allow looking-up getters by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return jsUndefined();
+    return Base::lookupGetter(exec, propertyName);
+}
+
+JSValue* JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
+{
+    // Only allow looking-up setters by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return jsUndefined();
+    return Base::lookupSetter(exec, propertyName);
+}
+
+void JSDOMWindow::setLocation(ExecState* exec, JSValue* value)
+{
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return;
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    // To avoid breaking old widgets, make "var location =" in a top-level frame create
+    // a property named "location" instead of performing a navigation (<rdar://problem/5688039>).
+    if (Settings* settings = activeFrame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode() && !activeFrame->tree()->parent()) {
+            if (allowsAccessFrom(exec))
+                putDirect(Identifier(exec, "location"), value);
+            return;
+        }
+    }
+#endif
+
+    if (!activeFrame->loader()->shouldAllowNavigation(impl()->frame()))
+        return;
+    String dstUrl = activeFrame->loader()->completeURL(value->toString(exec)).string();
+    if (!protocolIs(dstUrl, "javascript") || allowsAccessFrom(exec)) {
+        bool userGesture = activeFrame->script()->processingUserGesture();
+        // We want a new history item if this JS was called via a user gesture
+        impl()->frame()->loader()->scheduleLocationChange(dstUrl, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+    }
+}
+
+JSValue* JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
+{
+    DOMWindow* window = impl();
+
+    DOMWindow* source = asJSDOMWindow(exec->dynamicGlobalObject())->impl();
+    String message = args.at(exec, 0)->toString(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(exec, 1));
+
+    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, (args.size() == 2) ? 1 : 2));
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    setDOMException(exec, ec);
+
+    return jsUndefined();
+}
+
+static JSValue* setTimeoutOrInterval(ExecState* exec, JSDOMWindow* window, const ArgList& args, bool timeout)
+{
+    JSValue* v = args.at(exec, 0);
+    int delay = args.at(exec, 1)->toInt32(exec);
+    if (v->isString())
+        return jsNumber(exec, window->installTimeout(asString(v)->value(), delay, timeout));
+    CallData callData;
+    if (v->getCallData(callData) == CallTypeNone)
+        return jsUndefined();
+    ArgList argsTail;
+    args.getSlice(2, argsTail);
+    return jsNumber(exec, window->installTimeout(exec, v, argsTail, delay, timeout));
+}
+
+JSValue* JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
+{
+    return setTimeoutOrInterval(exec, this, args, true);
+}
+
+JSValue* JSDOMWindow::clearTimeout(ExecState* exec, const ArgList& args)
+{
+    removeTimeout(args.at(exec, 0)->toInt32(exec));
+    return jsUndefined();
+}
+
+JSValue* JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
+{
+    return setTimeoutOrInterval(exec, this, args, false);
+}
+
+JSValue* JSDOMWindow::clearInterval(ExecState* exec, const ArgList& args)
+{
+    removeTimeout(args.at(exec, 0)->toInt32(exec));
+    return jsUndefined();
+}
+
+JSValue* JSDOMWindow::atob(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    JSValue* v = args.at(exec, 0);
+    if (v->isNull())
+        return jsEmptyString(exec);
+
+    UString s = v->toString(exec);
+    if (!s.is8Bit()) {
+        setDOMException(exec, INVALID_CHARACTER_ERR);
+        return jsUndefined();
+    }
+
+    Vector<char> in(s.size());
+    for (int i = 0; i < s.size(); ++i)
+        in[i] = static_cast<char>(s.data()[i]);
+    Vector<char> out;
+
+    if (!base64Decode(in, out))
+        return throwError(exec, GeneralError, "Cannot decode base64");
+
+    return jsString(exec, String(out.data(), out.size()));
+}
+
+JSValue* JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    JSValue* v = args.at(exec, 0);
+    if (v->isNull())
+        return jsEmptyString(exec);
+
+    UString s = v->toString(exec);
+    if (!s.is8Bit()) {
+        setDOMException(exec, INVALID_CHARACTER_ERR);
+        return jsUndefined();
+    }
+
+    Vector<char> in(s.size());
+    for (int i = 0; i < s.size(); ++i)
+        in[i] = static_cast<char>(s.data()[i]);
+    Vector<char> out;
+
+    base64Encode(in, out);
+
+    return jsString(exec, String(out.data(), out.size()));
+}
+
+JSValue* JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+
+    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(exec, args.at(exec, 1))) {
+        if (Document* doc = frame->document())
+            doc->addWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    }
+
+    return jsUndefined();
+}
+
+JSValue* JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+
+    if (JSEventListener* listener = findJSEventListener(args.at(exec, 1))) {
+        if (Document* doc = frame->document())
+            doc->removeWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener, args.at(exec, 2)->toBoolean(exec));
+    }
+
+    return jsUndefined();
+}
+
+DOMWindow* toDOMWindow(JSValue* value)
+{
+    if (!value->isObject())
+        return 0;
+    JSObject* object = asObject(value);
+    if (object->inherits(&JSDOMWindow::s_info))
+        return static_cast<JSDOMWindow*>(object)->impl();
+    if (object->inherits(&JSDOMWindowShell::s_info))
+        return static_cast<JSDOMWindowShell*>(object)->impl();
+    return 0;
+}
+
+JSValue* nonCachingStaticCloseFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionClose);
+}
+
+JSValue* nonCachingStaticBlurFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionBlur);
+}
+
+JSValue* nonCachingStaticFocusFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionFocus);
+}
+
+JSValue* nonCachingStaticPostMessageFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 2, propertyName, jsDOMWindowPrototypeFunctionPostMessage);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.h b/WebCore/bindings/js/JSDOMWindowCustom.h
new file mode 100644
index 0000000..c8ce088
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -0,0 +1,202 @@
+/*
+ *  Copyright (C) 2008 Apple Inc. All rights reseved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSDOMWindowCustom_h
+#define JSDOMWindowCustom_h
+
+#include "JSDOMWindow.h"
+#include "JSDOMWindowShell.h"
+#include <wtf/AlwaysInline.h>
+
+namespace WebCore {
+
+inline JSDOMWindow* asJSDOMWindow(JSC::JSGlobalObject* globalObject)
+{
+    return static_cast<JSDOMWindow*>(globalObject);
+}
+ 
+inline const JSDOMWindow* asJSDOMWindow(const JSC::JSGlobalObject* globalObject)
+{
+    return static_cast<const JSDOMWindow*>(globalObject);
+}
+
+JSC::JSValue* nonCachingStaticCloseFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue* nonCachingStaticBlurFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue* nonCachingStaticFocusFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue* nonCachingStaticPostMessageFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+
+    const JSC::HashEntry* entry;
+
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & JSC::Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            slot.setCustom(this, entry->propertyGetter());
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & JSC::Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+            return true;
+        }
+
+        // FIXME: We should have a message here that explains why the property access/function call was
+        // not allowed. 
+        slot.setUndefined();
+        return true;
+    }
+
+    // We need to check for cross-domain access here without printing the generic warning message
+    // because we always allow access to some function, just different ones depending whether access
+    // is allowed.
+    bool allowsAccess = allowsAccessFromNoErrorMessage(exec);
+
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot)) {
+        // But ignore overrides completely if this is cross-domain access.
+        if (allowsAccess)
+            return true;
+    }
+
+    // We need this code here because otherwise JSC::Window will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & JSC::Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticBlurFunctionGetter);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFocusFunctionGetter);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticPostMessageFunctionGetter);
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                slot.setCustom(this, objectToStringFunctionGetter);
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
+inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValue* value, JSC::PutPropertySlot& slot)
+{
+    if (!impl()->frame())
+        return true;
+
+    // We have a local override (e.g. "var location"), save time and jump directly to JSGlobalObject.
+    JSC::PropertySlot getSlot;
+    bool slotIsWriteable;
+    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, getSlot, slotIsWriteable)) {
+        if (allowsAccessFrom(exec)) {
+            if (slotIsWriteable) {
+                getSlot.putValue(value);
+                if (getSlot.isCacheable())
+                    slot.setExistingProperty(this, getSlot.cachedOffset());
+            } else
+                JSGlobalObject::put(exec, propertyName, value, slot);
+        }
+        return true;
+    }
+
+    return false;
+}
+
+
+
+inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
+{
+    if (allowsAccessFromPrivate(other))
+        return true;
+    printErrorMessage(crossDomainAccessErrorMessage(other));
+    return false;
+}
+
+    inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
+{
+    if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
+        return true;
+    printErrorMessage(crossDomainAccessErrorMessage(exec->lexicalGlobalObject()));
+    return false;
+}
+    
+inline bool JSDOMWindowBase::allowsAccessFromNoErrorMessage(JSC::ExecState* exec) const
+{
+    return allowsAccessFromPrivate(exec->lexicalGlobalObject());
+}
+    
+inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec, String& message) const
+{
+    if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
+        return true;
+    message = crossDomainAccessErrorMessage(exec->lexicalGlobalObject());
+    return false;
+}
+    
+ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject* other) const
+{
+    const JSDOMWindow* originWindow = asJSDOMWindow(other);
+    const JSDOMWindow* targetWindow = d()->shell->window();
+
+    if (originWindow == targetWindow)
+        return true;
+
+    // JS may be attempting to access the "window" object, which should be valid,
+    // even if the document hasn't been constructed yet.  If the document doesn't
+    // exist yet allow JS to access the window object.
+    if (!originWindow->impl()->document())
+        return true;
+
+    const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
+    const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
+
+    return originSecurityOrigin->canAccess(targetSecurityOrigin);
+}
+
+}
+
+#endif // JSDOMWindowCustom_h
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
new file mode 100644
index 0000000..ee4a76f
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMWindowShell.h"
+
+#include "Frame.h"
+#include "JSDOMWindow.h"
+#include "DOMWindow.h"
+#include "ScriptController.h"
+#include <runtime/JSObject.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell)
+
+const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
+
+JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window)
+    : Base(JSDOMWindowShell::createStructureID(jsNull()))
+    , m_window(0)
+{
+    setWindow(window);
+}
+
+JSDOMWindowShell::~JSDOMWindowShell()
+{
+}
+
+void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> window)
+{
+    RefPtr<StructureID> prototypeStructure = JSDOMWindowPrototype::createStructureID(jsNull());
+    RefPtr<StructureID> structure = JSDOMWindow::createStructureID(new JSDOMWindowPrototype(prototypeStructure.release()));
+    setWindow(new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), window, this));
+}
+
+// ----
+// JSObject methods
+// ----
+
+void JSDOMWindowShell::mark()
+{
+    Base::mark();
+    if (m_window && !m_window->marked())
+        m_window->mark();
+}
+
+UString JSDOMWindowShell::className() const
+{
+    return m_window->className();
+}
+
+bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return m_window->getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot& slot)
+{
+    m_window->put(exec, propertyName, value, slot);
+}
+
+void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue* value, unsigned attributes)
+{
+    m_window->putWithAttributes(exec, propertyName, value, attributes);
+}
+
+bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    return m_window->deleteProperty(exec, propertyName);
+}
+
+void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_window->getPropertyNames(exec, propertyNames);
+}
+
+bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+{
+    return m_window->getPropertyAttributes(exec, propertyName, attributes);
+}
+
+void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    m_window->defineGetter(exec, propertyName, getterFunction);
+}
+
+void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+{
+    m_window->defineSetter(exec, propertyName, setterFunction);
+}
+
+JSValue* JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
+{
+    return m_window->lookupGetter(exec, propertyName);
+}
+
+JSValue* JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
+{
+    return m_window->lookupSetter(exec, propertyName);
+}
+
+JSGlobalObject* JSDOMWindowShell::toGlobalObject(ExecState*) const
+{
+    return m_window;
+}
+
+// ----
+// JSDOMWindow methods
+// ----
+
+DOMWindow* JSDOMWindowShell::impl() const
+{
+    return m_window->impl();
+}
+
+void JSDOMWindowShell::disconnectFrame()
+{
+    m_window->disconnectFrame();
+}
+
+void JSDOMWindowShell::clear()
+{
+    m_window->clear();
+}
+
+void* JSDOMWindowShell::operator new(size_t size)
+{
+    return JSDOMWindow::commonJSGlobalData()->heap.allocate(size);
+}
+
+// ----
+// Conversion methods
+// ----
+
+JSValue* toJS(ExecState*, Frame* frame)
+{
+    if (!frame)
+        return jsNull();
+    return frame->script()->windowShell();
+}
+
+JSDOMWindowShell* toJSDOMWindowShell(Frame* frame)
+{
+    if (!frame)
+        return 0;
+    return frame->script()->windowShell();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
new file mode 100644
index 0000000..7cda4d4
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDOMWindowShell_h
+#define JSDOMWindowShell_h
+
+#include "JSDOMWindow.h"
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class DOMWindow;
+    class Frame;
+
+    class JSDOMWindowShell : public DOMObject {
+        typedef DOMObject Base;
+    public:
+        JSDOMWindowShell(PassRefPtr<DOMWindow>);
+        virtual ~JSDOMWindowShell();
+
+        JSDOMWindow* window() const { return m_window; }
+        void setWindow(JSDOMWindow* window)
+        {
+            ASSERT_ARG(window, window);
+            m_window = window;
+            setPrototype(window->prototype());
+        }
+        void setWindow(PassRefPtr<DOMWindow>);
+
+        static const JSC::ClassInfo s_info;
+
+        DOMWindow* impl() const;
+        void disconnectFrame();
+        void clear();
+
+        void* operator new(size_t);
+
+        static PassRefPtr<JSC::StructureID> createStructureID(JSC::JSValue* prototype) 
+        {
+            return JSC::StructureID::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
+        }
+
+    private:
+        virtual void mark();
+        virtual JSC::UString className() const;
+        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue*, JSC::PutPropertySlot&);
+        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue*, unsigned attributes);
+        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
+        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
+        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
+        virtual JSC::JSValue* lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue* lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSGlobalObject* toGlobalObject(JSC::ExecState*) const;
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+
+        JSDOMWindow* m_window;
+    };
+
+    JSC::JSValue* toJS(JSC::ExecState*, Frame*);
+    JSDOMWindowShell* toJSDOMWindowShell(Frame*);
+
+} // namespace WebCore
+
+#endif // JSDOMWindowShell_h
diff --git a/WebCore/bindings/js/JSDatabaseCustom.cpp b/WebCore/bindings/js/JSDatabaseCustom.cpp
new file mode 100644
index 0000000..f17340c
--- /dev/null
+++ b/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDatabase.h"
+
+#include "DOMWindow.h"
+#include "Database.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "JSCustomSQLTransactionCallback.h"
+#include "JSCustomSQLTransactionErrorCallback.h"
+#include "JSCustomVoidCallback.h"
+#include "JSDOMWindowCustom.h"
+#include "PlatformString.h"
+#include "SQLValue.h"
+#include <runtime/JSArray.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+JSValue* JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
+{
+    String oldVersion = args.at(exec, 0)->toString(exec);
+    String newVersion = args.at(exec, 1)->toString(exec);
+
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    
+    JSObject *object;
+    if (!(object = args.at(exec, 2)->getObject())) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+    
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    
+    RefPtr<SQLTransactionErrorCallback> errorCallback;
+    if (!args.at(exec, 3)->isNull()) {
+        if (!(object = args.at(exec, 3)->getObject())) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+        
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+    }
+    
+    RefPtr<VoidCallback> successCallback;
+    if (!args.at(exec, 4)->isNull()) {
+        successCallback = toVoidCallback(exec, args.at(exec, 4));
+        if (!successCallback) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+    }
+    
+    m_impl->changeVersion(oldVersion, newVersion, callback.release(), errorCallback.release(), successCallback.release());
+    
+    return jsUndefined();
+}
+
+JSValue* JSDatabase::transaction(ExecState* exec, const ArgList& args)
+{
+    JSObject* object;
+    
+    if (!(object = args.at(exec, 0)->getObject())) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }        
+ 
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    RefPtr<SQLTransactionErrorCallback> errorCallback;
+    
+    if (args.size() > 1 && !args.at(exec, 1)->isNull()) {
+        if (!(object = args.at(exec, 1)->getObject())) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+    }
+
+    RefPtr<VoidCallback> successCallback;
+    if (args.size() > 2 && !args.at(exec, 2)->isNull()) {
+        successCallback = toVoidCallback(exec, args.at(exec, 2));
+        if (!successCallback) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+    }
+    
+    m_impl->transaction(callback.release(), errorCallback.release(), successCallback.release());
+
+    return jsUndefined();
+}
+    
+}
diff --git a/WebCore/bindings/js/JSDedicatedWorkerConstructor.cpp b/WebCore/bindings/js/JSDedicatedWorkerConstructor.cpp
new file mode 100644
index 0000000..58ea258
--- /dev/null
+++ b/WebCore/bindings/js/JSDedicatedWorkerConstructor.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "JSDedicatedWorkerConstructor.h"
+
+#include "DedicatedWorker.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "JSDOMWindowCustom.h"
+#include "JSDedicatedWorker.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSDedicatedWorkerConstructor::s_info = { "DedicatedWorkerConstructor", 0, 0, 0 };
+
+JSDedicatedWorkerConstructor::JSDedicatedWorkerConstructor(ExecState* exec)
+    : DOMObject(JSDedicatedWorkerConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructDedicatedWorker(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    if (args.size() == 0)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString scriptURL = args.at(exec, 0)->toString(exec);
+
+    DOMWindow* window = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
+    
+    ExceptionCode ec = 0;
+    RefPtr<DedicatedWorker> worker = DedicatedWorker::create(scriptURL, window->document(), ec);
+    setDOMException(exec, ec);
+
+    return asObject(toJS(exec, worker.release()));
+}
+
+ConstructType JSDedicatedWorkerConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructDedicatedWorker;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/WebCore/bindings/js/JSDedicatedWorkerConstructor.h b/WebCore/bindings/js/JSDedicatedWorkerConstructor.h
new file mode 100644
index 0000000..3eda174
--- /dev/null
+++ b/WebCore/bindings/js/JSDedicatedWorkerConstructor.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSDedicatedWorkerConstructor_h
+#define JSDedicatedWorkerConstructor_h
+
+#if ENABLE(WORKERS)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSDedicatedWorkerConstructor : public DOMObject {
+    public:
+        JSDedicatedWorkerConstructor(JSC::ExecState*);
+
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // JSDedicatedWorkerConstructor_h
diff --git a/WebCore/bindings/js/JSDedicatedWorkerCustom.cpp b/WebCore/bindings/js/JSDedicatedWorkerCustom.cpp
new file mode 100644
index 0000000..d70f55a
--- /dev/null
+++ b/WebCore/bindings/js/JSDedicatedWorkerCustom.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "JSDedicatedWorker.h"
+
+#include "DedicatedWorker.h"
+#include "Document.h"
+#include "JSDOMWindowCustom.h"
+#include "JSEventListener.h"
+#include "JSMessagePort.h"
+#include "MessagePort.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+void JSDedicatedWorker::mark()
+{
+    DOMObject::mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onMessageListener()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onCloseListener()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onErrorListener()))
+        listener->mark();
+}
+
+JSValue* JSDedicatedWorker::startConversation(ExecState* exec, const ArgList& args)
+{
+    DOMWindow* window = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
+    const UString& message = args.at(exec, 0)->toString(exec);
+
+    return toJS(exec, impl()->startConversation(window->document(), message).get());
+}
+
+void JSDedicatedWorker::setOnmessage(ExecState* exec, JSValue* value)
+{
+    Document* document = impl()->document();
+    if (!document)
+        return;
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
+        return;
+    impl()->setOnMessageListener(window->findOrCreateJSUnprotectedEventListener(exec, value, true));
+}
+
+JSValue* JSDedicatedWorker::onmessage(ExecState*) const
+{
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(impl()->onMessageListener()))
+        if (JSObject* listenerObj = listener->listenerObj())
+            return listenerObj;
+    return jsNull();
+}
+
+void JSDedicatedWorker::setOnclose(ExecState* exec, JSValue* value)
+{
+    Document* document = impl()->document();
+    if (!document)
+        return;
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
+        return;
+    impl()->setOnCloseListener(window->findOrCreateJSUnprotectedEventListener(exec, value, true));
+}
+
+JSValue* JSDedicatedWorker::onclose(ExecState*) const
+{
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(impl()->onCloseListener()))
+        if (JSObject* listenerObj = listener->listenerObj())
+            return listenerObj;
+    return jsNull();
+}
+
+void JSDedicatedWorker::setOnerror(ExecState* exec, JSValue* value)
+{
+    Document* document = impl()->document();
+    if (!document)
+        return;
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
+        return;
+    impl()->setOnErrorListener(window->findOrCreateJSUnprotectedEventListener(exec, value, true));
+}
+
+JSValue* JSDedicatedWorker::onerror(ExecState*) const
+{
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(impl()->onErrorListener()))
+        if (JSObject* listenerObj = listener->listenerObj())
+            return listenerObj;
+    return jsNull();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
new file mode 100644
index 0000000..661dbed
--- /dev/null
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSDocument.h"
+
+#include "DOMWindow.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLDocument.h"
+#include "JSDOMWindowCustom.h"
+#include "JSHTMLDocument.h"
+#include "JSLocation.h"
+#include "JSNodeList.h"
+#include "Location.h"
+#include "NodeList.h"
+#include "ScriptController.h"
+
+#if ENABLE(SVG)
+#include "JSSVGDocument.h"
+#include "SVGDocument.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSDocument::mark()
+{
+    JSEventTargetNode::mark();
+    markDOMNodesForDocument(impl());
+    markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
+}
+
+JSValue* JSDocument::location(ExecState* exec) const
+{
+    Frame* frame = static_cast<Document*>(impl())->frame();
+    if (!frame)
+        return jsNull();
+
+    return toJS(exec, frame->domWindow()->location());
+}
+
+void JSDocument::setLocation(ExecState* exec, JSValue* value)
+{
+    Frame* frame = static_cast<Document*>(impl())->frame();
+    if (!frame)
+        return;
+
+    String str = value->toString(exec);
+
+    // IE and Mozilla both resolve the URL relative to the source frame,
+    // not the target frame.
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (activeFrame)
+        str = activeFrame->document()->completeURL(str).string();
+
+    bool userGesture = activeFrame->script()->processingUserGesture();
+    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+}
+
+JSValue* toJS(ExecState* exec, Document* document)
+{
+    if (!document)
+        return jsNull();
+
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), document);
+    if (wrapper)
+        return wrapper;
+
+    if (document->isHTMLDocument())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLDocument, document);
+#if ENABLE(SVG)
+    else if (document->isSVGDocument())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, SVGDocument, document);
+#endif
+    else
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, Document, document);
+
+    // Make sure the document is kept around by the window object, and works right with the
+    // back/forward cache.
+    if (!document->frame()) {
+        size_t nodeCount = 0;
+        for (Node* n = document; n; n = n->traverseNextNode())
+            nodeCount++;
+        
+        exec->heap()->reportExtraMemoryCost(nodeCount * sizeof(Node));
+    }
+
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDocumentFragmentCustom.cpp b/WebCore/bindings/js/JSDocumentFragmentCustom.cpp
new file mode 100644
index 0000000..7bc7d68
--- /dev/null
+++ b/WebCore/bindings/js/JSDocumentFragmentCustom.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDocumentFragment.h"
+
+#include "DocumentFragment.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+#include "JSElement.h"
+#include "JSNodeList.h"
+#include "NodeList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
new file mode 100644
index 0000000..22480a2
--- /dev/null
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "JSElement.h"
+
+#include "CSSHelper.h"
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "HTMLFrameElementBase.h"
+#include "HTMLNames.h"
+#include "JSAttr.h"
+#include "JSHTMLElementWrapperFactory.h"
+#include "JSNodeList.h"
+#include "NodeList.h"
+
+#if ENABLE(SVG)
+#include "JSSVGElementWrapperFactory.h"
+#include "SVGElement.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
+{
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIs(parseURL(value), "javascript")) {
+        HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
+        if (!checkNodeSecurity(exec, frame->contentDocument()))
+            return false;
+    }
+    return true;
+} 
+
+JSValue* JSElement::setAttribute(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    AtomicString name = args.at(exec, 0)->toString(exec);
+    AtomicString value = args.at(exec, 1)->toString(exec);
+
+    Element* imp = impl();
+    if (!allowSettingSrcToJavascriptURL(exec, imp, name, value))
+        return jsUndefined();
+
+    imp->setAttribute(name, value, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    Attr* newAttr = toAttr(args.at(exec, 0));
+    if (!newAttr) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    Element* imp = impl();
+    if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
+        return jsUndefined();
+
+    JSValue* result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue* JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    AtomicString qualifiedName = args.at(exec, 1)->toString(exec);
+    AtomicString value = args.at(exec, 2)->toString(exec);
+
+    Element* imp = impl();
+    if (!allowSettingSrcToJavascriptURL(exec, imp, qualifiedName, value))
+        return jsUndefined();
+
+    imp->setAttributeNS(namespaceURI, qualifiedName, value, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    Attr* newAttr = toAttr(args.at(exec, 0));
+    if (!newAttr) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    Element* imp = impl();
+    if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
+        return jsUndefined();
+
+    JSValue* result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue* toJSNewlyCreated(ExecState* exec, Element* element)
+{
+    if (!element)
+        return jsNull();
+
+    ASSERT(!getCachedDOMNodeWrapper(element->document(), element));
+
+    JSNode* wrapper;        
+    if (element->isHTMLElement())
+        wrapper = createJSHTMLWrapper(exec, static_cast<HTMLElement*>(element));
+#if ENABLE(SVG)
+    else if (element->isSVGElement())
+        wrapper = createJSSVGWrapper(exec, static_cast<SVGElement*>(element));
+#endif
+    else
+        wrapper = CREATE_DOM_NODE_WRAPPER(exec, Element, element);
+
+    return wrapper;    
+}
+    
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
new file mode 100644
index 0000000..9c7d7a0
--- /dev/null
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSEvent.h"
+
+#include "Clipboard.h"
+#include "Event.h"
+#include "JSClipboard.h"
+#include "JSKeyboardEvent.h"
+#include "JSMessageEvent.h"
+#include "JSMouseEvent.h"
+#include "JSMutationEvent.h"
+#include "JSOverflowEvent.h"
+#include "JSProgressEvent.h"
+#include "JSTextEvent.h"
+#include "JSUIEvent.h"
+#include "JSWebKitAnimationEvent.h"
+#include "JSWebKitTransitionEvent.h"
+#include "JSWheelEvent.h"
+#include "JSXMLHttpRequestProgressEvent.h"
+#include "KeyboardEvent.h"
+#include "MessageEvent.h"
+#include "MouseEvent.h"
+#include "MutationEvent.h"
+#include "OverflowEvent.h"
+#include "ProgressEvent.h"
+#include "TextEvent.h"
+#include "UIEvent.h"
+#include "WebKitAnimationEvent.h"
+#include "WebKitTransitionEvent.h"
+#include "WheelEvent.h"
+#include "XMLHttpRequestProgressEvent.h"
+#include <runtime/JSLock.h>
+
+#if ENABLE(DOM_STORAGE)
+#include "JSStorageEvent.h"
+#include "StorageEvent.h"
+#endif
+
+#if ENABLE(SVG)
+#include "JSSVGZoomEvent.h"
+#include "SVGZoomEvent.h"
+#endif
+
+#if ENABLE(TOUCH_EVENTS) // Android
+#include "JSTouchEvent.h"
+#include "TouchEvent.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSEvent::clipboardData(ExecState* exec) const
+{
+    return impl()->isClipboardEvent() ? toJS(exec, impl()->clipboardData()) : jsUndefined();
+}
+
+JSValue* toJS(ExecState* exec, Event* event)
+{
+    JSLock lock(false);
+
+    if (!event)
+        return jsNull();
+
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), event);
+    if (wrapper)
+        return wrapper;
+
+    if (event->isUIEvent()) {
+        if (event->isKeyboardEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, KeyboardEvent, event);
+        else if (event->isTextEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, TextEvent, event);
+        else if (event->isMouseEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, MouseEvent, event);
+        else if (event->isWheelEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, WheelEvent, event);
+#if ENABLE(SVG)
+        else if (event->isSVGZoomEvent())
+            wrapper = CREATE_SVG_OBJECT_WRAPPER(exec, SVGZoomEvent, event, 0);
+#endif
+#if ENABLE(TOUCH_EVENTS) // Android
+        else if (event->isTouchEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, TouchEvent, event);
+#endif
+        else
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, UIEvent, event);
+    } else if (event->isMutationEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, MutationEvent, event);
+    else if (event->isOverflowEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, OverflowEvent, event);
+    else if (event->isMessageEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, MessageEvent, event);
+    else if (event->isProgressEvent()) {
+        if (event->isXMLHttpRequestProgressEvent())
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequestProgressEvent, event);
+        else
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, ProgressEvent, event);
+    }
+#if ENABLE(DOM_STORAGE)
+    else if (event->isStorageEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, StorageEvent, event);
+#endif
+    else if (event->isWebKitAnimationEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, WebKitAnimationEvent, event);
+    else if (event->isWebKitTransitionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, WebKitTransitionEvent, event);
+    else
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, Event, event);
+
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
new file mode 100644
index 0000000..e72af16
--- /dev/null
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -0,0 +1,337 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSEventListener.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Event.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "JSDOMWindow.h"
+#include "JSEvent.h"
+#include "JSEventTarget.h"
+#include "JSEventTargetNode.h"
+#include "ScriptController.h"
+#include <runtime/FunctionConstructor.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefCountedLeakCounter.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSAbstractEventListener)
+
+void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+{
+    JSLock lock(false);
+
+    JSObject* listener = listenerObj();
+    if (!listener)
+        return;
+
+    JSDOMGlobalObject* globalObject = this->globalObject();
+    // Null check as clearGlobalObject() can clear this and we still get called back by
+    // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
+    // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
+    if (!globalObject)
+        return;
+
+    ScriptExecutionContext* scriptExecutionContext = globalObject->scriptExecutionContext();
+    if (!scriptExecutionContext)
+        return;
+
+    Frame* frame = 0;
+    if (scriptExecutionContext->isDocument()) {
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
+        frame = window->impl()->frame();
+        if (!frame)
+            return;
+        // The window must still be active in its frame. See <https://bugs.webkit.org/show_bug.cgi?id=21921>.
+        // FIXME: A better fix for this may be to change DOMWindow::frame() to not return a frame the detached window used to be in.
+        if (frame->domWindow() != window->impl())
+            return;
+        // FIXME: Is this check needed for other contexts?
+        ScriptController* script = frame->script();
+        if (!script->isEnabled() || script->isPaused())
+            return;
+    }
+
+    ExecState* exec = globalObject->globalExec();
+
+    JSValue* handleEventFunction = listener->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = handleEventFunction->getCallData(callData);
+    if (callType == CallTypeNone) {
+        handleEventFunction = noValue();
+        callType = listener->getCallData(callData);
+    }
+
+    if (callType != CallTypeNone) {
+        ref();
+
+        ArgList args;
+        args.append(toJS(exec, event));
+
+        Event* savedEvent = globalObject->currentEvent();
+        globalObject->setCurrentEvent(event);
+
+        JSValue* retval;
+        if (handleEventFunction) {
+            globalObject->startTimeoutCheck();
+            retval = call(exec, handleEventFunction, callType, callData, listener, args);
+        } else {
+            JSValue* thisValue;
+            if (isWindowEvent)
+                thisValue = globalObject->toThisObject(exec);
+            else
+                thisValue = toJS(exec, event->currentTarget());
+            globalObject->startTimeoutCheck();
+            retval = call(exec, listener, callType, callData, thisValue, args);
+        }
+        globalObject->stopTimeoutCheck();
+
+        globalObject->setCurrentEvent(savedEvent);
+
+        if (exec->hadException()) {
+            // FIXME: Report exceptions in non-Document contexts.
+            if (frame)
+                frame->domWindow()->console()->reportCurrentException(exec);
+        } else {
+            if (!retval->isUndefinedOrNull() && event->storesResultAsString())
+                event->storeResult(retval->toString(exec));
+            if (m_isInline) {
+                bool retvalbool;
+                if (retval->getBoolean(retvalbool) && !retvalbool)
+                    event->preventDefault();
+            }
+        }
+
+        Document::updateDocumentsRendering();
+        deref();
+    }
+}
+
+bool JSAbstractEventListener::isInline() const
+{
+    return m_isInline;
+}
+
+// -------------------------------------------------------------------------
+
+JSUnprotectedEventListener::JSUnprotectedEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+    : JSAbstractEventListener(isInline)
+    , m_listener(listener)
+    , m_globalObject(globalObject)
+{
+    if (m_listener) {
+        JSDOMWindow::UnprotectedListenersMap& listeners = isInline
+            ? globalObject->jsUnprotectedInlineEventListeners() : globalObject->jsUnprotectedEventListeners();
+        listeners.set(m_listener, this);
+    }
+}
+
+JSUnprotectedEventListener::~JSUnprotectedEventListener()
+{
+    if (m_listener && m_globalObject) {
+        JSDOMWindow::UnprotectedListenersMap& listeners = isInline()
+            ? m_globalObject->jsUnprotectedInlineEventListeners() : m_globalObject->jsUnprotectedEventListeners();
+        listeners.remove(m_listener);
+    }
+}
+
+JSObject* JSUnprotectedEventListener::listenerObj() const
+{
+    return m_listener;
+}
+
+JSDOMGlobalObject* JSUnprotectedEventListener::globalObject() const
+{
+    return m_globalObject;
+}
+
+void JSUnprotectedEventListener::clearGlobalObject()
+{
+    m_globalObject = 0;
+}
+
+void JSUnprotectedEventListener::mark()
+{
+    if (m_listener && !m_listener->marked())
+        m_listener->mark();
+}
+
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter eventListenerCounter("EventListener");
+#endif
+
+// -------------------------------------------------------------------------
+
+JSEventListener::JSEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+    : JSAbstractEventListener(isInline)
+    , m_listener(listener)
+    , m_globalObject(globalObject)
+{
+    if (m_listener) {
+        JSDOMWindow::ListenersMap& listeners = isInline
+            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
+        listeners.set(m_listener, this);
+    }
+#ifndef NDEBUG
+    eventListenerCounter.increment();
+#endif
+}
+
+JSEventListener::~JSEventListener()
+{
+    if (m_listener && m_globalObject) {
+        JSDOMWindow::ListenersMap& listeners = isInline()
+            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
+        listeners.remove(m_listener);
+    }
+#ifndef NDEBUG
+    eventListenerCounter.decrement();
+#endif
+}
+
+JSObject* JSEventListener::listenerObj() const
+{
+    return m_listener;
+}
+
+JSDOMGlobalObject* JSEventListener::globalObject() const
+{
+    return m_globalObject;
+}
+
+void JSEventListener::clearGlobalObject()
+{
+    m_globalObject = 0;
+}
+
+// -------------------------------------------------------------------------
+
+JSLazyEventListener::JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+    : JSEventListener(0, globalObject, true)
+    , m_functionName(functionName)
+    , m_code(code)
+    , m_parsed(false)
+    , m_lineNumber(lineNumber)
+    , m_originalNode(node)
+    , m_type(type)
+{
+    // We don't retain the original node because we assume it
+    // will stay alive as long as this handler object is around
+    // and we need to avoid a reference cycle. If JS transfers
+    // this handler to another node, parseCode will be called and
+    // then originalNode is no longer needed.
+
+    // A JSLazyEventListener can be created with a line number of zero when it is created with
+    // a setAttribute call from JavaScript, so make the line number 1 in that case.
+    if (m_lineNumber == 0)
+        m_lineNumber = 1;
+}
+
+JSObject* JSLazyEventListener::listenerObj() const
+{
+    parseCode();
+    return m_listener;
+}
+
+// Helper function
+inline JSValue* eventParameterName(JSLazyEventListener::LazyEventListenerType type, ExecState* exec)
+{
+    switch (type) {
+    case JSLazyEventListener::HTMLLazyEventListener:
+        return jsNontrivialString(exec, "event");
+#if ENABLE(SVG)
+    case JSLazyEventListener::SVGLazyEventListener:
+        return jsNontrivialString(exec, "evt");
+#endif
+    default:
+        ASSERT_NOT_REACHED();
+        return jsUndefined();
+    }
+}
+
+void JSLazyEventListener::parseCode() const
+{
+    if (m_parsed)
+        return;
+
+    Frame* frame = 0;
+    if (globalObject()->scriptExecutionContext()->isDocument()) {
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject());
+        frame = window->impl()->frame();
+        if (!frame)
+            return;
+        // FIXME: Is this check needed for non-Document contexts?
+        ScriptController* script = frame->script();
+        if (!script->isEnabled() || script->isPaused())
+            return;
+    }
+
+    m_parsed = true;
+
+    ExecState* exec = globalObject()->globalExec();
+
+    ArgList args;
+    UString sourceURL(globalObject()->scriptExecutionContext()->url().string());
+    args.append(eventParameterName(m_type, exec));
+    args.append(jsString(exec, m_code));
+
+    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
+    // have been added with setAttribute from a script, and we should pass String() in that case.
+    m_listener = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_listener.get());
+
+    if (exec->hadException()) {
+        exec->clearException();
+
+        // failed to parse, so let's just make this listener a no-op
+        m_listener = 0;
+    } else if (m_originalNode) {
+        // Add the event's home element to the scope
+        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
+        ScopeChain scope = listenerAsFunction->scope();
+
+        JSValue* thisObj = toJS(exec, m_originalNode);
+        if (thisObj->isObject()) {
+            static_cast<JSEventTargetNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
+            listenerAsFunction->setScope(scope);
+        }
+    }
+
+    // no more need to keep the unparsed code around
+    m_functionName = String();
+    m_code = String();
+
+    if (m_listener) {
+        ASSERT(isInline());
+        JSDOMWindow::ListenersMap& listeners = globalObject()->jsInlineEventListeners();
+        listeners.set(m_listener, const_cast<JSLazyEventListener*>(this));
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventListener.h b/WebCore/bindings/js/JSEventListener.h
new file mode 100644
index 0000000..3c9edd0
--- /dev/null
+++ b/WebCore/bindings/js/JSEventListener.h
@@ -0,0 +1,125 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSEventListener_h
+#define JSEventListener_h
+
+#include "EventListener.h"
+#include "PlatformString.h"
+#include <kjs/protect.h>
+
+namespace WebCore {
+
+    class Event;
+    class JSDOMGlobalObject;
+    class Node;
+
+    class JSAbstractEventListener : public EventListener {
+    public:
+        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual bool isInline() const;
+        virtual JSC::JSObject* listenerObj() const = 0;
+        virtual JSDOMGlobalObject* globalObject() const = 0;
+
+    protected:
+        JSAbstractEventListener(bool isInline)
+            : m_isInline(isInline)
+        {
+        }
+
+    private:
+        bool m_isInline;
+    };
+
+    class JSUnprotectedEventListener : public JSAbstractEventListener {
+    public:
+        static PassRefPtr<JSUnprotectedEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+        {
+            return adoptRef(new JSUnprotectedEventListener(listener, globalObject, isInline));
+        }
+        virtual ~JSUnprotectedEventListener();
+
+        virtual JSC::JSObject* listenerObj() const;
+        virtual JSDOMGlobalObject* globalObject() const;
+        void clearGlobalObject();
+        void mark();
+
+    private:
+        JSUnprotectedEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
+
+        JSC::JSObject* m_listener;
+        JSDOMGlobalObject* m_globalObject;
+    };
+
+    class JSEventListener : public JSAbstractEventListener {
+    public:
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+        {
+            return adoptRef(new JSEventListener(listener, globalObject, isInline));
+        }
+        virtual ~JSEventListener();
+
+        virtual JSC::JSObject* listenerObj() const;
+        virtual JSDOMGlobalObject* globalObject() const;
+        void clearGlobalObject();
+
+    protected:
+        JSEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
+
+        mutable JSC::ProtectedPtr<JSC::JSObject> m_listener;
+
+    private:
+        JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+    };
+
+    class JSLazyEventListener : public JSEventListener {
+    public:
+        enum LazyEventListenerType {
+            HTMLLazyEventListener
+#if ENABLE(SVG)
+            , SVGLazyEventListener
+#endif
+        };
+
+        virtual bool wasCreatedFromMarkup() const { return true; }
+
+        static PassRefPtr<JSLazyEventListener> create(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        {
+            return adoptRef(new JSLazyEventListener(type, functionName, code, globalObject, node, lineNumber));
+        }
+        virtual JSC::JSObject* listenerObj() const;
+
+    protected:
+        JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+
+    private:
+        void parseCode() const;
+
+        mutable String m_functionName;
+        mutable String m_code;
+        mutable bool m_parsed;
+        int m_lineNumber;
+        Node* m_originalNode;
+
+        LazyEventListenerType m_type;
+    };
+
+} // namespace WebCore
+
+#endif // JSEventListener_h
diff --git a/WebCore/bindings/js/JSEventTarget.cpp b/WebCore/bindings/js/JSEventTarget.cpp
new file mode 100644
index 0000000..185756d
--- /dev/null
+++ b/WebCore/bindings/js/JSEventTarget.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSEventTarget.h"
+
+#include "Document.h"
+#include "JSEventListener.h"
+#include "JSEventTargetNode.h"
+#include "JSMessagePort.h"
+#include "JSXMLHttpRequestUpload.h"
+
+#if ENABLE(SVG)
+#include "SVGElementInstance.h"
+#include "JSSVGElementInstance.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJS(ExecState* exec, EventTarget* target)
+{
+    if (!target)
+        return jsNull();
+    
+#if ENABLE(SVG)
+    // SVGElementInstance supports both toSVGElementInstance and toNode since so much mouse handling code depends on toNode returning a valid node.
+    if (SVGElementInstance* instance = target->toSVGElementInstance())
+        return toJS(exec, instance);
+#endif
+    
+    if (Node* node = target->toNode())
+        return toJS(exec, node);
+
+    if (XMLHttpRequest* xhr = target->toXMLHttpRequest())
+        // XMLHttpRequest is always created via JS, so we don't need to use cacheDOMObject() here.
+        return getCachedDOMObjectWrapper(exec->globalData(), xhr);
+
+    if (XMLHttpRequestUpload* upload = target->toXMLHttpRequestUpload())
+        return toJS(exec, upload);
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (DOMApplicationCache* cache = target->toDOMApplicationCache())
+        // DOMApplicationCache is always created via JS, so we don't need to use cacheDOMObject() here.
+        return getCachedDOMObjectWrapper(exec->globalData(), cache);
+#endif
+
+    if (MessagePort* messagePort = target->toMessagePort())
+        return toJS(exec, messagePort);
+    
+    ASSERT_NOT_REACHED();
+    return jsNull();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventTarget.h b/WebCore/bindings/js/JSEventTarget.h
new file mode 100644
index 0000000..1ee854f
--- /dev/null
+++ b/WebCore/bindings/js/JSEventTarget.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSEventTarget_h
+#define JSEventTarget_h
+
+#include <runtime/JSValue.h>
+
+namespace JSC {
+    class ExecState;
+}
+
+namespace WebCore {
+
+    class EventTarget;
+
+    JSC::JSValue* toJS(JSC::ExecState*, EventTarget*);
+
+} // namespace WebCore
+
+#endif // JSEventTarget_h
diff --git a/WebCore/bindings/js/JSEventTargetBase.h b/WebCore/bindings/js/JSEventTargetBase.h
new file mode 100644
index 0000000..e1395d3
--- /dev/null
+++ b/WebCore/bindings/js/JSEventTargetBase.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSEventTargetBase_h
+#define JSEventTargetBase_h
+
+#include "Event.h"
+#include "EventNames.h"
+#include "JSEvent.h"
+
+#define JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, macro) \
+    macro(specificEventTarget, OnAbort, abortEvent) \
+    macro(specificEventTarget, OnBlur, blurEvent) \
+    macro(specificEventTarget, OnChange, changeEvent) \
+    macro(specificEventTarget, OnClick, clickEvent) \
+    macro(specificEventTarget, OnContextMenu, contextmenuEvent) \
+    macro(specificEventTarget, OnDblClick, dblclickEvent) \
+    macro(specificEventTarget, OnError, errorEvent) \
+    macro(specificEventTarget, OnFocus, focusEvent) \
+    macro(specificEventTarget, OnInput, inputEvent) \
+    macro(specificEventTarget, OnKeyDown, keydownEvent) \
+    macro(specificEventTarget, OnKeyPress, keypressEvent) \
+    macro(specificEventTarget, OnKeyUp, keyupEvent) \
+    macro(specificEventTarget, OnLoad, loadEvent) \
+    macro(specificEventTarget, OnMouseDown, mousedownEvent) \
+    macro(specificEventTarget, OnMouseMove, mousemoveEvent) \
+    macro(specificEventTarget, OnMouseOut, mouseoutEvent) \
+    macro(specificEventTarget, OnMouseOver, mouseoverEvent) \
+    macro(specificEventTarget, OnMouseUp, mouseupEvent) \
+    macro(specificEventTarget, OnMouseWheel, mousewheelEvent) \
+    macro(specificEventTarget, OnBeforeCut, beforecutEvent) \
+    macro(specificEventTarget, OnCut, cutEvent) \
+    macro(specificEventTarget, OnBeforeCopy, beforecopyEvent) \
+    macro(specificEventTarget, OnCopy, copyEvent) \
+    macro(specificEventTarget, OnBeforePaste, beforepasteEvent) \
+    macro(specificEventTarget, OnPaste, pasteEvent) \
+    macro(specificEventTarget, OnDragEnter, dragenterEvent) \
+    macro(specificEventTarget, OnDragOver, dragoverEvent) \
+    macro(specificEventTarget, OnDragLeave, dragleaveEvent) \
+    macro(specificEventTarget, OnDrop, dropEvent) \
+    macro(specificEventTarget, OnDragStart, dragstartEvent) \
+    macro(specificEventTarget, OnDrag, dragEvent) \
+    macro(specificEventTarget, OnDragEnd, dragendEvent) \
+    macro(specificEventTarget, OnReset, resetEvent) \
+    macro(specificEventTarget, OnResize, resizeEvent) \
+    macro(specificEventTarget, OnScroll, scrollEvent) \
+    macro(specificEventTarget, OnSearch, searchEvent) \
+    macro(specificEventTarget, OnSelect, selectEvent) \
+    macro(specificEventTarget, OnSelectStart, selectstartEvent) \
+    macro(specificEventTarget, OnSubmit, submitEvent) \
+    macro(specificEventTarget, OnUnload, unloadEvent) \
+/* #if ENABLE(TOUCH_EVENTS) // Android */ \
+    macro(specificEventTarget, OnTouchStart, touchstartEvent) \
+    macro(specificEventTarget, OnTouchMove, touchmoveEvent) \
+    macro(specificEventTarget, OnTouchEnd, touchendEvent) \
+    macro(specificEventTarget, OnTouchCancel, touchcancelEvent) \
+/* #endif */ \
+
+#define EVENT_LISTENER_GETTER(specificEventTarget, name, event) \
+JSC::JSValue* js##specificEventTarget##name(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot& slot) \
+{ \
+    return static_cast<JS##specificEventTarget*>(slot.slotBase())->getListener(event); \
+} \
+
+#define EVENT_LISTENER_SETTER(specificEventTarget, name, event) \
+void setJS##specificEventTarget##name(JSC::ExecState* exec, JSC::JSObject* baseObject, JSC::JSValue* value) \
+{ \
+    static_cast<JS##specificEventTarget*>(baseObject)->setListener(exec, event, value); \
+} \
+
+#define DECLARE_JS_EVENT_LISTENERS(specificEventTarget) \
+    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_GETTER) \
+    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_SETTER) \
+
+#endif // JSEventTargetBase_h
diff --git a/WebCore/bindings/js/JSEventTargetNodeCustom.cpp b/WebCore/bindings/js/JSEventTargetNodeCustom.cpp
new file mode 100644
index 0000000..7e80f70
--- /dev/null
+++ b/WebCore/bindings/js/JSEventTargetNodeCustom.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSEventTargetNode.h"
+
+#include "AtomicString.h"
+#include "Document.h"
+#include "Event.h"
+#include "EventTargetNode.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "JSDOMWindow.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSEventTargetNode::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
+        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+
+    return jsUndefined();
+}
+
+JSValue* JSEventTargetNode::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
+        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+
+    return jsUndefined();
+}
+
+void JSEventTargetNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
+{
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSGeolocationCustom.cpp b/WebCore/bindings/js/JSGeolocationCustom.cpp
new file mode 100644
index 0000000..9c11172
--- /dev/null
+++ b/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSGeolocation.h"
+
+#include "DOMWindow.h"
+#include "ExceptionCode.h"
+#include "Geolocation.h"
+#include "GeolocationService.h"
+#include "JSCustomPositionCallback.h"
+#include "JSCustomPositionErrorCallback.h"
+#include "JSDOMWindow.h"
+#include "JSPositionOptions.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
+{
+    // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
+    RefPtr<PositionCallback> positionCallback;
+    JSObject* object = args.at(exec, 0)->getObject();
+    if (exec->hadException())
+        return jsUndefined();
+    if (!object) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
+        positionCallback = JSCustomPositionCallback::create(object, frame);
+    
+    RefPtr<PositionErrorCallback> positionErrorCallback;
+    if (!args.at(exec, 1)->isUndefinedOrNull()) {
+        JSObject* object = args.at(exec, 1)->getObject();
+        if (!object) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+
+        if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
+            positionErrorCallback = JSCustomPositionErrorCallback::create(object, frame);
+    }
+    
+    RefPtr<PositionOptions> positionOptions;
+    if (!args.at(exec, 2)->isUndefinedOrNull())
+        positionOptions = toPositionOptions(args.at(exec, 2));
+    
+    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    
+    return jsUndefined();
+}
+
+JSValue* JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
+{
+    // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
+    RefPtr<PositionCallback> positionCallback;
+    JSObject* object = args.at(exec, 0)->getObject();
+    if (exec->hadException())
+        return jsUndefined();
+    if (!object) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+    
+    if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
+        positionCallback = JSCustomPositionCallback::create(object, frame);
+    
+    RefPtr<PositionErrorCallback> positionErrorCallback;
+    if (!args.at(exec, 1)->isUndefinedOrNull()) {
+        JSObject* object = args.at(exec, 1)->getObject();
+        if (!object) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+        
+        if (Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame())
+            positionErrorCallback = JSCustomPositionErrorCallback::create(object, frame);
+    }
+    
+    RefPtr<PositionOptions> positionOptions;
+    if (!args.at(exec, 2)->isUndefinedOrNull())
+        positionOptions = toPositionOptions(args.at(exec, 2));
+    
+    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    return jsNumber(exec, watchID);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.cpp b/WebCore/bindings/js/JSHTMLAllCollection.cpp
new file mode 100644
index 0000000..ce2609c
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLAllCollection.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSHTMLAllCollection.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSHTMLAllCollection::s_info = { "HTMLAllCollection", 0, 0, 0 };
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.h b/WebCore/bindings/js/JSHTMLAllCollection.h
new file mode 100644
index 0000000..f85c997
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSHTMLAllCollection_h
+#define JSHTMLAllCollection_h
+
+#include "HTMLCollection.h"
+#include "JSHTMLCollection.h"
+
+namespace WebCore {
+
+    class HTMLCollection;
+
+    class JSHTMLAllCollection : public JSHTMLCollection {
+    public:
+        JSHTMLAllCollection(PassRefPtr<JSC::StructureID> structure, PassRefPtr<HTMLCollection> collection)
+            : JSHTMLCollection(structure, collection)
+        {
+        }
+
+        static PassRefPtr<JSC::StructureID> createStructureID(JSC::JSValue* proto) 
+        { 
+            return JSC::StructureID::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
+        }
+
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual bool toBoolean(JSC::ExecState*) const { return false; }
+    };
+
+} // namespace WebCore
+
+#endif // JSHTMLAllCollection_h
diff --git a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
new file mode 100644
index 0000000..ca9e08e
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLAppletElementCustom.h"
+
+#include "HTMLAppletElement.h"
+#include "JSPluginElementFunctions.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+bool JSHTMLAppletElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
+}
+
+bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot& slot)
+{
+    return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
+}
+
+CallType JSHTMLAppletElement::getCallData(CallData& callData)
+{
+    return runtimeObjectGetCallData(impl(), callData);
+}
+
+bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, const Identifier& propertyName)
+{
+    return propertyName == "__apple_runtime_object";
+}
+
+JSValue* JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return runtimeObjectGetter(exec, propertyName, slot);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLAppletElementCustom.h b/WebCore/bindings/js/JSHTMLAppletElementCustom.h
new file mode 100644
index 0000000..5df9a66
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLAppletElementCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSHTMLAppletElementCustom_h
+#define JSHTMLAppletElementCustom_h
+
+#include "JSHTMLAppletElement.h"
+
+#endif // JSHTMLAppletElementCustom_h
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
new file mode 100644
index 0000000..3e98194
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSHTMLCollection.h"
+
+#include "AtomicString.h"
+#include "HTMLCollection.h"
+#include "HTMLOptionsCollection.h"
+#include "JSHTMLAllCollection.h"
+#include "JSHTMLOptionsCollection.h"
+#include "JSNamedNodesCollection.h"
+#include "JSNode.h"
+#include "Node.h"
+#include "JSDOMBinding.h"
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static JSValue* getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
+{
+    Vector<RefPtr<Node> > namedItems;
+    impl->namedItems(propertyName, namedItems);
+
+    if (namedItems.isEmpty())
+        return jsUndefined();
+
+    if (namedItems.size() == 1)
+        return toJS(exec, namedItems[0].get());
+
+    return new (exec) JSNamedNodesCollection(exec, namedItems);
+}
+
+// HTMLCollections are strange objects, they support both get and call,
+// so that document.forms.item(0) and document.forms(0) both work.
+static JSValue* callHTMLCollection(ExecState* exec, JSObject* function, JSValue*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    // Do not use thisObj here. It can be the JSHTMLDocument, in the document.forms(i) case.
+    HTMLCollection* collection = static_cast<JSHTMLCollection*>(function)->impl();
+
+    // Also, do we need the TypeError test here ?
+
+    if (args.size() == 1) {
+        // Support for document.all(<index>) etc.
+        bool ok;
+        UString string = args.at(exec, 0)->toString(exec);
+        unsigned index = string.toUInt32(&ok, false);
+        if (ok)
+            return toJS(exec, collection->item(index));
+
+        // Support for document.images('<name>') etc.
+        return getNamedItems(exec, collection, Identifier(exec, string));
+    }
+
+    // The second arg, if set, is the index of the item we want
+    bool ok;
+    UString string = args.at(exec, 0)->toString(exec);
+    unsigned index = args.at(exec, 1)->toString(exec).toUInt32(&ok, false);
+    if (ok) {
+        String pstr = string;
+        Node* node = collection->namedItem(pstr);
+        while (node) {
+            if (!index)
+                return toJS(exec, node);
+            node = collection->nextNamedItem(pstr);
+            --index;
+        }
+    }
+
+    return jsUndefined();
+}
+
+CallType JSHTMLCollection::getCallData(CallData& callData)
+{
+    callData.native.function = callHTMLCollection;
+    return CallTypeHost;
+}
+
+bool JSHTMLCollection::canGetItemsForName(ExecState* exec, HTMLCollection* thisObj, const Identifier& propertyName)
+{
+    return !getNamedItems(exec, thisObj, propertyName)->isUndefined();
+}
+
+JSValue* JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
+    return getNamedItems(exec, thisObj->impl(), propertyName);
+}
+
+JSValue* JSHTMLCollection::item(ExecState* exec, const ArgList& args)
+{
+    bool ok;
+    uint32_t index = args.at(exec, 0)->toString(exec).toUInt32(&ok, false);
+    if (ok)
+        return toJS(exec, impl()->item(index));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+}
+
+JSValue* JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
+{
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+}
+
+JSValue* toJS(ExecState* exec, HTMLCollection* collection)
+{
+    if (!collection)
+        return jsNull();
+
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), collection);
+
+    if (wrapper)
+        return wrapper;
+
+    switch (collection->type()) {
+        case HTMLCollection::SelectOptions:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLOptionsCollection, collection);
+            break;
+        case HTMLCollection::DocAll:
+            typedef HTMLCollection HTMLAllCollection;
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLAllCollection, collection);
+            break;
+        default:
+            wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLCollection, collection);
+            break;
+    }
+
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
new file mode 100644
index 0000000..be57a3d
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLDocument.h"
+
+#include "Frame.h"
+#include "HTMLBodyElement.h"
+#include "HTMLCollection.h"
+#include "HTMLDocument.h"
+#include "HTMLElement.h"
+#include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowCustom.h"
+#include "JSDOMWindowShell.h"
+#include "JSHTMLCollection.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, const Identifier& propertyName)
+{
+    AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+    return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
+}
+
+JSValue* JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
+    HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
+
+    String name = propertyName;
+    RefPtr<HTMLCollection> collection = document->documentNamedItems(name);
+
+    unsigned length = collection->length();
+    if (!length)
+        return jsUndefined();
+
+    if (length == 1) {
+        Node* node = collection->firstItem();
+
+        Frame* frame;
+        if (node->hasTagName(iframeTag) && (frame = static_cast<HTMLIFrameElement*>(node)->contentFrame()))
+            return toJS(exec, frame);
+
+        return toJS(exec, node);
+    } 
+
+    return toJS(exec, collection.get());
+}
+
+// Custom attributes
+
+JSValue* JSHTMLDocument::all(ExecState* exec) const
+{
+    // If "all" has been overwritten, return the overwritten value
+    if (JSValue* v = getDirect(Identifier(exec, "all")))
+        return v;
+
+    return toJS(exec, static_cast<HTMLDocument*>(impl())->all().get());
+}
+
+void JSHTMLDocument::setAll(ExecState* exec, JSValue* value)
+{
+    // Add "all" to the property map.
+    putDirect(Identifier(exec, "all"), value);
+}
+
+// Custom functions
+
+JSValue* JSHTMLDocument::open(ExecState* exec, const ArgList& args)
+{
+    // For compatibility with other browsers, pass open calls with more than 2 parameters to the window.
+    if (args.size() > 2) {
+        Frame* frame = static_cast<HTMLDocument*>(impl())->frame();
+        if (frame) {
+            JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
+            if (wrapper) {
+                JSValue* function = wrapper->get(exec, Identifier(exec, "open"));
+                CallData callData;
+                CallType callType = function->getCallData(callData);
+                if (callType == CallTypeNone)
+                    return throwError(exec, TypeError);
+                return call(exec, function, callType, callData, wrapper, args);
+            }
+        }
+        return jsUndefined();
+    }
+
+    // document.open clobbers the security context of the document and
+    // aliases it with the active security context.
+    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
+
+    // In the case of two parameters or fewer, do a normal document open.
+    static_cast<HTMLDocument*>(impl())->open(activeDocument);
+    return jsUndefined();
+}
+
+static String writeHelper(ExecState* exec, const ArgList& args)
+{
+    // DOM only specifies single string argument, but NS & IE allow multiple
+    // or no arguments.
+
+    unsigned size = args.size();
+    if (size == 1)
+        return args.at(exec, 0)->toString(exec);
+
+    Vector<UChar> result;
+    for (unsigned i = 0; i < size; ++i)
+        append(result, args.at(exec, i)->toString(exec));
+    return String::adopt(result);
+}
+
+JSValue* JSHTMLDocument::write(ExecState* exec, const ArgList& args)
+{
+    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
+    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args), activeDocument);
+    return jsUndefined();
+}
+
+JSValue* JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
+{
+    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
+    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args) + "\n", activeDocument);
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLElementCustom.cpp b/WebCore/bindings/js/JSHTMLElementCustom.cpp
new file mode 100644
index 0000000..3345764
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLElementCustom.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLElement.h"
+
+#include "Document.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+void JSHTMLElement::pushEventHandlerScope(ExecState* exec, ScopeChain& scope) const
+{
+    HTMLElement* element = impl();
+
+    // The document is put on first, fall back to searching it only after the element and form.
+    scope.push(asObject(toJS(exec, element->ownerDocument())));
+
+    // The form is next, searched before the document, but after the element itself.
+    if (HTMLFormElement* form = element->form())
+        scope.push(asObject(toJS(exec, form)));
+
+    // The element is on top, searched first.
+    scope.push(asObject(toJS(exec, element)));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
new file mode 100644
index 0000000..ae9ebf6
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLEmbedElementCustom.h"
+
+#include "HTMLEmbedElement.h"
+#include "JSPluginElementFunctions.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+bool JSHTMLEmbedElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
+}
+
+bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot& slot)
+{
+    return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
+}
+
+CallType JSHTMLEmbedElement::getCallData(CallData& callData)
+{
+    return runtimeObjectGetCallData(impl(), callData);
+}
+
+bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const Identifier& propertyName)
+{
+    return propertyName == "__apple_runtime_object";
+}
+
+JSValue* JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return runtimeObjectGetter(exec, propertyName, slot);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLEmbedElementCustom.h b/WebCore/bindings/js/JSHTMLEmbedElementCustom.h
new file mode 100644
index 0000000..58833ae
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLEmbedElementCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSHTMLEmbedElementCustom_h
+#define JSHTMLEmbedElementCustom_h
+
+#include "JSHTMLEmbedElement.h"
+
+#endif // JSHTMLEmbedElementCustom_h
diff --git a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
new file mode 100644
index 0000000..196cb6d
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLFormElement.h"
+
+#include "HTMLCollection.h"
+#include "HTMLFormElement.h"
+#include "JSNamedNodesCollection.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSHTMLFormElement::canGetItemsForName(ExecState* exec, HTMLFormElement* form, const Identifier& propertyName)
+{
+    Vector<RefPtr<Node> > namedItems;
+    form->getNamedElements(propertyName, namedItems);
+    return namedItems.size();
+}
+
+JSValue* JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    HTMLFormElement* form = static_cast<HTMLFormElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
+    
+    Vector<RefPtr<Node> > namedItems;
+    form->getNamedElements(propertyName, namedItems);
+    
+    if (namedItems.size() == 1)
+        return toJS(exec, namedItems[0].get());
+    if (namedItems.size() > 1) 
+        return new (exec) JSNamedNodesCollection(exec, namedItems);
+    return jsUndefined();
+}
+
+}
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
new file mode 100644
index 0000000..594349a
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSHTMLFrameElement.h"
+
+#include "CSSHelper.h"
+#include "Document.h"
+#include "HTMLFrameElement.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
+{
+    if (protocolIs(parseURL(value), "javascript")) {
+        if (!checkNodeSecurity(exec, imp->contentDocument()))
+            return false;
+    }
+    return true;
+}
+
+void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue* value)
+{
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
+    String srcValue = valueToStringWithNullCheck(exec, value);
+
+    if (!allowSettingJavascriptURL(exec, imp, srcValue))
+        return;
+
+    imp->setSrc(srcValue);
+    return;
+}
+
+void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue* value)
+{
+    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
+    String locationValue = valueToStringWithNullCheck(exec, value);
+
+    if (!allowSettingJavascriptURL(exec, imp, locationValue))
+        return;
+
+    imp->setLocation(locationValue);
+    return;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
new file mode 100644
index 0000000..126ad8b
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLFrameSetElement.h"
+
+#include "Document.h"
+#include "HTMLFrameElement.h"
+#include "HTMLFrameSetElement.h"
+#include "HTMLNames.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowShell.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement* frameSet, const Identifier& propertyName)
+{
+    Node* frame = frameSet->children()->namedItem(propertyName);
+    return frame && frame->hasTagName(frameTag);
+}
+
+JSValue* JSHTMLFrameSetElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
+
+    Node* frame = element->children()->namedItem(propertyName);
+    if (Document* doc = static_cast<HTMLFrameElement*>(frame)->contentDocument()) {
+        if (JSDOMWindowShell* window = toJSDOMWindowShell(doc->frame()))
+            return window;
+    }
+
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
new file mode 100644
index 0000000..3f27462
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSHTMLIFrameElement.h"
+
+#include "CSSHelper.h"
+#include "Document.h"
+#include "HTMLIFrameElement.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue* value)
+{
+    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
+
+    String srcValue = valueToStringWithNullCheck(exec, value);
+
+    if (protocolIs(parseURL(srcValue), "javascript")) {
+        if (!checkNodeSecurity(exec, imp->contentDocument()))
+            return;
+    }
+
+    imp->setSrc(srcValue);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
new file mode 100644
index 0000000..f097e1e
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#include "config.h"
+#include "JSHTMLInputElement.h"
+
+#include "HTMLInputElement.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSHTMLInputElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (input->canHaveSelection())
+        return false;
+
+    const HashEntry* entry = JSHTMLInputElementPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHTMLInputElementPrototypeFunctionSetSelectionRange) {
+                slot.setUndefined();
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
+JSValue* JSHTMLInputElement::selectionStart(ExecState* exec) const
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        return jsUndefined();
+
+    return jsNumber(exec, input->selectionStart());
+}
+
+JSValue* JSHTMLInputElement::selectionEnd(ExecState* exec) const
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        return jsUndefined();
+
+    return jsNumber(exec, input->selectionEnd());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.h b/WebCore/bindings/js/JSHTMLInputElementCustom.h
new file mode 100644
index 0000000..f5222d2
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSHTMLInputElementCustom_h
+#define JSHTMLInputElementCustom_h
+
+#include "JSHTMLInputElement.h"
+
+#endif // JSHTMLInputElementCustom_h
diff --git a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
new file mode 100644
index 0000000..9208af0
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLObjectElementCustom.h"
+
+#include "HTMLObjectElement.h"
+#include "JSPluginElementFunctions.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+bool JSHTMLObjectElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
+}
+
+bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot& slot)
+{
+    return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
+}
+
+CallType JSHTMLObjectElement::getCallData(CallData& callData)
+{
+    return runtimeObjectGetCallData(impl(), callData);
+}
+
+bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, const Identifier& propertyName)
+{
+    return propertyName == "__apple_runtime_object";
+}
+
+JSValue* JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return runtimeObjectGetter(exec, propertyName, slot);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLObjectElementCustom.h b/WebCore/bindings/js/JSHTMLObjectElementCustom.h
new file mode 100644
index 0000000..38659f9
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLObjectElementCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSHTMLObjectElementCustom_h
+#define JSHTMLObjectElementCustom_h
+
+#include "JSHTMLObjectElement.h"
+
+#endif // JSHTMLObjectElementCustom_h
diff --git a/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
new file mode 100644
index 0000000..2b3c04e
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSHTMLOptionsCollection.h"
+
+#include "ExceptionCode.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+#include "HTMLOptionsCollection.h"
+#include "HTMLSelectElement.h"
+#include "JSHTMLOptionElement.h"
+#include "JSHTMLSelectElement.h"
+#include "JSHTMLSelectElementCustom.h"
+
+#include <wtf/MathExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSHTMLOptionsCollection::length(ExecState* exec) const
+{
+    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
+    return jsNumber(exec, imp->length());
+}
+
+void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValue* value)
+{
+    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
+    ExceptionCode ec = 0;
+    unsigned newLength = 0;
+    double lengthValue = value->toNumber(exec);
+    if (!isnan(lengthValue) && !isinf(lengthValue)) {
+        if (lengthValue < 0.0)
+            ec = INDEX_SIZE_ERR;
+        else if (lengthValue > static_cast<double>(UINT_MAX))
+            newLength = UINT_MAX;
+        else
+            newLength = static_cast<unsigned>(lengthValue);
+    }
+    if (!ec)
+        imp->setLength(newLength, ec);
+    setDOMException(exec, ec);
+}
+
+void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValue* value)
+{
+    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
+    HTMLSelectElement* base = static_cast<HTMLSelectElement*>(imp->base());
+    selectIndexSetter(base, exec, index, value);
+}
+
+JSValue* JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
+{
+    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
+    HTMLOptionElement* option = toHTMLOptionElement(args.at(exec, 0));
+    ExceptionCode ec = 0;
+    if (args.size() < 2)
+        imp->add(option, ec);
+    else {
+        bool ok;
+        int index = args.at(exec, 1)->toInt32(exec, ok);
+        if (exec->hadException())
+            return jsUndefined();
+        if (!ok)
+            ec = TYPE_MISMATCH_ERR;
+        else
+            imp->add(option, index, ec);
+    }
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
+{
+    HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
+    JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(asObject(toJS(exec, imp->base())));
+    return base->remove(exec, args);
+}
+
+}
diff --git a/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp b/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
new file mode 100644
index 0000000..06789ac
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2007 Apple, Inc.
+ * Copyright (C) 2007 Alexey Proskuryakov (ap@webkit.org)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSHTMLSelectElementCustom.h"
+
+#include "ExceptionCode.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+#include "HTMLSelectElement.h"
+#include "JSHTMLOptionElement.h"
+
+namespace WebCore {
+
+using namespace JSC;
+using namespace HTMLNames;
+
+JSValue* JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
+{
+    HTMLSelectElement& select = *static_cast<HTMLSelectElement*>(impl());
+
+    // we support both options index and options objects
+    HTMLElement* element = toHTMLElement(args.at(exec, 0));
+    if (element && element->hasTagName(optionTag))
+        select.remove(static_cast<HTMLOptionElement*>(element)->index());
+    else
+        select.remove(args.at(exec, 0)->toInt32(exec));
+
+    return jsUndefined();
+}
+
+void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValue* value)
+{
+    if (value->isUndefinedOrNull())
+        select->remove(index);
+    else {
+        ExceptionCode ec = 0;
+        HTMLOptionElement* option = toHTMLOptionElement(value);
+        if (!option)
+            ec = TYPE_MISMATCH_ERR;
+        else
+            select->setOption(index, option, ec);
+        setDOMException(exec, ec);
+    }
+}
+
+void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue* value)
+{
+    selectIndexSetter(static_cast<HTMLSelectElement*>(impl()), exec, index, value);
+}
+
+}
diff --git a/WebCore/bindings/js/JSHTMLSelectElementCustom.h b/WebCore/bindings/js/JSHTMLSelectElementCustom.h
new file mode 100644
index 0000000..de32c72
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLSelectElementCustom.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef JSHTMLSelectElementCustom_h
+#define JSHTMLSelectElementCustom_h
+
+#include "JSHTMLSelectElement.h"
+
+namespace WebCore {
+
+void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValue*);
+
+}
+
+#endif
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
new file mode 100644
index 0000000..31699a0
--- /dev/null
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSHistoryCustom.h"
+
+#include "Frame.h"
+#include "History.h"
+#include <runtime/PrototypeFunction.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionBack);
+}
+
+JSValue* nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionForward);
+}
+
+JSValue* nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 1, propertyName, jsHistoryPrototypeFunctionGo);
+}
+
+bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // When accessing History cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::customGetOwnPropertySlot for additional details.
+
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, impl()->frame(), message))
+        return false;
+
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        // Allow access to back(), forward() and go() from any frame.
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHistoryPrototypeFunctionBack) {
+                slot.setCustom(this, nonCachingStaticBackFunctionGetter);
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionForward) {
+                slot.setCustom(this, nonCachingStaticForwardFunctionGetter);
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionGo) {
+                slot.setCustom(this, nonCachingStaticGoFunctionGetter);
+                return true;
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            slot.setCustom(this, objectToStringFunctionGetter);
+            return true;
+        }
+    }
+
+    printErrorMessageForFrame(impl()->frame(), message);
+    slot.setUndefined();
+    return true;
+}
+
+bool JSHistory::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot&)
+{
+    // Only allow putting by frames in the same origin.
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+    return false;
+}
+
+bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    // Only allow deleting by frames in the same origin.
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return false;
+    return Base::deleteProperty(exec, propertyName);
+}
+
+bool JSHistory::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+{
+    // Only allow the history object to enumerated by frames in the same origin.
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+    return false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHistoryCustom.h b/WebCore/bindings/js/JSHistoryCustom.h
new file mode 100644
index 0000000..40edc6f
--- /dev/null
+++ b/WebCore/bindings/js/JSHistoryCustom.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSHistoryCustom_h
+#define JSHistoryCustom_h
+
+#include "JSHistory.h"
+
+#endif // JSHistoryCustom_h
+
+
diff --git a/WebCore/bindings/js/JSImageConstructor.cpp b/WebCore/bindings/js/JSImageConstructor.cpp
new file mode 100644
index 0000000..c1e4630
--- /dev/null
+++ b/WebCore/bindings/js/JSImageConstructor.cpp
@@ -0,0 +1,85 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSImageConstructor.h"
+
+#include "HTMLImageElement.h"
+#include "JSNode.h"
+#include "ScriptExecutionContext.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor)
+
+const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", 0, 0, 0 };
+
+JSImageConstructor::JSImageConstructor(ExecState* exec, ScriptExecutionContext* context)
+    : DOMObject(JSImageConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    ASSERT(context->isDocument());
+    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+}
+
+static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    bool widthSet = false;
+    bool heightSet = false;
+    int width = 0;
+    int height = 0;
+    if (args.size() > 0) {
+        widthSet = true;
+        width = args.at(exec, 0)->toInt32(exec);
+    }
+    if (args.size() > 1) {
+        heightSet = true;
+        height = args.at(exec, 1)->toInt32(exec);
+    }
+
+    Document* document = static_cast<JSImageConstructor*>(constructor)->document();
+
+    // Calling toJS on the document causes the JS document wrapper to be
+    // added to the window object. This is done to ensure that JSDocument::mark
+    // will be called (which will cause the image element to be marked if necessary).
+    toJS(exec, document);
+
+    RefPtr<HTMLImageElement> image = new HTMLImageElement(document);
+    if (widthSet)
+        image->setWidth(width);
+    if (heightSet)
+        image->setHeight(height);
+    return asObject(toJS(exec, image.release()));
+}
+
+ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructImage;
+    return ConstructTypeHost;
+}
+
+void JSImageConstructor::mark()
+{
+    DOMObject::mark();
+    if (!m_document->marked())
+        m_document->mark();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSImageConstructor.h b/WebCore/bindings/js/JSImageConstructor.h
new file mode 100644
index 0000000..13cce26
--- /dev/null
+++ b/WebCore/bindings/js/JSImageConstructor.h
@@ -0,0 +1,45 @@
+/*
+ *  Copyright (C) 1999 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSImageConstructor_h
+#define JSImageConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSImageConstructor : public DOMObject {
+    public:
+        JSImageConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        Document* document() const { return m_document->impl(); }
+
+        static const JSC::ClassInfo s_info;
+        
+        virtual void mark();
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+
+        JSDocument* m_document;
+    };
+
+} // namespace WebCore
+
+#endif // JSImageConstructor_h
diff --git a/WebCore/bindings/js/JSImageDataCustom.cpp b/WebCore/bindings/js/JSImageDataCustom.cpp
new file mode 100644
index 0000000..50f237a
--- /dev/null
+++ b/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSImageData.h"
+
+#include "ImageData.h"
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJS(ExecState* exec, ImageData* imageData)
+{
+    if (!imageData)
+        return jsNull();
+    
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), imageData);
+    if (wrapper)
+        return wrapper;
+    
+    wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, ImageData, imageData);
+    
+    exec->heap()->reportExtraMemoryCost(imageData->data()->length());
+    
+    return wrapper;
+}
+
+}
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
new file mode 100644
index 0000000..9bc7e7d
--- /dev/null
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectedObjectWrapper.h"
+
+#include "JSInspectorCallbackWrapper.h"
+#include <runtime/JSGlobalObject.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper)
+
+typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
+typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
+
+static GlobalObjectWrapperMap& wrappers()
+{
+    static GlobalObjectWrapperMap map;
+    return map;
+}
+
+const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
+
+JSValue* JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue* unwrappedValue)
+{
+    if (!unwrappedValue->isObject())
+        return unwrappedValue;
+
+    JSObject* unwrappedObject = asObject(unwrappedValue);
+
+    if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
+        return unwrappedObject;
+
+    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->dynamicGlobalObject()))
+        if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
+            return wrapper;
+
+    JSValue* prototype = unwrappedObject->prototype();
+    ASSERT(prototype->isNull() || prototype->isObject());
+
+    if (prototype->isNull())
+        return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructureID(jsNull()));
+    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructureID(asObject(wrap(unwrappedExec, prototype))));
+}
+
+JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<StructureID> structureID)
+    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structureID)
+{
+    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
+    if (!wrapperMap) {
+        wrapperMap = new WrapperMap;
+        wrappers().set(unwrappedGlobalObject(), wrapperMap);
+    }
+
+    ASSERT(!wrapperMap->contains(unwrappedObject));
+    wrapperMap->set(unwrappedObject, this);
+}
+
+JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
+{
+    ASSERT(wrappers().contains(unwrappedGlobalObject()));
+    WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
+
+    ASSERT(wrapperMap->contains(unwrappedObject()));
+    wrapperMap->remove(unwrappedObject());
+
+    if (wrapperMap->isEmpty()) {
+        wrappers().remove(unwrappedGlobalObject());
+        delete wrapperMap;
+    }
+}
+
+JSValue* JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue* value) const
+{
+    // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
+
+    if (!value->isObject())
+        return value;
+
+    JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
+    ASSERT_WITH_MESSAGE(wrapper, "Objects passed to JSInspectedObjectWrapper must be wrapped");
+    if (!wrapper)
+        return jsUndefined();
+
+    if (wrapper->allowsUnwrappedAccessFrom(unwrappedExecState())) {
+        ASSERT_WITH_MESSAGE(wrapper->inherits(&s_info), "A wrapper contains an object from the inspected page but is not a JSInspectedObjectWrapper");
+        if (!wrapper->inherits(&s_info))
+            return jsUndefined();
+
+        // Return the unwrapped object so the inspected page never sees one of its own objects in wrapped form.
+        return wrapper->unwrappedObject();
+    }
+
+    ASSERT_WITH_MESSAGE(wrapper->inherits(&JSInspectorCallbackWrapper::s_info), "A wrapper that was not from the inspected page and is not an Inspector callback was passed to a JSInspectedObjectWrapper");
+    if (!wrapper->inherits(&JSInspectorCallbackWrapper::s_info))
+        return jsUndefined();
+
+    return wrapper;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.h b/WebCore/bindings/js/JSInspectedObjectWrapper.h
new file mode 100644
index 0000000..1c6f2db
--- /dev/null
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSInspectedObjectWrapper_h
+#define JSInspectedObjectWrapper_h
+
+#include "JSQuarantinedObjectWrapper.h"
+
+namespace WebCore {
+
+    class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
+    public:
+        static JSC::JSValue* wrap(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue);
+        virtual ~JSInspectedObjectWrapper();
+
+        static const JSC::ClassInfo s_info;
+
+    private:
+        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::StructureID>);
+
+        virtual bool allowsGetProperty() const { return true; }
+        virtual bool allowsSetProperty() const { return true; }
+        virtual bool allowsDeleteProperty() const { return true; }
+        virtual bool allowsConstruct() const { return true; }
+        virtual bool allowsHasInstance() const { return true; }
+        virtual bool allowsCallAsFunction() const { return true; }
+        virtual bool allowsGetPropertyNames() const { return true; }
+
+        virtual JSC::JSValue* prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue) const;
+        virtual JSC::JSValue* wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // JSInspectedObjectWrapper_h
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
new file mode 100644
index 0000000..8440a1f
--- /dev/null
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorCallbackWrapper.h"
+
+#include "JSInspectedObjectWrapper.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper)
+
+typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
+
+static WrapperMap& wrappers()
+{
+    static WrapperMap map;
+    return map;
+}
+
+const ClassInfo JSInspectorCallbackWrapper::s_info = { "JSInspectorCallbackWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
+
+static StructureID* leakInspectorCallbackWrapperStructure()
+{
+    StructureID::startIgnoringLeaks();
+    StructureID* structure = JSInspectorCallbackWrapper::createStructureID(jsNull()).releaseRef();
+    StructureID::stopIgnoringLeaks();
+    return structure;
+}
+
+JSValue* JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue* unwrappedValue)
+{
+    if (!unwrappedValue->isObject())
+        return unwrappedValue;
+
+    JSObject* unwrappedObject = asObject(unwrappedValue);
+
+    if (unwrappedObject->inherits(&JSInspectorCallbackWrapper::s_info))
+        return unwrappedObject;
+
+    if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
+        return wrapper;
+
+    JSValue* prototype = unwrappedObject->prototype();
+    ASSERT(prototype->isNull() || prototype->isObject());
+
+    if (prototype->isNull()) {
+        static StructureID* structure = leakInspectorCallbackWrapperStructure();
+        return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
+    }
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, asObject(wrap(unwrappedExec, prototype))->inheritorID());
+}
+
+JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<StructureID> structureID)
+    : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structureID)
+{
+    ASSERT(!wrappers().contains(unwrappedObject));
+    wrappers().set(unwrappedObject, this);
+}
+
+JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
+{
+    wrappers().remove(unwrappedObject());
+}
+
+JSValue* JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue* unwrappedValue) const
+{
+    if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
+        // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
+        // is called. (The client-side storage API calls the callback with the `this` object set to the callback itself.)
+        ASSERT_WITH_MESSAGE(wrapper == this, "A different wrapper was passed into a JSInspectorCallbackWrapper");
+        if (wrapper != this)
+            return jsUndefined();
+
+        return wrapper->unwrappedObject();
+    }
+
+    // Any value being passed to the Inspector from the inspected page should be wrapped in a JSInspectedObjectWrapper.
+    return JSInspectedObjectWrapper::wrap(unwrappedExec, unwrappedValue);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
new file mode 100644
index 0000000..5238add
--- /dev/null
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSInspectorCallbackWrapper_h
+#define JSInspectorCallbackWrapper_h
+
+#include "JSQuarantinedObjectWrapper.h"
+
+namespace WebCore {
+
+    class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
+    public:
+        static JSC::JSValue* wrap(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue);
+
+        virtual ~JSInspectorCallbackWrapper();
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
+    protected:
+        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::StructureID>);
+
+        virtual bool allowsCallAsFunction() const { return true; }
+
+        virtual JSC::JSValue* prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue) const;
+        virtual JSC::JSValue* wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+    };
+
+} // namespace WebCore
+
+#endif // JSInspectorCallbackWrapper_h
diff --git a/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
new file mode 100644
index 0000000..ce16b31
--- /dev/null
+++ b/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSJavaScriptCallFrame.h"
+
+#include "JavaScriptCallFrame.h"
+#include <runtime/ArrayPrototype.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
+{
+    JSValue* exception = noValue();
+    JSValue* result = impl()->evaluate(args.at(exec, 0)->toString(exec), exception);
+
+    if (exception)
+        exec->setException(exception);
+
+    return result;
+}
+
+JSValue* JSJavaScriptCallFrame::thisObject(ExecState* exec) const
+{
+    return impl()->thisObject() ? impl()->thisObject() : jsNull();
+}
+
+JSValue* JSJavaScriptCallFrame::type(ExecState* exec) const
+{
+    switch (impl()->type()) {
+        case DebuggerCallFrame::FunctionType:
+            return jsString(exec, "function");
+        case DebuggerCallFrame::ProgramType:
+            return jsString(exec, "program");
+    }
+
+    ASSERT_NOT_REACHED();
+    return jsNull();
+}
+
+JSValue* JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
+{
+    if (!impl()->scopeChain())
+        return jsNull();
+
+    const ScopeChainNode* scopeChain = impl()->scopeChain();
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+
+    // we must always have something in the scope chain
+    ASSERT(iter != end);
+
+    ArgList list;
+    do {
+        list.append(*iter);
+        ++iter;
+    } while (iter != end);
+
+    return constructArray(exec, list);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
new file mode 100644
index 0000000..a5ad179
--- /dev/null
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -0,0 +1,309 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ */
+
+#include "config.h"
+#include "JSLocationCustom.h"
+
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "JSDOMBinding.h"
+#include "JSDOMWindowCustom.h"
+#include "KURL.h"
+#include "Location.h"
+#include "ScriptController.h"
+#include <runtime/PrototypeFunction.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionReplace);
+}
+
+JSValue* nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 0, propertyName, jsLocationPrototypeFunctionReload);
+}
+
+JSValue* nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionAssign);
+}
+
+bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    Frame* frame = impl()->frame();
+    if (!frame) {
+        slot.setUndefined();
+        return true;
+    }
+
+    // When accessing Location cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::customGetOwnPropertySlot for additional details.
+
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, frame, message))
+        return false;
+
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry && (entry->attributes() & Function)) {
+        if (entry->function() == jsLocationPrototypeFunctionReplace) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionReload) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
+            slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
+            return true;
+        }
+    }
+
+    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
+    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
+    // such cases when normally the string form of Location would be the URL.
+
+    printErrorMessageForFrame(frame, message);
+    slot.setUndefined();
+    return true;
+}
+
+bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot& slot)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return true;
+
+    bool sameDomainAccess = allowsAccessFromFrame(exec, frame);
+
+    const HashEntry* entry = JSLocation::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (!entry) {
+        if (sameDomainAccess)
+            JSObject::put(exec, propertyName, value, slot);
+        return true;
+    }
+
+    // Cross-domain access to the location is allowed when assigning the whole location,
+    // but not when assigning the individual pieces, since that might inadvertently
+    // disclose other parts of the original location.
+    if (entry->propertyPutter() != setJSLocationHref && !sameDomainAccess)
+        return true;
+
+    return false;
+}
+
+bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    // Only allow deleting by frames in the same origin.
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return false;
+    return Base::deleteProperty(exec, propertyName);
+}
+
+bool JSLocation::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+{
+    // Only allow the location object to enumerated by frames in the same origin.
+    if (!allowsAccessFromFrame(exec, impl()->frame()))
+        return true;
+    return false;
+}
+
+static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory)
+{
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!url.protocolIs("javascript") || allowsAccessFromFrame(exec, frame)) {
+        bool userGesture = activeFrame->script()->processingUserGesture();
+        frame->loader()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, userGesture);
+    }
+}
+
+void JSLocation::setHref(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return;
+    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+        return;
+
+    KURL url = activeFrame->loader()->completeURL(value->toString(exec));
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setProtocol(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    url.setProtocol(value->toString(exec));
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setHost(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    url.setHostAndPort(value->toString(exec));
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setHostname(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    url.setHost(value->toString(exec));
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setPort(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    // FIXME: Could make this a little less ugly if String provided a toUnsignedShort function.
+    const UString& portString = value->toString(exec);
+    int port = charactersToInt(portString.data(), portString.size());
+    if (port < 0 || port > 0xFFFF)
+        port = 0;
+    url.setPort(port);
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setPathname(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    url.setPath(value->toString(exec));
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setSearch(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    url.setQuery(value->toString(exec));
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+void JSLocation::setHash(ExecState* exec, JSValue* value)
+{
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    KURL url = frame->loader()->url();
+    String oldRef = url.ref();
+    String str = value->toString(exec);
+    if (str.startsWith("#"))
+        str = str.substring(1);
+    if (oldRef == str || (oldRef.isNull() && str.isEmpty()))
+        return;
+    url.setRef(str);
+
+    navigateIfAllowed(exec, frame, url, false);
+}
+
+JSValue* JSLocation::replace(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame) 
+        return jsUndefined();
+    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+        return jsUndefined();
+
+    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), true);
+    return jsUndefined();
+}
+
+JSValue* JSLocation::reload(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+
+    JSDOMWindow* window = toJSDOMWindow(frame);
+    if (!window->allowsAccessFrom(exec))
+        return jsUndefined();
+
+    if (!frame->loader()->url().protocolIs("javascript") || (window && window->allowsAccessFrom(exec))) {
+        bool userGesture = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()->script()->processingUserGesture();
+        frame->loader()->scheduleRefresh(userGesture);
+    }
+    return jsUndefined();
+}
+
+JSValue* JSLocation::assign(ExecState* exec, const ArgList& args)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return jsUndefined();
+    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+        return jsUndefined();
+
+    // We want a new history item if this JS was called via a user gesture
+    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), false);
+    return jsUndefined();
+}
+
+JSValue* JSLocation::toString(ExecState* exec, const ArgList&)
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    if (!allowsAccessFromFrame(exec, frame))
+        return jsUndefined();
+
+    return jsString(exec, impl()->toString());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSLocationCustom.h b/WebCore/bindings/js/JSLocationCustom.h
new file mode 100644
index 0000000..127871e
--- /dev/null
+++ b/WebCore/bindings/js/JSLocationCustom.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSLocationCustom_h
+#define JSLocationCustom_h
+
+#include "JSLocation.h"
+
+#endif // JSLocationCustom_h
+
+
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
new file mode 100644
index 0000000..0151128
--- /dev/null
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSMessageChannelConstructor.h"
+
+#include "Document.h"
+#include "JSDocument.h"
+#include "JSMessageChannel.h"
+#include "MessageChannel.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSMessageChannelConstructor::s_info = { "MessageChannelConstructor", 0, 0, 0 };
+
+JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, ScriptExecutionContext* scriptExecutionContext)
+    : DOMObject(JSMessageChannelConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_scriptExecutionContext(scriptExecutionContext)
+{
+    if (m_scriptExecutionContext->isDocument())
+        m_contextWrapper = toJS(exec, static_cast<Document*>(scriptExecutionContext));
+    else if (m_scriptExecutionContext->isWorkerContext())
+        ; // Not yet implemented.
+    else
+        ASSERT_NOT_REACHED();
+
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+}
+
+JSMessageChannelConstructor::~JSMessageChannelConstructor()
+{
+}
+
+ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = construct;
+    return ConstructTypeHost;
+}
+
+JSObject* JSMessageChannelConstructor::construct(ExecState* exec, JSObject* constructor, const ArgList&)
+{
+    return asObject(toJS(exec, MessageChannel::create(static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext())));
+}
+
+void JSMessageChannelConstructor::mark()
+{
+    DOMObject::mark();
+    if (!m_contextWrapper->marked())
+        m_contextWrapper->mark();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.h b/WebCore/bindings/js/JSMessageChannelConstructor.h
new file mode 100644
index 0000000..0d26b4e
--- /dev/null
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSMessageChannelConstructor_h
+#define JSMessageChannelConstructor_h
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSMessageChannelConstructor : public DOMObject {
+    public:
+        JSMessageChannelConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        virtual ~JSMessageChannelConstructor();
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
+        ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+
+        virtual bool implementsHasInstance() const { return true; }
+        static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+
+        virtual void mark();
+
+    private:
+        ScriptExecutionContext* m_scriptExecutionContext;
+        JSC::JSValue* m_contextWrapper;
+    };
+
+} // namespace WebCore
+
+#endif // JSMessageChannelConstructor_h
diff --git a/WebCore/bindings/js/JSMessageChannelCustom.cpp b/WebCore/bindings/js/JSMessageChannelCustom.cpp
new file mode 100644
index 0000000..70329e2
--- /dev/null
+++ b/WebCore/bindings/js/JSMessageChannelCustom.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSMessageChannel.h"
+
+#include "MessageChannel.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+void JSMessageChannel::mark()
+{
+    DOMObject::mark();
+
+    if (MessagePort* port = m_impl->port1()) {
+        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
+        if (wrapper && !wrapper->marked())
+            wrapper->mark();
+    }
+
+    if (MessagePort* port = m_impl->port2()) {
+        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), port);
+        if (wrapper && !wrapper->marked())
+            wrapper->mark();
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.cpp
new file mode 100644
index 0000000..5768b0f
--- /dev/null
+++ b/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSMessagePort.h"
+
+#include "AtomicString.h"
+#include "Event.h"
+#include "Frame.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+#include "MessagePort.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSMessagePort::mark()
+{
+    DOMObject::mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
+        listener->mark();
+
+    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onclose()))
+        listener->mark();
+
+    if (MessagePort* entangledPort = m_impl->entangledPort()) {
+        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
+        if (wrapper && !wrapper->marked())
+            wrapper->mark();
+    }
+
+    typedef MessagePort::EventListenersMap EventListenersMap;
+    typedef MessagePort::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
+            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
+            listener->mark();
+        }
+    }
+}
+
+JSValue* JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
+    const UString& message = args.at(exec, 0)->toString(exec);
+
+    return toJS(exec, impl()->startConversation(globalObject->scriptExecutionContext(), message).get());
+}
+
+JSValue* JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue* JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
new file mode 100644
index 0000000..7cbba53
--- /dev/null
+++ b/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -0,0 +1,40 @@
+/*
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSMimeTypeArray.h"
+
+#include "AtomicString.h"
+#include "MimeTypeArray.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArray, const Identifier& propertyName)
+{
+    return mimeTypeArray->canGetItemsForName(propertyName);
+}
+
+JSValue* JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->nameGetter(propertyName));
+}
+
+}
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
new file mode 100644
index 0000000..1930b6b
--- /dev/null
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSNamedNodeMap.h"
+
+#include "JSNode.h"
+#include "NamedNodeMap.h"
+#include "Node.h"
+#include "PlatformString.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Identifier& propertyName)
+{
+    return impl->getNamedItem(propertyName);
+}
+
+JSValue* JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.cpp b/WebCore/bindings/js/JSNamedNodesCollection.cpp
new file mode 100644
index 0000000..ccf90f7
--- /dev/null
+++ b/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSNamedNodesCollection.h"
+
+#include "AtomicString.h"
+#include "Element.h"
+#include "JSNode.h"
+#include "NamedAttrMap.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection)
+
+const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
+
+// Such a collection is usually very short-lived, it only exists
+// for constructs like document.forms.<name>[1],
+// so it shouldn't be a problem that it's storing all the nodes (with the same name). (David)
+JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, const Vector<RefPtr<Node> >& nodes)
+    : DOMObject(getDOMStructure<JSNamedNodesCollection>(exec))
+    , m_nodes(new Vector<RefPtr<Node> >(nodes))
+{
+}
+
+JSValue* JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
+    return jsNumber(exec, thisObj->m_nodes->size());
+}
+
+JSValue* JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
+    return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
+}
+
+bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    if (propertyName == exec->propertyNames().length) {
+        slot.setCustom(this, lengthGetter);
+        return true;
+    }
+
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok);
+    if (ok && index < m_nodes->size()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+
+    // For IE compatibility, we need to be able to look up elements in a
+    // document.formName.name result by id as well as be index.
+
+    AtomicString atomicPropertyName = propertyName;
+    for (unsigned i = 0; i < m_nodes->size(); i++) {
+        Node* node = (*m_nodes)[i].get();
+        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
+            slot.setCustomIndex(this, i, indexGetter);
+            return true;
+        }
+    }
+
+    return DOMObject::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.h b/WebCore/bindings/js/JSNamedNodesCollection.h
new file mode 100644
index 0000000..e929400
--- /dev/null
+++ b/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSNamedNodesCollection_h
+#define JSNamedNodesCollection_h
+
+#include "JSDOMBinding.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class Node;
+
+    // Internal class, used for the collection return by e.g. document.forms.myinput
+    // when multiple nodes have the same name.
+    class JSNamedNodesCollection : public DOMObject {
+    public:
+        JSNamedNodesCollection(JSC::ExecState*, const Vector<RefPtr<Node> >&);
+
+        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        {
+            return exec->lexicalGlobalObject()->objectPrototype();
+        }
+
+        static PassRefPtr<JSC::StructureID> createStructureID(JSC::JSValue* prototype)
+        {
+            return JSC::StructureID::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        }
+
+    private:
+        static JSC::JSValue* lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue* indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+        OwnPtr<Vector<RefPtr<Node> > > m_nodes;
+    };
+
+} // namespace WebCore
+
+#endif // JSNamedNodesCollection_h
diff --git a/WebCore/bindings/js/JSNavigatorCustom.cpp b/WebCore/bindings/js/JSNavigatorCustom.cpp
new file mode 100644
index 0000000..a85eb93
--- /dev/null
+++ b/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -0,0 +1,125 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
+ *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSNavigator.h"
+
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "KURL.h"
+#include "Navigator.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+static bool needsYouTubeQuirk(ExecState*, Frame*);
+
+#if 1
+
+static inline bool needsYouTubeQuirk(ExecState*, Frame*)
+{
+    return false;
+}
+
+#else
+
+static bool needsYouTubeQuirk(ExecState* exec, Frame* frame)
+{
+    // This quirk works around a mistaken check in an ad at youtube.com.
+    // There's a function called isSafari that returns false if the function
+    // called isWindows returns true; thus the site malfunctions with Windows Safari.
+
+    // Do the quirk only if the function's name is "isWindows".
+    JSFunction* function = exec->function();
+    if (!function)
+        return false;
+    static const Identifier& isWindowsFunctionName = *new Identifier(exec, "isWindows");
+    if (function->functionName() != isWindowsFunctionName)
+        return false;
+
+    // Do the quirk only if the function is called by an "isSafari" function.
+    // However, that function is not itself named -- it is stored in the isSafari
+    // property, though, so that's how we recognize it.
+    ExecState* callingExec = exec->callingExecState();
+    if (!callingExec)
+        return false;
+    JSFunction* callingFunction = callingExec->function();
+    if (!callingFunction)
+        return false;
+    JSObject* thisObject = callingExec->thisValue();
+    if (!thisObject)
+        return false;
+    static const Identifier& isSafariFunctionName = *new Identifier(exec, "isSafari");
+    JSValue* isSafariFunction = thisObject->getDirect(isSafariFunctionName);
+    if (isSafariFunction != callingFunction)
+        return false;
+
+    Document* document = frame->document();
+    // FIXME: The document is never null, so we should remove this check along with the
+    // other similar ones in this file when we are absolutely sure it's safe.
+    if (!document)
+        return false;
+
+    // Do the quirk only on the front page of the global version of YouTube.
+    const KURL& url = document->url();
+    if (url.host() != "youtube.com" && url.host() != "www.youtube.com")
+        return false;
+    if (url.path() != "/")
+        return false;
+
+    // As with other site-specific quirks, allow website developers to turn this off.
+    // In theory, this allows website developers to check if their fixes are effective.
+    Settings* settings = frame->settings();
+    if (!settings)
+        return false;
+    if (!settings->needsSiteSpecificQuirks())
+        return false;
+
+    return true;
+}
+
+#endif
+
+JSValue* JSNavigator::appVersion(ExecState* exec) const
+{
+    Navigator* imp = static_cast<Navigator*>(impl());
+    Frame* frame = imp->frame();
+    if (!frame)
+        return jsString(exec, "");
+
+    if (needsYouTubeQuirk(exec, frame))
+        return jsString(exec, "");
+    return jsString(exec, imp->appVersion());
+}
+
+void JSNavigator::mark()
+{
+    Base::mark();
+
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(globalData, impl()->optionalGeolocation());
+}
+
+}
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
new file mode 100644
index 0000000..c40777b
--- /dev/null
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -0,0 +1,241 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSNode.h"
+
+#include "Attr.h"
+#include "CDATASection.h"
+#include "Comment.h"
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "DocumentType.h"
+#include "Entity.h"
+#include "EntityReference.h"
+#include "HTMLElement.h"
+#include "JSAttr.h"
+#include "JSCDATASection.h"
+#include "JSComment.h"
+#include "JSDocument.h"
+#include "JSDocumentFragment.h"
+#include "JSDocumentType.h"
+#include "JSEntity.h"
+#include "JSEntityReference.h"
+#include "JSHTMLElement.h"
+#include "JSHTMLElementWrapperFactory.h"
+#include "JSNotation.h"
+#include "JSProcessingInstruction.h"
+#include "JSText.h"
+#include "Node.h"
+#include "Notation.h"
+#include "ProcessingInstruction.h"
+#include "Text.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(SVG)
+#include "JSSVGElementWrapperFactory.h"
+#include "SVGElement.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+typedef int ExpectionCode;
+
+JSValue* JSNode::insertBefore(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    bool ok = impl()->insertBefore(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    setDOMException(exec, ec);
+    if (ok)
+        return args.at(exec, 0);
+    return jsNull();
+}
+
+JSValue* JSNode::replaceChild(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    bool ok = impl()->replaceChild(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    setDOMException(exec, ec);
+    if (ok)
+        return args.at(exec, 1);
+    return jsNull();
+}
+
+JSValue* JSNode::removeChild(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    bool ok = impl()->removeChild(toNode(args.at(exec, 0)), ec);
+    setDOMException(exec, ec);
+    if (ok)
+        return args.at(exec, 0);
+    return jsNull();
+}
+
+JSValue* JSNode::appendChild(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    bool ok = impl()->appendChild(toNode(args.at(exec, 0)), ec, true);
+    setDOMException(exec, ec);
+    if (ok)
+        return args.at(exec, 0);
+    return jsNull();
+}
+
+void JSNode::mark()
+{
+    ASSERT(!marked());
+
+    Node* node = m_impl.get();
+
+    // Nodes in the document are kept alive by ScriptInterpreter::mark,
+    // so we have no special responsibilities and can just call the base class here.
+    if (node->inDocument()) {
+        // But if the document isn't marked we have to mark it to ensure that
+        // nodes reachable from this one are also marked
+        if (Document* doc = node->ownerDocument())
+            if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
+                if (!docWrapper->marked())
+                    docWrapper->mark();
+        DOMObject::mark();
+        return;
+    }
+
+    // This is a node outside the document, so find the root of the tree it is in,
+    // and start marking from there.
+    Node* root = node;
+    for (Node* current = m_impl.get(); current; current = current->parentNode())
+        root = current;
+
+    // If we're already marking this tree, then we can simply mark this wrapper
+    // by calling the base class; our caller is iterating the tree.
+    if (root->inSubtreeMark()) {
+        DOMObject::mark();
+        return;
+    }
+
+    // Mark the whole tree; use the global set of roots to avoid reentering.
+    root->setInSubtreeMark(true);
+    for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
+        JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
+        if (wrapper) {
+            if (!wrapper->marked())
+                wrapper->mark();
+        } else if (nodeToMark == node) {
+            // This is the case where the map from the document to wrappers has
+            // been cleared out, but a wrapper is being marked. For now, we'll
+            // let the rest of the tree of wrappers get collected, because we have
+            // no good way of finding them. Later we should test behavior of other
+            // browsers and see if we need to preserve other wrappers in this case.
+            if (!marked())
+                mark();
+        }
+    }
+    root->setInSubtreeMark(false);
+
+    // Double check that we actually ended up marked. This assert caught problems in the past.
+    ASSERT(marked());
+}
+
+static ALWAYS_INLINE JSValue* createWrapper(ExecState* exec, Node* node)
+{
+    ASSERT(node);
+    ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
+    
+    JSNode* wrapper;    
+    switch (node->nodeType()) {
+        case Node::ELEMENT_NODE:
+            if (node->isHTMLElement())
+                wrapper = createJSHTMLWrapper(exec, static_cast<HTMLElement*>(node));
+#if ENABLE(SVG)
+            else if (node->isSVGElement())
+                wrapper = createJSSVGWrapper(exec, static_cast<SVGElement*>(node));
+#endif
+            else
+                wrapper = CREATE_DOM_NODE_WRAPPER(exec, Element, node);
+            break;
+        case Node::ATTRIBUTE_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, Attr, node);
+            break;
+        case Node::TEXT_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, Text, node);
+            break;
+        case Node::CDATA_SECTION_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, CDATASection, node);
+            break;
+        case Node::ENTITY_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, Entity, node);
+            break;
+        case Node::PROCESSING_INSTRUCTION_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, ProcessingInstruction, node);
+            break;
+        case Node::COMMENT_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, Comment, node);
+            break;
+        case Node::DOCUMENT_NODE:
+            // we don't want to cache the document itself in the per-document dictionary
+            return toJS(exec, static_cast<Document*>(node));
+        case Node::DOCUMENT_TYPE_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, DocumentType, node);
+            break;
+        case Node::NOTATION_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, Notation, node);
+            break;
+        case Node::DOCUMENT_FRAGMENT_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, DocumentFragment, node);
+            break;
+        case Node::ENTITY_REFERENCE_NODE:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, EntityReference, node);
+            break;
+        default:
+            wrapper = CREATE_DOM_NODE_WRAPPER(exec, Node, node);
+    }
+
+    return wrapper;    
+}
+    
+JSValue* toJSNewlyCreated(ExecState* exec, Node* node)
+{
+    if (!node)
+        return jsNull();
+    
+    return createWrapper(exec, node);
+}
+    
+JSValue* toJS(ExecState* exec, Node* node)
+{
+    if (!node)
+        return jsNull();
+
+    JSNode* wrapper = getCachedDOMNodeWrapper(node->document(), node);
+    if (wrapper)
+        return wrapper;
+
+    return createWrapper(exec, node);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.cpp b/WebCore/bindings/js/JSNodeFilterCondition.cpp
new file mode 100644
index 0000000..bc5f01d
--- /dev/null
+++ b/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSNodeFilterCondition.h"
+
+#include "JSNode.h"
+#include "JSNodeFilter.h"
+#include "NodeFilter.h"
+#include <runtime/JSLock.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition)
+
+JSNodeFilterCondition::JSNodeFilterCondition(JSValue* filter)
+    : m_filter(filter)
+{
+}
+
+void JSNodeFilterCondition::mark()
+{
+    if (!m_filter->marked())
+        m_filter->mark();
+}
+
+short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
+{
+    JSLock lock(false);
+
+    CallData callData;
+    CallType callType = m_filter->getCallData(callData);
+    if (callType == CallTypeNone)
+        return NodeFilter::FILTER_ACCEPT;
+
+   // The exec argument here should only be null if this was called from a
+   // non-JavaScript language, and this is a JavaScript filter, and the document
+   // in question is not associated with the frame. In that case, we're going to
+   // behave incorrectly, and just reject nodes instead of calling the filter function.
+   // To fix that we'd need to come up with a way to find a suitable JavaScript
+   // execution context for the filter function to run in.
+    if (!exec)
+        return NodeFilter::FILTER_REJECT;
+
+    ArgList args;
+    args.append(toJS(exec, filterNode));
+    if (exec->hadException())
+        return NodeFilter::FILTER_REJECT;
+
+    JSValue* result = call(exec, m_filter, callType, callData, m_filter, args);
+    if (exec->hadException())
+        return NodeFilter::FILTER_REJECT;
+
+    int intResult = result->toInt32(exec);
+    if (exec->hadException())
+        return NodeFilter::FILTER_REJECT;
+
+    return intResult;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeFilterCondition.h b/WebCore/bindings/js/JSNodeFilterCondition.h
new file mode 100644
index 0000000..e39d094
--- /dev/null
+++ b/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -0,0 +1,49 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSNodeFilterCondition_h
+#define JSNodeFilterCondition_h
+
+#include "NodeFilterCondition.h"
+#include <runtime/JSValue.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Node;
+
+    class JSNodeFilterCondition : public NodeFilterCondition {
+    public:
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue* filter)
+        {
+            return adoptRef(new JSNodeFilterCondition(filter));
+        }
+
+    private:
+        JSNodeFilterCondition(JSC::JSValue* filter);
+
+        virtual short acceptNode(JSC::ExecState*, Node*) const;
+        virtual void mark();
+
+        JSC::JSValue* m_filter;
+    };
+
+} // namespace WebCore
+
+#endif // JSNodeFilterCondition_h
diff --git a/WebCore/bindings/js/JSNodeFilterCustom.cpp b/WebCore/bindings/js/JSNodeFilterCustom.cpp
new file mode 100644
index 0000000..351062b
--- /dev/null
+++ b/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSNodeFilter.h"
+
+#include "JSNode.h"
+#include "JSNodeFilterCondition.h"
+#include "NodeFilter.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSNodeFilter::mark()
+{
+    impl()->mark();
+    DOMObject::mark();
+}
+
+JSValue* JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
+{
+    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(exec, 0))));
+}
+
+PassRefPtr<NodeFilter> toNodeFilter(JSValue* value)
+{
+    if (value->isObject(&JSNodeFilter::s_info))
+        return static_cast<JSNodeFilter*>(asObject(value))->impl();
+
+    return NodeFilter::create(JSNodeFilterCondition::create(value));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/WebCore/bindings/js/JSNodeIteratorCustom.cpp
new file mode 100644
index 0000000..445c8cb
--- /dev/null
+++ b/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSNodeIterator.h"
+
+#include "JSNode.h"
+#include "Node.h"
+#include "NodeFilter.h"
+#include "NodeIterator.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSNodeIterator::mark()
+{
+    if (NodeFilter* filter = m_impl->filter())
+        filter->mark();
+    
+    DOMObject::mark();
+}
+
+JSValue* JSNodeIterator::nextNode(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    RefPtr<Node> node = impl()->nextNode(exec, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    return toJS(exec, node.get());
+}
+
+JSValue* JSNodeIterator::previousNode(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    RefPtr<Node> node = impl()->previousNode(exec, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    return toJS(exec, node.get());
+}
+
+}
diff --git a/WebCore/bindings/js/JSNodeListCustom.cpp b/WebCore/bindings/js/JSNodeListCustom.cpp
new file mode 100644
index 0000000..973538e
--- /dev/null
+++ b/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSNodeList.h"
+
+#include "AtomicString.h"
+#include "JSNode.h"
+#include "Node.h"
+#include "NodeList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+// Need to support call so that list(0) works.
+static JSValue* callNodeList(ExecState* exec, JSObject* function, JSValue*, const ArgList& args)
+{
+    bool ok;
+    unsigned index = args.at(exec, 0)->toString(exec).toUInt32(&ok);
+    if (!ok)
+        return jsUndefined();
+    return toJS(exec, static_cast<JSNodeList*>(function)->impl()->item(index));
+}
+
+CallType JSNodeList::getCallData(CallData& callData)
+{
+    callData.native.function = callNodeList;
+    return CallTypeHost;
+}
+
+bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier& propertyName)
+{
+    return impl->itemWithName(propertyName);
+}
+
+JSValue* JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->itemWithName(propertyName));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSOptionConstructor.cpp b/WebCore/bindings/js/JSOptionConstructor.cpp
new file mode 100644
index 0000000..8fffb55
--- /dev/null
+++ b/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSOptionConstructor.h"
+
+#include "HTMLOptionElement.h"
+#include "JSHTMLOptionElement.h"
+#include "ScriptExecutionContext.h"
+#include "Text.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor)
+
+const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", 0, 0, 0 };
+
+JSOptionConstructor::JSOptionConstructor(ExecState* exec, ScriptExecutionContext* context)
+    : DOMObject(JSOptionConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    ASSERT(context->isDocument());
+    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+
+    putDirect(exec->propertyNames().length, jsNumber(exec, 4), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    Document* document = static_cast<JSOptionConstructor*>(constructor)->document();
+
+    ExceptionCode ec = 0;
+
+    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement("option", ec));
+    RefPtr<Text> text;
+    if (ec == 0)
+        text = document->createTextNode("");
+    if (ec == 0 && !args.at(exec, 0)->isUndefined())
+        text->setData(args.at(exec, 0)->toString(exec), ec);
+    if (ec == 0)
+        element->appendChild(text.release(), ec);
+    if (ec == 0 && !args.at(exec, 1)->isUndefined())
+        element->setValue(args.at(exec, 1)->toString(exec));
+    if (ec == 0)
+        element->setDefaultSelected(args.at(exec, 2)->toBoolean(exec));
+    if (ec == 0)
+        element->setSelected(args.at(exec, 3)->toBoolean(exec));
+
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
+
+    return asObject(toJS(exec, element.release()));
+}
+
+ConstructType JSOptionConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructHTMLOptionElement;
+    return ConstructTypeHost;
+}
+
+void JSOptionConstructor::mark()
+{
+    DOMObject::mark();
+    if (!m_document->marked())
+        m_document->mark();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSOptionConstructor.h b/WebCore/bindings/js/JSOptionConstructor.h
new file mode 100644
index 0000000..5234c49
--- /dev/null
+++ b/WebCore/bindings/js/JSOptionConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef JSOptionConstructor_h
+#define JSOptionConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class JSOptionConstructor : public DOMObject {
+    public:
+        JSOptionConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        Document* document() const { return m_document->impl(); }
+
+        static const JSC::ClassInfo s_info;
+        
+        virtual void mark();
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+
+        JSDocument* m_document;
+    };
+
+} // namespace WebCore
+
+#endif // JSOptionConstructor_h
diff --git a/WebCore/bindings/js/JSPluginArrayCustom.cpp b/WebCore/bindings/js/JSPluginArrayCustom.cpp
new file mode 100644
index 0000000..eb379a7
--- /dev/null
+++ b/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -0,0 +1,40 @@
+/*
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSPluginArray.h"
+
+#include "AtomicString.h"
+#include "PluginArray.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, const Identifier& propertyName)
+{
+    return pluginArray->canGetItemsForName(propertyName);
+}
+
+JSValue* JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->nameGetter(propertyName));
+}
+
+}
diff --git a/WebCore/bindings/js/JSPluginCustom.cpp b/WebCore/bindings/js/JSPluginCustom.cpp
new file mode 100644
index 0000000..5cc4a92
--- /dev/null
+++ b/WebCore/bindings/js/JSPluginCustom.cpp
@@ -0,0 +1,40 @@
+/*
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSPlugin.h"
+
+#include "AtomicString.h"
+#include "Plugin.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier& propertyName)
+{
+    return plugin->canGetItemsForName(propertyName);
+}
+
+JSValue* JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->nameGetter(propertyName));
+}
+
+}
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.cpp b/WebCore/bindings/js/JSPluginElementFunctions.cpp
new file mode 100644
index 0000000..94e9806
--- /dev/null
+++ b/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -0,0 +1,121 @@
+/*
+ *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSPluginElementFunctions.h"
+
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLDocument.h"
+#include "HTMLNames.h"
+#include "HTMLPlugInElement.h"
+#include "JSHTMLElement.h"
+#include "ScriptController.h"
+#include "runtime.h"
+#include "runtime_object.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace Bindings;
+using namespace HTMLNames;
+
+// Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
+
+static Instance* pluginInstance(Node* node)
+{
+    if (!node)
+        return 0;
+    if (!(node->hasTagName(objectTag) || node->hasTagName(embedTag) || node->hasTagName(appletTag)))
+        return 0;
+    HTMLPlugInElement* plugInElement = static_cast<HTMLPlugInElement*>(node);
+    Instance* instance = plugInElement->getInstance();
+    if (!instance || !instance->rootObject())
+        return 0;
+    return instance;
+}
+
+static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
+{
+    Instance* instance = pluginInstance(node);
+    if (!instance)
+        return 0;
+    return JSC::Bindings::Instance::createRuntimeObject(exec, instance);
+}
+
+JSValue* runtimeObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    return runtimeObject ? runtimeObject : jsUndefined();
+}
+
+JSValue* runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
+    HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    if (!runtimeObject)
+        return jsUndefined();
+    return runtimeObject->get(exec, propertyName);
+}
+
+bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, JSHTMLElement* element)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    if (!runtimeObject)
+        return false;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    slot.setCustom(element, runtimeObjectPropertyGetter);
+    return true;
+}
+
+bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue* value, HTMLElement* element, PutPropertySlot& slot)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
+    if (!runtimeObject)
+        return 0;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    runtimeObject->put(exec, propertyName, value, slot);
+    return true;
+}
+
+static JSValue* callPlugin(ExecState* exec, JSObject* function, JSValue*, const ArgList& args)
+{
+    Instance* instance = pluginInstance(static_cast<JSHTMLElement*>(function)->impl());
+    instance->begin();
+    JSValue* result = instance->invokeDefaultMethod(exec, args);
+    instance->end();
+    return result;
+}
+
+CallType runtimeObjectGetCallData(HTMLElement* element, CallData& callData)
+{
+    Instance* instance = pluginInstance(element);
+    if (!instance || !instance->supportsInvokeDefaultMethod())
+        return CallTypeNone;
+    callData.native.function = callPlugin;
+    return CallTypeHost;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.h b/WebCore/bindings/js/JSPluginElementFunctions.h
new file mode 100644
index 0000000..280ffb7
--- /dev/null
+++ b/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (C) 1999 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSPluginElementFunctions_h
+#define JSPluginElementFunctions_h
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class HTMLElement;
+    class JSHTMLElement;
+    class Node;
+
+    // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
+
+    JSC::JSValue* runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue* runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue*, HTMLElement*, JSC::PutPropertySlot&);
+    JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
+
+} // namespace WebCore
+
+#endif // JSPluginElementFunctions_h
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
new file mode 100644
index 0000000..7bb0c79
--- /dev/null
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -0,0 +1,278 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSQuarantinedObjectWrapper.h"
+
+#include <runtime/JSGlobalObject.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper)
+
+const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
+
+JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue* value)
+{
+    if (!value->isObject())
+        return 0;
+
+    JSObject* object = asObject(value);
+
+    if (!object->inherits(&JSQuarantinedObjectWrapper::s_info))
+        return 0;
+
+    return static_cast<JSQuarantinedObjectWrapper*>(object);
+}
+
+JSValue* JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
+{
+    JSValue* v = slot.slotBase();
+    ASSERT(v);
+    return v;
+}
+
+JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<StructureID> structureID)
+    : JSObject(structureID)
+    , m_unwrappedGlobalObject(unwrappedExec->dynamicGlobalObject())
+    , m_unwrappedObject(unwrappedObject)
+{
+    ASSERT_ARG(unwrappedExec, unwrappedExec);
+    ASSERT_ARG(unwrappedObject, unwrappedObject);
+    ASSERT(this->structureID());
+}
+
+JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
+{
+}
+
+bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
+{
+    return m_unwrappedGlobalObject->profileGroup() == exec->dynamicGlobalObject()->profileGroup();
+}
+
+ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
+{
+    return m_unwrappedGlobalObject->globalExec();
+}
+
+void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) const
+{
+    ASSERT(exec != unwrappedExecState());
+
+    if (!unwrappedExecState()->hadException())
+        return;
+
+    exec->setException(wrapOutgoingValue(unwrappedExecState(), unwrappedExecState()->exception()));
+    unwrappedExecState()->clearException();
+}
+
+void JSQuarantinedObjectWrapper::mark()
+{
+    JSObject::mark();
+
+    if (!m_unwrappedObject->marked())
+        m_unwrappedObject->mark();
+    if (!m_unwrappedGlobalObject->marked())
+        m_unwrappedGlobalObject->mark();
+}
+
+bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Identifier& identifier, PropertySlot& slot)
+{
+    if (!allowsGetProperty()) {
+        slot.setUndefined();
+        return true;
+    }
+
+    PropertySlot unwrappedSlot(m_unwrappedObject);
+    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
+    if (result) {
+        JSValue* unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
+    }
+
+    transferExceptionToExecState(exec);
+
+    return result;
+}
+
+bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySlot& slot)
+{
+    if (!allowsGetProperty()) {
+        slot.setUndefined();
+        return true;
+    }
+
+    PropertySlot unwrappedSlot(m_unwrappedObject);
+    bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
+    if (result) {
+        JSValue* unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
+    }
+
+    transferExceptionToExecState(exec);
+
+    return result;
+}
+
+void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue* value, PutPropertySlot& slot)
+{
+    if (!allowsSetProperty())
+        return;
+
+    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value), slot);
+
+    transferExceptionToExecState(exec);
+}
+
+void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue* value)
+{
+    if (!allowsSetProperty())
+        return;
+
+    m_unwrappedObject->put(unwrappedExecState(), identifier, prepareIncomingValue(exec, value));
+
+    transferExceptionToExecState(exec);
+}
+
+bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
+{
+    if (!allowsDeleteProperty())
+        return false;
+
+    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
+
+    transferExceptionToExecState(exec);
+
+    return result;
+}
+
+bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, unsigned identifier)
+{
+    if (!allowsDeleteProperty())
+        return false;
+
+    bool result = m_unwrappedObject->deleteProperty(unwrappedExecState(), identifier);
+
+    transferExceptionToExecState(exec);
+
+    return result;
+}
+
+JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
+
+    ArgList preparedArgs;
+    for (size_t i = 0; i < args.size(); ++i)
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+
+    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
+    // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
+    ConstructData unwrappedConstructData;
+    ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
+    ASSERT(unwrappedConstructType != ConstructTypeNone);
+
+    JSValue* unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+
+    JSValue* resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    ASSERT(resultValue->isObject());
+    JSObject* result = asObject(resultValue);
+
+    wrapper->transferExceptionToExecState(exec);
+
+    return result;
+}
+
+ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constructData)
+{
+    if (!allowsConstruct())
+        return ConstructTypeNone;
+    ConstructData unwrappedConstructData;
+    if (m_unwrappedObject->getConstructData(unwrappedConstructData) == ConstructTypeNone)
+        return ConstructTypeNone;
+    constructData.native.function = construct;
+    return ConstructTypeHost;
+}
+
+bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue* value, JSValue* proto)
+{
+    if (!allowsHasInstance())
+        return false;
+
+    bool result = m_unwrappedObject->hasInstance(unwrappedExecState(), prepareIncomingValue(exec, value), prepareIncomingValue(exec, proto));
+
+    transferExceptionToExecState(exec);
+
+    return result;
+}
+
+JSValue* JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue* thisValue, const ArgList& args)
+{
+    JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
+
+    JSValue* preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
+
+    ArgList preparedArgs;
+    for (size_t i = 0; i < args.size(); ++i)
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+
+    // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
+    // from when we called it in JSQuarantinedObjectWrapper::getCallData.
+    CallData unwrappedCallData;
+    CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
+    ASSERT(unwrappedCallType != CallTypeNone);
+
+    JSValue* unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+
+    JSValue* result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+
+    wrapper->transferExceptionToExecState(exec);
+
+    return result;
+}
+
+CallType JSQuarantinedObjectWrapper::getCallData(CallData& callData)
+{
+    if (!allowsCallAsFunction())
+        return CallTypeNone;
+    CallData unwrappedCallData;
+    if (m_unwrappedObject->getCallData(unwrappedCallData) == CallTypeNone)
+        return CallTypeNone;
+    callData.native.function = call;
+    return CallTypeHost;
+}
+
+void JSQuarantinedObjectWrapper::getPropertyNames(ExecState* exec, PropertyNameArray& array)
+{
+    if (!allowsGetPropertyNames())
+        return;
+
+    m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
new file mode 100644
index 0000000..ff684bf
--- /dev/null
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSQuarantinedObjectWrapper_h
+#define JSQuarantinedObjectWrapper_h
+
+#include <runtime/JSObject.h>
+
+namespace WebCore {
+
+    class JSQuarantinedObjectWrapper : public JSC::JSObject {
+    public:
+        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue*);
+
+        virtual ~JSQuarantinedObjectWrapper();
+
+        JSC::JSObject* unwrappedObject() const { return m_unwrappedObject; }
+        JSC::JSGlobalObject* unwrappedGlobalObject() const { return m_unwrappedGlobalObject; };
+        JSC::ExecState* unwrappedExecState() const;
+
+        bool allowsUnwrappedAccessFrom(JSC::ExecState*) const;
+
+        static const JSC::ClassInfo s_info;
+
+        static PassRefPtr<JSC::StructureID> createStructureID(JSC::JSValue* proto) 
+        { 
+            return JSC::StructureID::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
+        }
+
+    protected:
+        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::StructureID>);
+
+        virtual void mark();
+
+    private:
+        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+        virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
+
+        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue*, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue*);
+
+        virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
+        virtual bool deleteProperty(JSC::ExecState*, unsigned);
+
+        virtual JSC::CallType getCallData(JSC::CallData&);
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+
+        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue*, JSC::JSValue* proto);
+
+        virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+
+        virtual JSC::UString className() const { return m_unwrappedObject->className(); }
+
+        virtual bool allowsGetProperty() const { return false; }
+        virtual bool allowsSetProperty() const { return false; }
+        virtual bool allowsDeleteProperty() const { return false; }
+        virtual bool allowsConstruct() const { return false; }
+        virtual bool allowsHasInstance() const { return false; }
+        virtual bool allowsCallAsFunction() const { return false; }
+        virtual bool allowsGetPropertyNames() const { return false; }
+
+        virtual JSC::JSValue* prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue) const = 0;
+        virtual JSC::JSValue* wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue* unwrappedValue) const = 0;
+
+        static JSC::JSValue* cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+        void transferExceptionToExecState(JSC::ExecState*) const;
+
+        static JSC::JSValue* call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue* thisValue, const JSC::ArgList&);
+        static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
+
+        JSC::JSGlobalObject* m_unwrappedGlobalObject;
+        JSC::JSObject* m_unwrappedObject;
+    };
+
+} // namespace WebCore
+
+#endif // JSQuarantinedObjectWrapper_h
diff --git a/WebCore/bindings/js/JSRGBColor.cpp b/WebCore/bindings/js/JSRGBColor.cpp
new file mode 100644
index 0000000..4541bfa
--- /dev/null
+++ b/WebCore/bindings/js/JSRGBColor.cpp
@@ -0,0 +1,85 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2006 James G. Speth (speth@end.com)
+ *  Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSRGBColor.h"
+
+#include "CSSPrimitiveValue.h"
+#include "JSCSSPrimitiveValue.h"
+
+using namespace JSC;
+
+static JSValue* jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue* jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue* jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
+
+/*
+@begin JSRGBColorTable
+  red   jsRGBColorRed        DontDelete|ReadOnly
+  green jsRGBColorGreen      DontDelete|ReadOnly
+  blue  jsRGBColorBlue       DontDelete|ReadOnly
+@end
+*/
+
+#include "JSRGBColor.lut.h"
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSRGBColor)
+
+const ClassInfo JSRGBColor::s_info = { "RGBColor", 0, &JSRGBColorTable, 0 };
+
+JSRGBColor::JSRGBColor(ExecState* exec, unsigned color)
+    : DOMObject(getDOMStructure<JSRGBColor>(exec))
+    , m_color(color)
+{
+}
+
+bool JSRGBColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSRGBColor, DOMObject>(exec, &JSRGBColorTable, this, propertyName, slot);
+}
+
+JSValue* getJSRGBColor(ExecState* exec, unsigned color)
+{
+    return new (exec) JSRGBColor(exec, color);
+}
+
+} // namespace WebCore
+
+using namespace WebCore;
+
+JSValue* jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 16) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
+}
+
+JSValue* jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 8) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
+}
+
+JSValue* jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return toJS(exec, CSSPrimitiveValue::create(static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
+}
+
diff --git a/WebCore/bindings/js/JSRGBColor.h b/WebCore/bindings/js/JSRGBColor.h
new file mode 100644
index 0000000..afd5264
--- /dev/null
+++ b/WebCore/bindings/js/JSRGBColor.h
@@ -0,0 +1,59 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSRGBColor_h
+#define JSRGBColor_h
+
+#include "Color.h"
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    // FIXME: JSRGBColor should have a proper prototype and a constructor.
+    class JSRGBColor : public DOMObject {
+    public:
+        JSRGBColor(JSC::ExecState*, unsigned color);
+
+        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        static const JSC::ClassInfo s_info;
+
+        unsigned impl() const { return m_color; }
+
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        {
+            return exec->lexicalGlobalObject()->objectPrototype();
+        }
+
+        static PassRefPtr<JSC::StructureID> createStructureID(JSC::JSValue* prototype)
+        {
+            return JSC::StructureID::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+        }
+
+    private:
+        unsigned m_color;
+    };
+
+    JSC::JSValue* getJSRGBColor(JSC::ExecState*, unsigned color);
+
+} // namespace WebCore
+
+#endif // JSRGBColor_h
diff --git a/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp b/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
new file mode 100644
index 0000000..14e9baa
--- /dev/null
+++ b/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSQLResultSetRowList.h"
+
+#include "ExceptionCode.h"
+#include "SQLValue.h"
+#include "SQLResultSetRowList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    int index = args.at(exec, 0)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+    if (index < 0 || (unsigned)index >= m_impl->length()) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+
+    JSObject* object = constructEmptyObject(exec);
+
+    unsigned numColumns = m_impl->columnNames().size();
+    unsigned valuesIndex = index * numColumns;
+    for (unsigned i = 0; i < numColumns; i++) {
+        const SQLValue& value = m_impl->values()[valuesIndex + i];
+        JSValue* jsValue = noValue();
+
+        switch (value.type()) {
+            case SQLValue::StringValue:
+              jsValue = jsString(exec, value.string());
+              break;
+          case SQLValue::NullValue:
+              jsValue = jsNull();
+              break;
+          case SQLValue::NumberValue:
+              jsValue = jsNumber(exec, value.number());
+              break;
+          default:
+              ASSERT_NOT_REACHED();
+        }
+
+        object->putDirect(Identifier(exec, m_impl->columnNames()[i]), jsValue, DontDelete | ReadOnly);
+    }
+
+    return object;
+}
+
+}
diff --git a/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
new file mode 100644
index 0000000..5138517
--- /dev/null
+++ b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSQLTransaction.h"
+
+#include "DOMWindow.h"
+#include "ExceptionCode.h"
+#include "JSCustomSQLStatementCallback.h"
+#include "JSCustomSQLStatementErrorCallback.h"
+#include "JSDOMWindowCustom.h"
+#include "SQLTransaction.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+JSValue* JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
+{
+    String sqlStatement = args.at(exec, 0)->toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    // Now assemble the list of SQL arguments
+    Vector<SQLValue> sqlValues;
+    if (!args.at(exec, 1)->isUndefinedOrNull()) {
+        JSObject* object = args.at(exec, 1)->getObject();
+        if (!object) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+
+        JSValue* lengthValue = object->get(exec, exec->propertyNames().length);
+        if (exec->hadException())
+            return jsUndefined();
+        unsigned length = lengthValue->toUInt32(exec);
+        if (exec->hadException())
+            return jsUndefined();
+        
+        for (unsigned i = 0 ; i < length; ++i) {
+            JSValue* value = object->get(exec, i);
+            if (exec->hadException())
+                return jsUndefined();
+            
+            if (value->isNull())
+                sqlValues.append(SQLValue());
+            else if (value->isNumber())
+                sqlValues.append(value->getNumber());
+            else {
+                // Convert the argument to a string and append it
+                sqlValues.append(value->toString(exec));
+                if (exec->hadException())
+                    return jsUndefined();
+            }
+        }
+    }
+
+    RefPtr<SQLStatementCallback> callback;
+    if (!args.at(exec, 2)->isUndefinedOrNull()) {
+        JSObject* object = args.at(exec, 2)->getObject();
+        if (!object) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+        
+        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
+            callback = JSCustomSQLStatementCallback::create(object, frame);
+    }
+    
+    RefPtr<SQLStatementErrorCallback> errorCallback;
+    if (!args.at(exec, 3)->isUndefinedOrNull()) {
+        JSObject* object = args.at(exec, 3)->getObject();
+        if (!object) {
+            setDOMException(exec, TYPE_MISMATCH_ERR);
+            return jsUndefined();
+        }
+        
+        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
+            errorCallback = JSCustomSQLStatementErrorCallback::create(object, frame);
+    }
+    
+    ExceptionCode ec = 0;
+    m_impl->executeSQL(sqlStatement, sqlValues, callback.release(), errorCallback.release(), ec);
+    setDOMException(exec, ec);
+    
+    return jsUndefined();
+}
+
+}
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
new file mode 100644
index 0000000..471486b
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGElementInstance.h"
+#include "JSSVGElementInstance.h"
+
+#include "JSEventListener.h"
+#include "JSDOMWindow.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
+        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+
+    return jsUndefined();
+}
+
+JSValue* JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
+        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+
+    return jsUndefined();
+}
+
+void JSSVGElementInstance::pushEventHandlerScope(ExecState*, ScopeChain&) const
+{
+}
+
+}
+
+#endif
diff --git a/WebCore/bindings/js/JSSVGLengthCustom.cpp b/WebCore/bindings/js/JSSVGLengthCustom.cpp
new file mode 100644
index 0000000..f199517
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -0,0 +1,48 @@
+/*
+    Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "JSSVGLength.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSSVGLength::value(ExecState* exec) const
+{
+    SVGLength imp(*impl());
+    return jsNumber(exec, imp.value(context()));
+}
+
+JSValue* JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
+{
+    JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
+
+    SVGLength imp(*wrapper);
+    imp.convertToSpecifiedUnits(args.at(exec, 0)->toInt32(exec), context());
+
+    wrapper->commitChange(imp, context());
+    return jsUndefined();
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
new file mode 100644
index 0000000..d20a55e
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "JSSVGMatrix.h"
+
+#include "AffineTransform.h"
+#include "SVGException.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    AffineTransform secondMatrix = toSVGMatrix(args.at(exec, 0));    
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.multiply(secondMatrix)).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
+{
+    AffineTransform imp(*impl());
+    JSC::JSValue* result = toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.inverse()).get(), m_context.get());
+
+    if (!imp.isInvertible())
+        setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
+
+    return result;
+}
+
+JSValue* JSSVGMatrix::translate(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    float x = args.at(exec, 0)->toFloat(exec);
+    float y = args.at(exec, 1)->toFloat(exec);
+
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.translate(x, y)).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::scale(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    float scaleFactor = args.at(exec, 0)->toFloat(exec);
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.scale(scaleFactor)).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::scaleNonUniform(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    float scaleFactorX = args.at(exec, 0)->toFloat(exec);
+    float scaleFactorY = args.at(exec, 1)->toFloat(exec);
+
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::rotate(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    float angle = args.at(exec, 0)->toFloat(exec);
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.rotate(angle)).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+ 
+    float x = args.at(exec, 0)->toFloat(exec);
+    float y = args.at(exec, 1)->toFloat(exec);
+
+    JSC::JSValue* result = toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+
+    if (x == 0.0 || y == 0.0)
+        setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
+
+    return result;
+}
+
+JSValue* JSSVGMatrix::flipX(ExecState* exec, const ArgList&)
+{
+    AffineTransform imp(*impl());
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.flipX()).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::flipY(ExecState* exec, const ArgList&)
+{
+    AffineTransform imp(*impl());
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.flipY()).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::skewX(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    float angle = args.at(exec, 0)->toFloat(exec);
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.skewX(angle)).get(), m_context.get());
+}
+
+JSValue* JSSVGMatrix::skewY(ExecState* exec, const ArgList& args)
+{
+    AffineTransform imp(*impl());
+
+    float angle = args.at(exec, 0)->toFloat(exec);
+    return toJS(exec, JSSVGStaticPODTypeWrapper<AffineTransform>::create(imp.skewY(angle)).get(), m_context.get());
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/WebCore/bindings/js/JSSVGPODTypeWrapper.h
new file mode 100644
index 0000000..7eb665a
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -0,0 +1,408 @@
+/*
+ * Copyright (C) 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSSVGPODTypeWrapper_h
+#define JSSVGPODTypeWrapper_h
+
+#if ENABLE(SVG)
+#include "Frame.h"
+#include "SVGElement.h"
+
+namespace WebCore {
+
+template<typename PODType>
+class JSSVGPODTypeWrapper : public RefCounted<JSSVGPODTypeWrapper<PODType> > {
+public:
+    virtual ~JSSVGPODTypeWrapper() { }
+
+    virtual operator PODType() = 0;
+    virtual void commitChange(PODType, SVGElement*) = 0;
+};
+
+// This file contains JS wrapper objects for SVG datatypes, that are passed around by value
+// in WebCore/svg (aka. 'POD types'). For instance SVGMatrix is mapped to AffineTransform, and
+// passed around as const reference. SVG DOM demands these objects to be "live", changes to any
+// of the writable attributes of SVGMatrix need to be reflected in the object which exposed the
+// SVGMatrix object (ie. 'someElement.transform.matrix.a = 50.0', in that case 'SVGTransform').
+// The SVGTransform class stores its "AffineTransform m_matrix" object on the stack. If it would
+// be stored as pointer we could just build an auto-generated JSSVG* wrapper object around it
+// and all changes to that object would automatically affect the AffineTransform* object stored
+// in the SVGTransform object. For the sake of efficiency and memory we don't pass around any
+// primitive values as pointers, so a custom JS wrapper object is needed for all SVG types, that
+// are internally represented by POD types (SVGRect <-> FloatRect, SVGPoint <-> FloatPoint, ...).
+// Those custom wrappers are called JSSVGPODTypeWrapper and are capable of updating the POD types
+// by taking function pointers to the getter & setter functions of the "creator object", the object
+// which exposed a SVG POD type. For example, the JSSVGPODTypeWrapper object wrapping a SVGMatrix
+// object takes (SVGTransform*, &SVGTransform::matrix, &SVGTransform::setMatrix). A JS call like
+// "someElement.transform.matrix.a = 50.0' causes the JSSVGMatrix object to call SVGTransform::setMatrix,
+// method, which in turn notifies 'someElement' that the 'SVGNames::transformAttr' has changed.
+// That's a short sketch of our SVG DOM implementation.
+
+// Represents a JS wrapper object for SVGAnimated* classes, exposing SVG POD types that contain writable properties
+// (Two cases: SVGAnimatedLength exposing SVGLength, SVGAnimatedRect exposing SVGRect)
+
+#if COMPILER(MSVC)
+// GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
+// greater than or equal to that to avoid an alignment warning (C4121). 16 is
+// the next-largest size allowed for packing, so we use that.
+#pragma pack(16)
+#endif
+template<typename PODType, typename PODTypeCreator>
+class JSSVGDynamicPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
+public:
+    typedef PODType (PODTypeCreator::*GetterMethod)() const; 
+    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+
+    static PassRefPtr<JSSVGDynamicPODTypeWrapper> create(PassRefPtr<PODTypeCreator> creator, GetterMethod getter, SetterMethod setter)
+    {
+        return adoptRef(new JSSVGDynamicPODTypeWrapper(creator, getter, setter));
+    }
+
+    virtual operator PODType()
+    {
+        return (m_creator.get()->*m_getter)();
+    }
+
+    virtual void commitChange(PODType type, SVGElement* context)
+    {
+        (m_creator.get()->*m_setter)(type);
+
+        if (context)
+            context->svgAttributeChanged(m_creator->associatedAttributeName());
+    }
+
+private:
+    JSSVGDynamicPODTypeWrapper(PassRefPtr<PODTypeCreator> creator, GetterMethod getter, SetterMethod setter)
+        : m_creator(creator)
+        , m_getter(getter)
+        , m_setter(setter)
+    {
+        ASSERT(m_creator);
+        ASSERT(m_getter);
+        ASSERT(m_setter);
+    }
+
+    // Update callbacks
+    RefPtr<PODTypeCreator> m_creator;
+    GetterMethod m_getter;
+    SetterMethod m_setter;
+};
+
+// Represents a JS wrapper object for SVG POD types (not for SVGAnimated* clases). Any modification to the SVG POD
+// types don't cause any updates unlike JSSVGDynamicPODTypeWrapper. This class is used for return values (ie. getBBox())
+// and for properties where SVG specification explicitely states, that the contents of the POD type are immutable.
+
+template<typename PODType>
+class JSSVGStaticPODTypeWrapper : public JSSVGPODTypeWrapper<PODType> {
+public:
+    static PassRefPtr<JSSVGStaticPODTypeWrapper> create(PODType type)
+    {
+        return adoptRef(new JSSVGStaticPODTypeWrapper(type));
+    }
+
+    virtual operator PODType()
+    {
+        return m_podType;
+    }
+
+    virtual void commitChange(PODType type, SVGElement*)
+    {
+        m_podType = type;
+    }
+
+protected:
+    JSSVGStaticPODTypeWrapper(PODType type)
+        : m_podType(type)
+    {
+    }
+
+    PODType m_podType;
+};
+
+template<typename PODType, typename ParentTypeArg>
+class JSSVGStaticPODTypeWrapperWithPODTypeParent : public JSSVGStaticPODTypeWrapper<PODType> {
+public:
+    typedef JSSVGPODTypeWrapper<ParentTypeArg> ParentType;
+
+    static PassRefPtr<JSSVGStaticPODTypeWrapperWithPODTypeParent> create(PODType type, PassRefPtr<ParentType> parent)
+    {
+        return adoptRef(new JSSVGStaticPODTypeWrapperWithPODTypeParent(type, parent));
+    }
+
+    virtual void commitChange(PODType type, SVGElement* context)
+    {
+        JSSVGStaticPODTypeWrapper<PODType>::commitChange(type, context);
+        m_parentType->commitChange(ParentTypeArg(type), context);    
+    }
+
+private:
+    JSSVGStaticPODTypeWrapperWithPODTypeParent(PODType type, PassRefPtr<ParentType> parent)
+        : JSSVGStaticPODTypeWrapper<PODType>(type)
+        , m_parentType(parent)
+    {
+    }
+
+    RefPtr<ParentType> m_parentType;
+};
+
+#if COMPILER(MSVC)
+// GetterMethod and SetterMethod are each 12 bytes. We have to pack to a size
+// greater than or equal to that to avoid an alignment warning (C4121). 16 is
+// the next-largest size allowed for packing, so we use that.
+#pragma pack(16)
+#endif
+template<typename PODType, typename ParentType>
+class JSSVGStaticPODTypeWrapperWithParent : public JSSVGPODTypeWrapper<PODType> {
+public:
+    typedef PODType (ParentType::*GetterMethod)() const;
+    typedef void (ParentType::*SetterMethod)(const PODType&);
+
+    static PassRefPtr<JSSVGStaticPODTypeWrapperWithParent> create(PassRefPtr<ParentType> parent, GetterMethod getter, SetterMethod setter)
+    {
+        return adoptRef(new JSSVGStaticPODTypeWrapperWithParent(parent, getter, setter));
+    }
+
+    virtual operator PODType()
+    {
+        return (m_parent.get()->*m_getter)();
+    }
+
+    virtual void commitChange(PODType type, SVGElement* context)
+    {
+        (m_parent.get()->*m_setter)(type);
+    }
+
+private:
+    JSSVGStaticPODTypeWrapperWithParent(PassRefPtr<ParentType> parent, GetterMethod getter, SetterMethod setter)
+        : m_parent(parent)
+        , m_getter(getter)
+        , m_setter(setter)
+    {
+        ASSERT(m_parent);
+        ASSERT(m_getter);
+        ASSERT(m_setter);
+    }
+
+    // Update callbacks
+    RefPtr<ParentType> m_parent;
+    GetterMethod m_getter;
+    SetterMethod m_setter;
+};
+
+template<typename PODType>
+class SVGPODListItem;
+
+// Just like JSSVGDynamicPODTypeWrapper, but only used for SVGList* objects wrapping around POD values.
+
+template<typename PODType>
+class JSSVGPODTypeWrapperCreatorForList : public JSSVGPODTypeWrapper<PODType> {
+public:
+    typedef SVGPODListItem<PODType> PODListItemPtrType;
+
+    typedef PODType (SVGPODListItem<PODType>::*GetterMethod)() const; 
+    typedef void (SVGPODListItem<PODType>::*SetterMethod)(PODType);
+
+    static PassRefPtr<JSSVGPODTypeWrapperCreatorForList> create(PassRefPtr<PODListItemPtrType> creator, const QualifiedName& attributeName)
+    {
+        return adoptRef(new JSSVGPODTypeWrapperCreatorForList(creator, attributeName));
+    }
+
+    virtual operator PODType()
+    {
+        return (m_creator.get()->*m_getter)();
+    }
+
+    virtual void commitChange(PODType type, SVGElement* context)
+    {
+        if (!m_setter)
+            return;
+
+        (m_creator.get()->*m_setter)(type);
+
+        if (context)
+            context->svgAttributeChanged(m_associatedAttributeName);
+    }
+
+private:
+    JSSVGPODTypeWrapperCreatorForList(PassRefPtr<PODListItemPtrType> creator, const QualifiedName& attributeName)
+        : m_creator(creator)
+        , m_getter(&PODListItemPtrType::value)
+        , m_setter(&PODListItemPtrType::setValue)
+        , m_associatedAttributeName(attributeName)
+    {
+        ASSERT(m_creator);
+        ASSERT(m_getter);
+        ASSERT(m_setter);
+    }
+
+    // Update callbacks
+    RefPtr<PODListItemPtrType> m_creator;
+    GetterMethod m_getter;
+    SetterMethod m_setter;
+    const QualifiedName& m_associatedAttributeName;
+};
+
+// Caching facilities
+template<typename PODType, typename PODTypeCreator>
+struct PODTypeWrapperCacheInfo {
+    typedef PODType (PODTypeCreator::*GetterMethod)() const; 
+    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+
+    // Empty value
+    PODTypeWrapperCacheInfo()
+        : creator(0)
+        , getter(0)
+        , setter(0)
+    {
+    }
+
+    // Deleted value
+    PODTypeWrapperCacheInfo(WTF::HashTableDeletedValueType)
+        : creator(reinterpret_cast<PODTypeCreator*>(-1))
+    {
+    }
+    bool isHashTableDeletedValue() const
+    {
+        return creator == reinterpret_cast<PODTypeCreator*>(-1);
+    }
+
+    PODTypeWrapperCacheInfo(PODTypeCreator* _creator, GetterMethod _getter, SetterMethod _setter)
+        : creator(_creator)
+        , getter(_getter)
+        , setter(_setter)
+    {
+        ASSERT(creator);
+        ASSERT(getter);
+    }
+
+    bool operator==(const PODTypeWrapperCacheInfo& other) const
+    {
+        return creator == other.creator && getter == other.getter && setter == other.setter;
+    }
+
+    PODTypeCreator* creator;
+    GetterMethod getter;
+    SetterMethod setter;
+};
+
+template<typename PODType, typename PODTypeCreator>
+struct PODTypeWrapperCacheInfoHash {
+    typedef PODTypeWrapperCacheInfo<PODType, PODTypeCreator> CacheInfo;
+
+    static unsigned hash(const CacheInfo& info)
+    {
+        return StringImpl::computeHash(reinterpret_cast<const UChar*>(&info), sizeof(CacheInfo) / sizeof(UChar));
+    }
+
+    static bool equal(const CacheInfo& a, const CacheInfo& b)
+    {
+        return a == b;
+    }
+
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+
+template<typename PODType, typename PODTypeCreator>
+struct PODTypeWrapperCacheInfoTraits : WTF::GenericHashTraits<PODTypeWrapperCacheInfo<PODType, PODTypeCreator> > {
+    typedef PODTypeWrapperCacheInfo<PODType, PODTypeCreator> CacheInfo;
+
+    static const bool emptyValueIsZero = true;
+    static const bool needsDestruction = false;
+
+    static const CacheInfo& emptyValue()
+    {
+        static CacheInfo key;
+        return key;
+    }
+
+    static void constructDeletedValue(CacheInfo& slot)
+    {
+        new (&slot) CacheInfo(WTF::HashTableDeletedValue);
+    }
+
+    static bool isDeletedValue(const CacheInfo& value)
+    {
+        return value.isHashTableDeletedValue();
+    }
+};
+
+template<typename PODType, typename PODTypeCreator>
+class JSSVGDynamicPODTypeWrapperCache {
+public:
+    typedef PODType (PODTypeCreator::*GetterMethod)() const; 
+    typedef void (PODTypeCreator::*SetterMethod)(PODType);
+
+    typedef PODTypeWrapperCacheInfo<PODType, PODTypeCreator> CacheInfo;
+    typedef PODTypeWrapperCacheInfoHash<PODType, PODTypeCreator> CacheInfoHash;
+    typedef PODTypeWrapperCacheInfoTraits<PODType, PODTypeCreator> CacheInfoTraits;
+
+    typedef JSSVGPODTypeWrapper<PODType> WrapperBase;
+    typedef JSSVGDynamicPODTypeWrapper<PODType, PODTypeCreator> DynamicWrapper;
+    typedef HashMap<CacheInfo, DynamicWrapper*, CacheInfoHash, CacheInfoTraits> DynamicWrapperHashMap;
+    typedef typename DynamicWrapperHashMap::const_iterator DynamicWrapperHashMapIterator;
+
+    static DynamicWrapperHashMap& dynamicWrapperHashMap()
+    {
+        static DynamicWrapperHashMap s_dynamicWrapperHashMap;
+        return s_dynamicWrapperHashMap;
+    }
+
+    // Used for readwrite attributes only
+    static PassRefPtr<WrapperBase> lookupOrCreateWrapper(PODTypeCreator* creator, GetterMethod getter, SetterMethod setter)
+    {
+        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
+        CacheInfo info(creator, getter, setter);
+
+        if (map.contains(info))
+            return map.get(info);
+
+        RefPtr<DynamicWrapper> wrapper = DynamicWrapper::create(creator, getter, setter);
+        map.set(info, wrapper.get());
+        return wrapper.release();
+    }
+
+    static void forgetWrapper(WrapperBase* wrapper)
+    {
+        DynamicWrapperHashMap& map(dynamicWrapperHashMap());
+
+        DynamicWrapperHashMapIterator it = map.begin();
+        DynamicWrapperHashMapIterator end = map.end();
+
+        for (; it != end; ++it) {
+            if (it->second != wrapper)
+                continue;
+
+            // It's guaranteed that there's just one object we need to take care of.
+            map.remove(it->first);
+            break;
+        }
+    }
+};
+
+};
+
+#endif // ENABLE(SVG)
+#endif // JSSVGPODTypeWrapper_h
diff --git a/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
new file mode 100644
index 0000000..8c0a4ef
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "JSSVGPathSeg.h"
+#include "JSSVGPathSegArcAbs.h"
+#include "JSSVGPathSegArcRel.h"
+#include "JSSVGPathSegClosePath.h"
+#include "JSSVGPathSegCurvetoCubicAbs.h"
+#include "JSSVGPathSegCurvetoCubicRel.h"
+#include "JSSVGPathSegCurvetoCubicSmoothAbs.h"
+#include "JSSVGPathSegCurvetoCubicSmoothRel.h"
+#include "JSSVGPathSegCurvetoQuadraticAbs.h"
+#include "JSSVGPathSegCurvetoQuadraticRel.h"
+#include "JSSVGPathSegCurvetoQuadraticSmoothAbs.h"
+#include "JSSVGPathSegCurvetoQuadraticSmoothRel.h"
+#include "JSSVGPathSegLinetoAbs.h"
+#include "JSSVGPathSegLinetoRel.h"
+#include "JSSVGPathSegLinetoHorizontalAbs.h"
+#include "JSSVGPathSegLinetoHorizontalRel.h"
+#include "JSSVGPathSegLinetoVerticalAbs.h"
+#include "JSSVGPathSegLinetoVerticalRel.h"
+#include "JSSVGPathSegMovetoAbs.h"
+#include "JSSVGPathSegMovetoRel.h"
+
+#include "JSDOMBinding.h"
+
+#include "SVGPathSeg.h"
+#include "SVGPathSegArc.h"
+#include "SVGPathSegClosePath.h"
+#include "SVGPathSegCurvetoCubic.h"
+#include "SVGPathSegCurvetoCubicSmooth.h"
+#include "SVGPathSegCurvetoQuadratic.h"
+#include "SVGPathSegCurvetoQuadraticSmooth.h"
+#include "SVGPathSegLineto.h"
+#include "SVGPathSegLinetoHorizontal.h"
+#include "SVGPathSegLinetoVertical.h"
+#include "SVGPathSegMoveto.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
+{
+    if (!object)
+        return jsNull();
+
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), object))
+        return wrapper;
+
+    switch (object->pathSegType()) {
+    case SVGPathSeg::PATHSEG_CLOSEPATH:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegClosePath, object, context);
+    case SVGPathSeg::PATHSEG_MOVETO_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegMovetoAbs, object, context);
+    case SVGPathSeg::PATHSEG_MOVETO_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegMovetoRel, object, context);
+    case SVGPathSeg::PATHSEG_LINETO_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegLinetoAbs, object, context);
+    case SVGPathSeg::PATHSEG_LINETO_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegLinetoRel, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_CUBIC_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoCubicAbs, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_CUBIC_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoCubicRel, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoQuadraticAbs, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoQuadraticRel, object, context);
+    case SVGPathSeg::PATHSEG_ARC_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegArcAbs, object, context);
+    case SVGPathSeg::PATHSEG_ARC_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegArcRel, object, context);
+    case SVGPathSeg::PATHSEG_LINETO_HORIZONTAL_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegLinetoHorizontalAbs, object, context);
+    case SVGPathSeg::PATHSEG_LINETO_HORIZONTAL_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegLinetoHorizontalRel, object, context);
+    case SVGPathSeg::PATHSEG_LINETO_VERTICAL_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegLinetoVerticalAbs, object, context);
+    case SVGPathSeg::PATHSEG_LINETO_VERTICAL_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegLinetoVerticalRel, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_CUBIC_SMOOTH_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoCubicSmoothAbs, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_CUBIC_SMOOTH_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoCubicSmoothRel, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoQuadraticSmoothAbs, object, context);
+    case SVGPathSeg::PATHSEG_CURVETO_QUADRATIC_SMOOTH_REL:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSegCurvetoQuadraticSmoothRel, object, context);
+    case SVGPathSeg::PATHSEG_UNKNOWN:
+    default:
+        return CREATE_SVG_OBJECT_WRAPPER(exec, SVGPathSeg, object, context);
+    }
+}
+
+}
+
+#endif // ENABLE(SVG)
+
+// vim:ts=4:noet
diff --git a/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
new file mode 100644
index 0000000..95b60aa
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "JSSVGPathSegList.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "JSSVGPathSeg.h"
+#include "SVGDocumentExtensions.h"
+#include "SVGElement.h"
+#include "SVGPathSegList.h"
+
+#include <wtf/Assertions.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSSVGPathSegList::clear(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    imp->clear(ec);
+
+    setDOMException(exec, ec);
+
+    m_context->svgAttributeChanged(imp->associatedAttributeName());
+    return jsUndefined();
+}
+
+JSValue* JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+
+    SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
+
+    JSC::JSValue* result = toJS(exec, obj, m_context.get());
+    setDOMException(exec, ec);
+
+    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    return result;
+}
+
+JSValue* JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+
+    bool indexOk;
+    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+    SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
+
+    JSC::JSValue* result = toJS(exec, obj, m_context.get());
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue* JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+
+    bool indexOk;
+    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+
+    JSC::JSValue* result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    setDOMException(exec, ec);
+
+    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    return result;
+}
+
+JSValue* JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    
+    bool indexOk;
+    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+
+    JSC::JSValue* result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    setDOMException(exec, ec);
+
+    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    return result;
+}
+
+JSValue* JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    
+    bool indexOk;
+    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+
+    RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
+
+    JSC::JSValue* result = toJS(exec, obj.get(), m_context.get());
+    setDOMException(exec, ec);
+
+    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    return result;
+}
+
+JSValue* JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+
+    SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
+
+    JSC::JSValue* result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    setDOMException(exec, ec);
+
+    m_context->svgAttributeChanged(imp->associatedAttributeName());    
+    return result;
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/bindings/js/JSSVGPointListCustom.cpp b/WebCore/bindings/js/JSSVGPointListCustom.cpp
new file mode 100644
index 0000000..6c13123
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGPointListCustom.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "JSSVGPointList.h"
+
+#include "JSSVGPoint.h"
+#include "SVGPointList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+typedef SVGPODListItem<FloatPoint> PODListItem;
+typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
+
+static JSValue* finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
+}
+
+static JSValue* finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    const QualifiedName& attributeName = list->associatedAttributeName();
+    context->svgAttributeChanged(attributeName);
+    return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
+}
+
+static JSValue* finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    context->svgAttributeChanged(list->associatedAttributeName());
+    return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
+}
+
+JSValue* JSSVGPointList::clear(ExecState* exec, const ArgList&)
+{
+    ExceptionCode ec = 0;
+    impl()->clear(ec);
+    setDOMException(exec, ec);
+    m_context->svgAttributeChanged(impl()->associatedAttributeName());
+    return jsUndefined();
+}
+
+JSValue* JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGPointListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+}
+
+JSValue* JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGPointListBase* listImp = impl();
+    return finishGetter(exec, ec, context(), impl(),
+        listImp->getItem(index, ec));
+}
+
+JSValue* JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGPointListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+}
+
+JSValue* JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGPointListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+}
+
+JSValue* JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGPointListBase* listImp = impl();
+    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
+        listImp->removeItem(index, ec));
+}
+
+JSValue* JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGPointListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/WebCore/bindings/js/JSSVGTransformListCustom.cpp
new file mode 100644
index 0000000..57cc662
--- /dev/null
+++ b/WebCore/bindings/js/JSSVGTransformListCustom.cpp
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "JSSVGTransformList.h"
+
+#include "JSSVGTransform.h"
+#include "SVGTransformList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+typedef SVGPODListItem<SVGTransform> PODListItem;
+typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
+
+static JSValue* finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
+}
+
+static JSValue* finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    const QualifiedName& attributeName = list->associatedAttributeName();
+    context->svgAttributeChanged(attributeName);
+    return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
+}
+
+static JSValue* finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+{
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    context->svgAttributeChanged(list->associatedAttributeName());
+    return toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
+}
+
+JSValue* JSSVGTransformList::clear(ExecState* exec, const ArgList&)
+{
+    ExceptionCode ec = 0;
+    impl()->clear(ec);
+    setDOMException(exec, ec);
+    m_context->svgAttributeChanged(impl()->associatedAttributeName());
+    return jsUndefined();
+}
+
+JSValue* JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGTransformListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+}
+
+JSValue* JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGTransformListBase* listImp = impl();
+    return finishGetter(exec, ec, context(), impl(),
+        listImp->getItem(index, ec));
+}
+
+JSValue* JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGTransformListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+}
+
+JSValue* JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGTransformListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+}
+
+JSValue* JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
+{
+    bool indexOk;
+    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    if (!indexOk) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+
+    ExceptionCode ec = 0;
+    SVGTransformListBase* listImp = impl();
+    return finishSetterReadOnlyResult(exec, ec, context(), impl(),
+        listImp->removeItem(index, ec));
+}
+
+JSValue* JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    SVGTransformListBase* listImp = impl();
+    return finishSetter(exec, ec, context(), impl(),
+        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/bindings/js/JSStorageCustom.cpp b/WebCore/bindings/js/JSStorageCustom.cpp
new file mode 100644
index 0000000..1966392
--- /dev/null
+++ b/WebCore/bindings/js/JSStorageCustom.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSStorageCustom.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "PlatformString.h"
+#include <runtime/PropertyNameArray.h>
+#include "Storage.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier& propertyName)
+{
+    return impl->contains(propertyName);
+}
+
+JSValue* JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
+    return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
+}
+
+bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    // Only perform the custom delete if the object doesn't have a native property by this name.
+    // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
+    // the native property slots manually.
+    PropertySlot slot;
+    if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
+        return false;
+        
+    JSValue* prototype = this->prototype();
+    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+        return false;
+
+    m_impl->removeItem(propertyName);
+    return true;
+}
+
+bool JSStorage::customGetPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    ExceptionCode ec;
+    unsigned length = m_impl->length();
+    for (unsigned i = 0; i < length; ++i)
+        propertyNames.add(Identifier(exec, m_impl->key(i, ec)));
+        
+    return false;
+}
+
+bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValue* value, PutPropertySlot&)
+{
+    // Only perform the custom put if the object doesn't have a native property by this name.
+    // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
+    // the native property slots manually.
+    PropertySlot slot;
+    if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
+        return false;
+        
+    JSValue* prototype = this->prototype();
+    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+        return false;
+    
+    String stringValue = valueToStringWithNullCheck(exec, value);
+    if (exec->hadException())
+        return true;
+    
+    ExceptionCode ec = 0;
+    impl()->setItem(propertyName, stringValue, ec);
+    setDOMException(exec, ec);
+
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebCore/bindings/js/JSStorageCustom.h b/WebCore/bindings/js/JSStorageCustom.h
new file mode 100644
index 0000000..45f62df
--- /dev/null
+++ b/WebCore/bindings/js/JSStorageCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSStorageCustom_h
+#define JSStorageCustom_h
+
+#include "JSStorage.h"
+
+#endif // JSStorageCustom_h
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
new file mode 100644
index 0000000..c9914ae
--- /dev/null
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSStyleSheet.h"
+
+#include "CSSStyleSheet.h"
+#include "JSCSSStyleSheet.h"
+#include "JSNode.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJS(ExecState* exec, StyleSheet* styleSheet)
+{
+    if (!styleSheet)
+        return jsNull();
+
+    DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), styleSheet);
+    if (wrapper)
+        return wrapper;
+
+    if (styleSheet->isCSSStyleSheet())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, CSSStyleSheet, styleSheet);
+    else
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, StyleSheet, styleSheet);
+
+    return wrapper;
+}
+
+void JSStyleSheet::mark()
+{
+    Base::mark();
+
+    // This prevents us from having a style sheet with a dangling ownerNode pointer.
+    // A better solution would be to handle this on the DOM side -- if the style sheet
+    // is kept around, then we want the node to stay around too. One possibility would
+    // be to make ref/deref on the style sheet ref/deref the node instead, but there's
+    // a lot of disentangling of the CSS DOM objects that would need to happen first.
+    if (Node* ownerNode = impl()->ownerNode()) {
+        if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode)) {
+            if (!ownerNodeWrapper->marked())
+                ownerNodeWrapper->mark();
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
new file mode 100644
index 0000000..2a24fe2
--- /dev/null
+++ b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSStyleSheetList.h"
+
+#include "HTMLStyleElement.h"
+#include "JSStyleSheet.h"
+#include "StyleSheet.h"
+#include "StyleSheetList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
+{
+    return styleSheetList->getNamedItem(propertyName);
+}
+
+JSValue* JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
+    HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
+    ASSERT(element);
+    return toJS(exec, element->sheet());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSTextCustom.cpp b/WebCore/bindings/js/JSTextCustom.cpp
new file mode 100644
index 0000000..245b4bd
--- /dev/null
+++ b/WebCore/bindings/js/JSTextCustom.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSText.h"
+
+#include "Text.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* toJSNewlyCreated(ExecState* exec, Text* text)
+{
+    if (!text)
+        return jsNull();
+    
+    return CREATE_DOM_NODE_WRAPPER(exec, Text, text);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/WebCore/bindings/js/JSTreeWalkerCustom.cpp
new file mode 100644
index 0000000..9822e1a
--- /dev/null
+++ b/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "JSTreeWalker.h"
+
+#include "JSNode.h"
+#include "Node.h"
+#include "NodeFilter.h"
+#include "TreeWalker.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+void JSTreeWalker::mark()
+{
+    if (NodeFilter* filter = m_impl->filter())
+        filter->mark();
+    
+    DOMObject::mark();
+}
+    
+JSValue* JSTreeWalker::parentNode(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->parentNode(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+    
+JSValue* JSTreeWalker::firstChild(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->firstChild(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+    
+JSValue* JSTreeWalker::lastChild(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->lastChild(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+    
+JSValue* JSTreeWalker::nextSibling(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->nextSibling(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+    
+JSValue* JSTreeWalker::previousSibling(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->previousSibling(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+    
+JSValue* JSTreeWalker::previousNode(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->previousNode(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+    
+JSValue* JSTreeWalker::nextNode(ExecState* exec, const ArgList& args)
+{
+    Node* node = impl()->nextNode(exec);
+    if (exec->hadException())
+        return jsUndefined();
+    return toJS(exec, node);
+}
+
+}
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
new file mode 100644
index 0000000..31d4dd7
--- /dev/null
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -0,0 +1,63 @@
+/*
+ *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@nypop.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSXMLHttpRequestConstructor.h"
+
+#include "JSXMLHttpRequest.h"
+#include "ScriptExecutionContext.h"
+#include "XMLHttpRequest.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor)
+
+const ClassInfo JSXMLHttpRequestConstructor::s_info = { "XMLHttpRequestConstructor", 0, 0, 0 };
+
+JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, ScriptExecutionContext* context)
+    : DOMObject(JSXMLHttpRequestConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    ASSERT(context->isDocument());
+    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+}
+
+static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
+{
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(static_cast<JSXMLHttpRequestConstructor*>(constructor)->document());
+    return CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequest, xmlHttpRequest.get());
+}
+
+ConstructType JSXMLHttpRequestConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructXMLHttpRequest;
+    return ConstructTypeHost;
+}
+
+void JSXMLHttpRequestConstructor::mark()
+{
+    DOMObject::mark();
+    if (!m_document->marked())
+        m_document->mark();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.h b/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
new file mode 100644
index 0000000..f235af6
--- /dev/null
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@nypop.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSXMLHttpRequestConstructor_h
+#define JSXMLHttpRequestConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+class JSXMLHttpRequestConstructor : public DOMObject {
+public:
+    JSXMLHttpRequestConstructor(JSC::ExecState*, ScriptExecutionContext*);
+    Document* document() const { return m_document->impl(); }
+    static const JSC::ClassInfo s_info;
+
+    virtual void mark();
+private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+
+    JSDocument* m_document;
+};
+
+} // namespace WebCore
+
+#endif // JSXMLHttpRequestConstructor_h
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
new file mode 100644
index 0000000..4524b16
--- /dev/null
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSXMLHttpRequest.h"
+
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Event.h"
+#include "File.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLDocument.h"
+#include "JSDOMWindowCustom.h"
+#include "JSDocument.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+#include "JSFile.h"
+#include "XMLHttpRequest.h"
+#include <runtime/Error.h>
+#include <VM/Machine.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSXMLHttpRequest::mark()
+{
+    Base::mark();
+
+    if (XMLHttpRequestUpload* upload = m_impl->optionalUpload()) {
+        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), upload);
+        if (wrapper && !wrapper->marked())
+            wrapper->mark();
+    }
+
+    if (JSUnprotectedEventListener* onReadyStateChangeListener = static_cast<JSUnprotectedEventListener*>(m_impl->onreadystatechange()))
+        onReadyStateChangeListener->mark();
+
+    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
+        onAbortListener->mark();
+
+    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
+        onErrorListener->mark();
+
+    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
+        onLoadListener->mark();
+
+    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
+        onLoadStartListener->mark();
+    
+    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
+        onProgressListener->mark();
+    
+    typedef XMLHttpRequest::EventListenersMap EventListenersMap;
+    typedef XMLHttpRequest::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
+            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
+            listener->mark();
+        }
+    }
+}
+
+// Custom functions
+JSValue* JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    const KURL& url = frame->loader()->completeURL(args.at(exec, 1)->toString(exec));
+
+    ExceptionCode ec = 0;
+
+    String method = args.at(exec, 0)->toString(exec);
+    bool async = true;
+    if (args.size() >= 3)
+        async = args.at(exec, 2)->toBoolean(exec);
+
+    if (args.size() >= 4 && !args.at(exec, 3)->isUndefined()) {
+        String user = valueToStringWithNullCheck(exec, args.at(exec, 3));
+
+        if (args.size() >= 5 && !args.at(exec, 4)->isUndefined()) {
+            String password = valueToStringWithNullCheck(exec, args.at(exec, 4));
+            impl()->open(method, url, async, user, password, ec);
+        } else
+            impl()->open(method, url, async, user, ec);
+    } else
+        impl()->open(method, url, async, ec);
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    ExceptionCode ec = 0;
+    impl()->setRequestHeader(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec), ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
+{
+    ExceptionCode ec = 0;
+    if (args.isEmpty())
+        impl()->send(ec);
+    else {
+        JSValue* val = args.at(exec, 0);
+        if (val->isUndefinedOrNull())
+            impl()->send(ec);
+        else if (val->isObject(&JSDocument::s_info))
+            impl()->send(toDocument(val), ec);
+        else if (val->isObject(&JSFile::s_info))
+            impl()->send(toFile(val), ec);
+        else
+            impl()->send(val->toString(exec), ec);
+    }
+
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString sourceURL;
+    JSValue* function;
+    exec->machine()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
+    impl()->setLastSendLineNumber(signedLineNumber >= 0 ? signedLineNumber : 0);
+    impl()->setLastSendURL(sourceURL);
+
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue* JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    ExceptionCode ec = 0;
+    JSValue* header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(exec, 0)->toString(exec), ec));
+    setDOMException(exec, ec);
+    return header;
+}
+
+JSValue* JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    impl()->overrideMimeType(args.at(exec, 0)->toString(exec));
+    return jsUndefined();
+}
+
+JSValue* JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue* JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
new file mode 100644
index 0000000..ae673d9
--- /dev/null
+++ b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSXMLHttpRequestUpload.h"
+
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Event.h"
+#include "Frame.h"
+#include "JSDOMWindowCustom.h"
+#include "JSEvent.h"
+#include "JSEventListener.h"
+#include "XMLHttpRequest.h"
+#include "XMLHttpRequestUpload.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSXMLHttpRequestUpload::mark()
+{
+    Base::mark();
+
+    if (XMLHttpRequest* xmlHttpRequest = m_impl->associatedXMLHttpRequest()) {
+        DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), xmlHttpRequest);
+        if (wrapper && !wrapper->marked())
+            wrapper->mark();
+    }
+
+    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
+        onAbortListener->mark();
+
+    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
+        onErrorListener->mark();
+
+    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
+        onLoadListener->mark();
+
+    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
+        onLoadStartListener->mark();
+    
+    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
+        onProgressListener->mark();
+    
+    typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
+    typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
+    EventListenersMap& eventListeners = m_impl->eventListeners();
+    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
+            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
+            listener->mark();
+        }
+    }
+}
+
+JSValue* JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue* JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    if (!listener)
+        return jsUndefined();
+    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp b/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
new file mode 100644
index 0000000..e27e7a5
--- /dev/null
+++ b/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "JSXSLTProcessorConstructor.h"
+
+#include "JSXSLTProcessor.h"
+#include "XSLTProcessor.h"
+#include <wtf/RefPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor)
+
+const ClassInfo JSXSLTProcessorConstructor::s_info = { "XSLTProcessorConsructor", 0, 0, 0 };
+
+JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
+    : DOMObject(JSXSLTProcessorConstructor::createStructureID(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec), None);
+}
+
+static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList& args)
+{
+    return CREATE_DOM_OBJECT_WRAPPER(exec, XSLTProcessor, XSLTProcessor::create().get());
+}
+
+ConstructType JSXSLTProcessorConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructXSLTProcessor;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebCore/bindings/js/JSXSLTProcessorConstructor.h b/WebCore/bindings/js/JSXSLTProcessorConstructor.h
new file mode 100644
index 0000000..64ef944
--- /dev/null
+++ b/WebCore/bindings/js/JSXSLTProcessorConstructor.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2005, 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSXSLTProcessorConstructor_h
+#define JSXSLTProcessorConstructor_h
+
+#if ENABLE(XSLT)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSXSLTProcessorConstructor : public DOMObject {
+    public:
+        JSXSLTProcessorConstructor(JSC::ExecState*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
+
+#endif // JSXSLTProcessorConstructor_h
diff --git a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
new file mode 100644
index 0000000..6a5d29b
--- /dev/null
+++ b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "JSXSLTProcessor.h"
+
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "JSDocument.h"
+#include "JSDocumentFragment.h"
+#include "JSNode.h"
+#include "Node.h"
+#include "PlatformString.h"
+#include "XSLTProcessor.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue* JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& args)
+{
+    JSValue* nodeVal = args.at(exec, 0);
+    if (nodeVal->isObject(&JSNode::s_info)) {
+        JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
+        impl()->importStylesheet(node->impl());
+        return jsUndefined();
+    }
+    // Throw exception?
+    return jsUndefined();
+}
+
+JSValue* JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
+{
+    JSValue* nodeVal = args.at(exec, 0);
+    JSValue* docVal = args.at(exec, 1);
+    if (nodeVal->isObject(&JSNode::s_info) && docVal->isObject(&JSDocument::s_info)) {
+        WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
+        Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
+        return toJS(exec, impl()->transformToFragment(node, doc).get());
+    }
+    // Throw exception?
+    return jsUndefined();
+}
+
+JSValue* JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
+{
+    JSValue* nodeVal = args.at(exec, 0);
+    if (nodeVal->isObject(&JSNode::s_info)) {
+        JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
+        RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
+        if (resultDocument)
+            return toJS(exec, resultDocument.get());
+        return jsUndefined();
+    }
+    // Throw exception?
+    return jsUndefined();
+}
+
+JSValue* JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.at(exec, 1)->isUndefinedOrNull() || args.at(exec, 2)->isUndefinedOrNull())
+        return jsUndefined(); // Throw exception?
+    String namespaceURI = args.at(exec, 0)->toString(exec);
+    String localName = args.at(exec, 1)->toString(exec);
+    String value = args.at(exec, 2)->toString(exec);
+    impl()->setParameter(namespaceURI, localName, value);
+    return jsUndefined();
+}
+
+JSValue* JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.at(exec, 1)->isUndefinedOrNull())
+        return jsUndefined();
+    String namespaceURI = args.at(exec, 0)->toString(exec);
+    String localName = args.at(exec, 1)->toString(exec);
+    String value = impl()->getParameter(namespaceURI, localName);
+    return jsStringOrUndefined(exec, value);
+}
+
+JSValue* JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
+{
+    if (args.at(exec, 1)->isUndefinedOrNull())
+        return jsUndefined();
+    String namespaceURI = args.at(exec, 0)->toString(exec);
+    String localName = args.at(exec, 1)->toString(exec);
+    impl()->removeParameter(namespaceURI, localName);
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebCore/bindings/js/PausedTimeouts.cpp b/WebCore/bindings/js/PausedTimeouts.cpp
new file mode 100644
index 0000000..c8a59d8
--- /dev/null
+++ b/WebCore/bindings/js/PausedTimeouts.cpp
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reseved.
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ */
+
+#include "config.h"
+#include "PausedTimeouts.h"
+
+#include "ScheduledAction.h"
+
+namespace WebCore {
+
+PausedTimeouts::~PausedTimeouts()
+{
+    PausedTimeout* array = m_array;
+    if (!array)
+        return;
+    size_t count = m_length;
+    for (size_t i = 0; i != count; ++i)
+        delete array[i].action;
+    delete [] array;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/PausedTimeouts.h b/WebCore/bindings/js/PausedTimeouts.h
new file mode 100644
index 0000000..3839eae
--- /dev/null
+++ b/WebCore/bindings/js/PausedTimeouts.h
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reseved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef PausedTimeouts_h
+#define PausedTimeouts_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class ScheduledAction;
+
+    struct PausedTimeout {
+        int timeoutId;
+        int nestingLevel;
+        double nextFireInterval;
+        double repeatInterval;
+        ScheduledAction* action;
+    };
+
+    class PausedTimeouts : Noncopyable {
+    public:
+        PausedTimeouts(PausedTimeout* array, size_t length)
+            : m_array(array)
+            , m_length(length)
+        {
+        }
+
+        ~PausedTimeouts();
+
+        size_t numTimeouts() const { return m_length; }
+        PausedTimeout* takeTimeouts() { PausedTimeout* a = m_array; m_array = 0; return a; }
+
+    private:
+        PausedTimeout* m_array;
+        size_t m_length;
+    };
+
+} // namespace WebCore
+
+#endif // PausedTimeouts_h
diff --git a/WebCore/bindings/js/ScheduledAction.cpp b/WebCore/bindings/js/ScheduledAction.cpp
new file mode 100644
index 0000000..8d13cd2
--- /dev/null
+++ b/WebCore/bindings/js/ScheduledAction.cpp
@@ -0,0 +1,93 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
+ *  USA
+ */
+
+#include "config.h"
+#include "ScheduledAction.h"
+
+#include "CString.h"
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "JSDOMWindow.h"
+#include "ScriptController.h"
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScheduledAction::ScheduledAction(ExecState* exec, JSValue* function, const ArgList& args)
+    : m_function(function)
+{
+    ArgList::const_iterator end = args.end();
+    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
+        m_args.append((*it).jsValue(exec));
+}
+
+void ScheduledAction::execute(JSDOMWindowShell* windowShell)
+{
+    RefPtr<Frame> frame = windowShell->window()->impl()->frame();
+    if (!frame)
+        return;
+
+    if (!frame->script()->isEnabled())
+        return;
+
+    frame->script()->setProcessingTimerCallback(true);
+
+    JSLock lock(false);
+
+    if (m_function) {
+        CallData callData;
+        CallType callType = m_function->getCallData(callData);
+        if (callType != CallTypeNone) {
+            JSDOMWindow* window = windowShell->window();
+            ExecState* exec = window->globalExec();
+
+            ArgList args;
+            size_t size = m_args.size();
+            for (size_t i = 0; i < size; ++i)
+                args.append(m_args[i]);
+
+            window->startTimeoutCheck();
+            call(exec, m_function, callType, callData, windowShell, args);
+            window->stopTimeoutCheck();
+            if (exec->hadException())
+                frame->domWindow()->console()->reportCurrentException(exec);
+        }
+    } else
+        frame->loader()->executeScript(m_code);
+
+    // Update our document's rendering following the execution of the timeout callback.
+    // FIXME: Why not use updateDocumentsRendering to update rendering of all documents?
+    // FIXME: Is this really the right point to do the update? We need a place that works
+    // for all possible entry points that might possibly execute script, but this seems
+    // to be a bit too low-level.
+    if (Document* document = frame->document())
+        document->updateRendering();
+
+    frame->script()->setProcessingTimerCallback(false);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/ScheduledAction.h b/WebCore/bindings/js/ScheduledAction.h
new file mode 100644
index 0000000..938ac7b
--- /dev/null
+++ b/WebCore/bindings/js/ScheduledAction.h
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef ScheduledAction_h
+#define ScheduledAction_h
+
+#include "PlatformString.h"
+#include <kjs/protect.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class JSDOMWindowShell;
+
+   /* An action (either function or string) to be executed after a specified
+    * time interval, either once or repeatedly. Used for window.setTimeout()
+    * and window.setInterval()
+    */
+    class ScheduledAction {
+    public:
+        ScheduledAction(JSC::ExecState* exec, JSC::JSValue* function, const JSC::ArgList&);
+        ScheduledAction(const String& code)
+            : m_code(code)
+        {
+        }
+
+        void execute(JSDOMWindowShell*);
+
+    private:
+        JSC::ProtectedPtr<JSC::JSValue> m_function;
+        Vector<JSC::ProtectedPtr<JSC::JSValue> > m_args;
+        String m_code;
+    };
+
+} // namespace WebCore
+
+#endif // ScheduledAction_h
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
new file mode 100644
index 0000000..5346c07
--- /dev/null
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -0,0 +1,376 @@
+/*
+ *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Event.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "GCController.h"
+#include "JSDOMWindow.h"
+#include "JSDocument.h"
+#include "JSEventListener.h"
+#include "npruntime_impl.h"
+#include "NP_jsobject.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "PausedTimeouts.h"
+#include "runtime_root.h"
+#include "Settings.h"
+#include "StringSourceProvider.h"
+
+#include <kjs/completion.h>
+#include <debugger/Debugger.h>
+#include <runtime/JSLock.h>
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+#include "HTMLPlugInElement.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptController::ScriptController(Frame* frame)
+    : m_frame(frame)
+    , m_handlerLineno(0)
+    , m_sourceURL(0)
+    , m_processingTimerCallback(false)
+    , m_paused(false)
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    , m_windowScriptNPObject(0)
+#endif
+#if PLATFORM(MAC)
+    , m_windowScriptObject(0)
+#endif
+{
+#if PLATFORM(MAC) && ENABLE(MAC_JAVA_BRIDGE)
+    static bool initializedJavaJSBindings;
+    if (!initializedJavaJSBindings) {
+        initializedJavaJSBindings = true;
+        initJavaJSBindings();
+    }
+#endif
+}
+
+ScriptController::~ScriptController()
+{
+    if (m_windowShell) {
+        m_windowShell = 0;
+    
+        // It's likely that releasing the global object has created a lot of garbage.
+        gcController().garbageCollectSoon();
+    }
+
+    disconnectPlatformScriptObjects();
+}
+
+JSValue* ScriptController::evaluate(const String& sourceURL, int baseLine, const String& str) 
+{
+    // evaluate code. Returns the JS return value or 0
+    // if there was none, an error occured or the type couldn't be converted.
+
+    initScriptIfNeeded();
+    // inlineCode is true for <a href="javascript:doSomething()">
+    // and false for <script>doSomething()</script>. Check if it has the
+    // expected value in all cases.
+    // See smart window.open policy for where this is used.
+    ExecState* exec = m_windowShell->window()->globalExec();
+    const String* savedSourceURL = m_sourceURL;
+    m_sourceURL = &sourceURL;
+
+    JSLock lock(false);
+
+    // Evaluating the JavaScript could cause the frame to be deallocated
+    // so we start the keep alive timer here.
+    m_frame->keepAlive();
+
+    m_windowShell->window()->startTimeoutCheck();
+    Completion comp = Interpreter::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), makeSource(str, sourceURL, baseLine), m_windowShell);
+    m_windowShell->window()->stopTimeoutCheck();
+
+    if (comp.complType() == Normal || comp.complType() == ReturnValue) {
+        m_sourceURL = savedSourceURL;
+        return comp.value();
+    }
+
+    if (comp.complType() == Throw)
+        m_frame->domWindow()->console()->reportException(exec, comp.value());
+
+    m_sourceURL = savedSourceURL;
+    return noValue();
+}
+
+void ScriptController::clearWindowShell()
+{
+    if (!m_windowShell)
+        return;
+
+    JSLock lock(false);
+    m_windowShell->window()->clear();
+    m_liveFormerWindows.add(m_windowShell->window());
+    m_windowShell->setWindow(m_frame->domWindow());
+    if (Page* page = m_frame->page()) {
+        attachDebugger(page->debugger());
+        m_windowShell->window()->setProfileGroup(page->group().identifier());
+    }
+
+    // There is likely to be a lot of garbage now.
+    gcController().garbageCollectSoon();
+}
+
+PassRefPtr<EventListener> ScriptController::createInlineEventListener(const String& functionName, const String& code, Node* node)
+{
+    initScriptIfNeeded();
+    JSLock lock(false);
+    return JSLazyEventListener::create(JSLazyEventListener::HTMLLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
+}
+
+#if ENABLE(SVG)
+PassRefPtr<EventListener> ScriptController::createSVGEventHandler(const String& functionName, const String& code, Node* node)
+{
+    initScriptIfNeeded();
+    JSLock lock(false);
+    return JSLazyEventListener::create(JSLazyEventListener::SVGLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
+}
+#endif
+
+void ScriptController::initScript()
+{
+    if (m_windowShell)
+        return;
+
+    JSLock lock(false);
+
+    m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
+    updateDocument();
+
+    if (Page* page = m_frame->page()) {
+        attachDebugger(page->debugger());
+        m_windowShell->window()->setProfileGroup(page->group().identifier());
+    }
+
+    m_frame->loader()->dispatchWindowObjectAvailable();
+}
+
+bool ScriptController::processingUserGesture() const
+{
+    if (!m_windowShell)
+        return false;
+
+    if (Event* event = m_windowShell->window()->currentEvent()) {
+        const AtomicString& type = event->type();
+        if ( // mouse events
+            type == eventNames().clickEvent || type == eventNames().mousedownEvent ||
+            type == eventNames().mouseupEvent || type == eventNames().dblclickEvent ||
+            // keyboard events
+            type == eventNames().keydownEvent || type == eventNames().keypressEvent ||
+            type == eventNames().keyupEvent ||
+#if ENABLE(TOUCH_EVENTS) // Android
+            // touch events
+            type == eventNames().touchstartEvent || type == eventNames().touchmoveEvent ||
+            type == eventNames().touchendEvent || type == eventNames().touchcancelEvent ||
+#endif
+            // other accepted events
+            type == eventNames().selectEvent || type == eventNames().changeEvent ||
+            type == eventNames().focusEvent || type == eventNames().blurEvent ||
+            type == eventNames().submitEvent)
+            return true;
+    } else { // no event
+        if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback) {
+            // This is the <a href="javascript:window.open('...')> case -> we let it through
+            return true;
+        }
+        // This is the <script>window.open(...)</script> case or a timer callback -> block it
+    }
+    return false;
+}
+
+bool ScriptController::isEnabled()
+{
+    Settings* settings = m_frame->settings();
+    return (settings && settings->isJavaScriptEnabled());
+}
+
+void ScriptController::attachDebugger(JSC::Debugger* debugger)
+{
+    if (!m_windowShell)
+        return;
+
+    if (debugger)
+        debugger->attach(m_windowShell->window());
+    else if (JSC::Debugger* currentDebugger = m_windowShell->window()->debugger())
+        currentDebugger->detach(m_windowShell->window());
+}
+
+void ScriptController::updateDocument()
+{
+    if (!m_frame->document())
+        return;
+
+    JSLock lock(false);
+    if (m_windowShell)
+        m_windowShell->window()->updateDocument();
+    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
+    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
+        (*it)->updateDocument();
+}
+
+
+Bindings::RootObject* ScriptController::bindingRootObject()
+{
+    if (!isEnabled())
+        return 0;
+
+    if (!m_bindingRootObject) {
+        JSLock lock(false);
+        m_bindingRootObject = Bindings::RootObject::create(0, globalObject());
+    }
+    return m_bindingRootObject.get();
+}
+
+PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* nativeHandle)
+{
+    RootObjectMap::iterator it = m_rootObjects.find(nativeHandle);
+    if (it != m_rootObjects.end())
+        return it->second;
+
+    RefPtr<Bindings::RootObject> rootObject = Bindings::RootObject::create(nativeHandle, globalObject());
+
+    m_rootObjects.set(nativeHandle, rootObject);
+    return rootObject.release();
+}
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+NPObject* ScriptController::windowScriptNPObject()
+{
+    if (!m_windowScriptNPObject) {
+        if (isEnabled()) {
+            // JavaScript is enabled, so there is a JavaScript window object.
+            // Return an NPObject bound to the window object.
+            JSC::JSLock lock(false);
+            JSObject* win = windowShell()->window();
+            ASSERT(win);
+            Bindings::RootObject* root = bindingRootObject();
+            m_windowScriptNPObject = _NPN_CreateScriptObject(0, win, root);
+        } else {
+            // JavaScript is not enabled, so we cannot bind the NPObject to the JavaScript window object.
+            // Instead, we create an NPObject of a different class, one which is not bound to a JavaScript object.
+            m_windowScriptNPObject = _NPN_CreateNoScriptObject();
+        }
+    }
+
+    return m_windowScriptNPObject;
+}
+
+NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
+{
+    // Can't create NPObjects when JavaScript is disabled
+    if (!isEnabled())
+        return _NPN_CreateNoScriptObject();
+
+    // Create a JSObject bound to this element
+    JSLock lock(false);
+    ExecState* exec = globalObject()->globalExec();
+    JSValue* jsElementValue = toJS(exec, plugin);
+    if (!jsElementValue || !jsElementValue->isObject())
+        return _NPN_CreateNoScriptObject();
+
+    // Wrap the JSObject in an NPObject
+    return _NPN_CreateScriptObject(0, jsElementValue->getObject(), bindingRootObject());
+}
+#endif
+
+#if !PLATFORM(MAC)
+void ScriptController::clearPlatformScriptObjects()
+{
+}
+
+void ScriptController::disconnectPlatformScriptObjects()
+{
+}
+#endif
+
+void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
+{
+    RootObjectMap::iterator it = m_rootObjects.find(nativeHandle);
+
+    if (it == m_rootObjects.end())
+        return;
+
+    it->second->invalidate();
+    m_rootObjects.remove(it);
+}
+
+void ScriptController::clearScriptObjects()
+{
+    JSLock lock(false);
+
+    RootObjectMap::const_iterator end = m_rootObjects.end();
+    for (RootObjectMap::const_iterator it = m_rootObjects.begin(); it != end; ++it)
+        it->second->invalidate();
+
+    m_rootObjects.clear();
+
+    if (m_bindingRootObject) {
+        m_bindingRootObject->invalidate();
+        m_bindingRootObject = 0;
+    }
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    if (m_windowScriptNPObject) {
+        // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window
+        // script object properly.
+        // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.
+        _NPN_DeallocateObject(m_windowScriptNPObject);
+        m_windowScriptNPObject = 0;
+    }
+#endif
+
+    clearPlatformScriptObjects();
+}
+
+void ScriptController::pauseTimeouts(OwnPtr<PausedTimeouts>& result)
+{
+    if (!haveWindowShell()) {
+        result.clear();
+        return;
+    }
+
+    windowShell()->window()->pauseTimeouts(result);
+}
+
+void ScriptController::resumeTimeouts(OwnPtr<PausedTimeouts>& pausedTimeouts)
+{
+    if (!haveWindowShell()) {
+        // Callers can assume we will always clear the passed in timeouts
+        pausedTimeouts.clear();
+        return;
+    }
+
+    windowShell()->window()->resumeTimeouts(pausedTimeouts);
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
new file mode 100644
index 0000000..047957c
--- /dev/null
+++ b/WebCore/bindings/js/ScriptController.h
@@ -0,0 +1,160 @@
+/*
+ *  Copyright (C) 1999 Harri Porten (porten@kde.org)
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef ScriptController_h
+#define ScriptController_h
+
+#include "JSDOMWindowShell.h"
+#include <kjs/protect.h>
+#include <wtf/RefPtr.h>
+
+#if PLATFORM(MAC)
+#include <wtf/RetainPtr.h>
+
+#ifdef __OBJC__
+@class WebScriptObject;
+#else
+class WebScriptObject;
+#endif
+#endif
+
+struct NPObject;
+
+namespace JSC {
+    class JSGlobalObject;
+
+    namespace Bindings {
+        class Instance;
+        class RootObject;
+    }
+}
+
+namespace WebCore {
+
+class Event;
+class EventListener;
+class HTMLPlugInElement;
+class Frame;
+class Node;
+class String;
+class Widget;
+
+typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
+
+class ScriptController {
+public:
+    ScriptController(Frame*);
+    ~ScriptController();
+
+    bool haveWindowShell() const { return m_windowShell; }
+    JSDOMWindowShell* windowShell()
+    {
+        initScriptIfNeeded();
+        return m_windowShell;
+    }
+
+    JSDOMWindow* globalObject()
+    {
+        initScriptIfNeeded();
+        return m_windowShell->window();
+    }
+
+    JSC::JSValue* evaluate(const String& sourceURL, int baseLine, const String& code);
+
+    PassRefPtr<EventListener> createInlineEventListener(const String& functionName, const String& code, Node*);
+#if ENABLE(SVG)
+    PassRefPtr<EventListener> createSVGEventHandler(const String& functionName, const String& code, Node*);
+#endif
+    void setEventHandlerLineno(int lineno) { m_handlerLineno = lineno; }
+
+    void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
+    bool processingUserGesture() const;
+
+    bool isEnabled();
+
+    void attachDebugger(JSC::Debugger*);
+
+    void setPaused(bool b) { m_paused = b; }
+    bool isPaused() const { return m_paused; }
+
+    const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
+
+    void clearWindowShell();
+    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
+    void updateDocument();
+
+    void pauseTimeouts(OwnPtr<PausedTimeouts>&);
+    void resumeTimeouts(OwnPtr<PausedTimeouts>&);
+
+    void clearScriptObjects();
+    void cleanupScriptObjectsForPlugin(void*);
+
+    PassRefPtr<JSC::Bindings::Instance> createScriptInstanceForWidget(Widget*);
+    JSC::Bindings::RootObject* bindingRootObject();
+
+    PassRefPtr<JSC::Bindings::RootObject> createRootObject(void* nativeHandle);
+
+#if PLATFORM(MAC)
+#if ENABLE(MAC_JAVA_BRIDGE)
+    static void initJavaJSBindings();
+#endif
+    WebScriptObject* windowScriptObject();
+#endif
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
+    NPObject* windowScriptNPObject();
+#endif
+
+private:
+    void initScriptIfNeeded()
+    {
+        if (!m_windowShell)
+            initScript();
+    }
+    void initScript();
+
+    void clearPlatformScriptObjects();
+    void disconnectPlatformScriptObjects();
+
+    JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
+    HashSet<JSDOMWindow*> m_liveFormerWindows;
+    Frame* m_frame;
+    int m_handlerLineno;
+    const String* m_sourceURL;
+
+    bool m_processingTimerCallback;
+    bool m_paused;
+
+    // The root object used for objects bound outside the context of a plugin.
+    RefPtr<JSC::Bindings::RootObject> m_bindingRootObject;
+    RootObjectMap m_rootObjects;
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    NPObject* m_windowScriptNPObject;
+#endif
+#if PLATFORM(MAC)
+    RetainPtr<WebScriptObject> m_windowScriptObject;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // ScriptController_h
diff --git a/WebCore/bindings/js/ScriptControllerAndroid.cpp b/WebCore/bindings/js/ScriptControllerAndroid.cpp
new file mode 100644
index 0000000..deb8ea3
--- /dev/null
+++ b/WebCore/bindings/js/ScriptControllerAndroid.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2008, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "PluginView.h"
+#include "runtime.h"
+
+namespace WebCore {
+
+#ifdef ANDROID_PLUGINS
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+}
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptControllerGtk.cpp b/WebCore/bindings/js/ScriptControllerGtk.cpp
new file mode 100644
index 0000000..c906034
--- /dev/null
+++ b/WebCore/bindings/js/ScriptControllerGtk.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
+ * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2008 Collabora Ltd.  All rights reserved.
+ * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "PluginView.h"
+#include "runtime_root.h"
+#include "runtime.h"
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+}
+
+}
diff --git a/WebCore/bindings/js/ScriptControllerMac.mm b/WebCore/bindings/js/ScriptControllerMac.mm
new file mode 100644
index 0000000..df65352
--- /dev/null
+++ b/WebCore/bindings/js/ScriptControllerMac.mm
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "ScriptController.h"
+
+#import "DOMAbstractViewFrame.h"
+#import "DOMWindow.h"
+#import "Frame.h"
+#import "FrameLoader.h"
+#import "FrameLoaderClient.h"
+#import "JSDOMWindow.h"
+#import "WebScriptObjectPrivate.h"
+#import "Widget.h"
+#import <JavaScriptCore/APICast.h>
+#import <runtime/JSLock.h>
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+#import "c_instance.h"
+#import "NP_jsobject.h"
+#import "npruntime_impl.h"
+#endif
+
+#import "objc_instance.h"
+#import "runtime_root.h"
+#import "runtime.h"
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+#import "jni_instance.h"
+#endif
+
+@interface NSObject (WebPlugin)
+- (id)objectForWebScript;
+- (NPObject *)createPluginScriptableObject;
+@end
+
+using namespace JSC::Bindings;
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    NSView* widgetView = widget->platformWidget();
+    if (!widgetView)
+        return 0;
+
+    RefPtr<RootObject> rootObject = createRootObject(widgetView);
+
+    if ([widgetView respondsToSelector:@selector(objectForWebScript)]) {
+        id objectForWebScript = [widgetView objectForWebScript];
+        if (!objectForWebScript)
+            return 0;
+        return JSC::Bindings::ObjcInstance::create(objectForWebScript, rootObject.release());
+    }
+
+    if ([widgetView respondsToSelector:@selector(createPluginScriptableObject)]) {
+#if !ENABLE(NETSCAPE_PLUGIN_API)
+        return 0;
+#else
+        NPObject* npObject = [widgetView createPluginScriptableObject];
+        if (!npObject)
+            return 0;
+        RefPtr<Instance> instance = JSC::Bindings::CInstance::create(npObject, rootObject.release());
+        // -createPluginScriptableObject returns a retained NPObject.  The caller is expected to release it.
+        _NPN_ReleaseObject(npObject);
+        return instance.release();
+#endif
+    }
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+    jobject applet = m_frame->loader()->client()->javaApplet(widgetView);
+    if (!applet)
+        return 0;
+    return JSC::Bindings::JavaInstance::create(applet, rootObject.release());
+#else
+    return 0;
+#endif
+}
+
+WebScriptObject* ScriptController::windowScriptObject()
+{
+    if (!isEnabled())
+        return 0;
+
+    if (!m_windowScriptObject) {
+        JSC::JSLock lock(false);
+        JSC::Bindings::RootObject* root = bindingRootObject();
+        m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell()) originRootObject:root rootObject:root];
+    }
+
+    ASSERT([m_windowScriptObject.get() isKindOfClass:[DOMAbstractView class]]);
+    return m_windowScriptObject.get();
+}
+
+void ScriptController::clearPlatformScriptObjects()
+{
+    if (m_windowScriptObject) {
+        JSC::Bindings::RootObject* root = bindingRootObject();
+        [m_windowScriptObject.get() _setOriginRootObject:root andRootObject:root];
+    }
+}
+
+void ScriptController::disconnectPlatformScriptObjects()
+{
+    if (m_windowScriptObject) {
+        ASSERT([m_windowScriptObject.get() isKindOfClass:[DOMAbstractView class]]);
+        [(DOMAbstractView *)m_windowScriptObject.get() _disconnectFrame];
+    }
+}
+
+#if ENABLE(MAC_JAVA_BRIDGE)
+static pthread_t mainThread;
+
+static void updateRenderingForBindings(JSC::ExecState* exec, JSC::JSObject* rootObject)
+{
+    if (pthread_self() != mainThread)
+        return;
+
+    if (!rootObject)
+        return;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(rootObject);
+    if (!window)
+        return;
+
+    Frame* frame = window->impl()->frame();
+    if (!frame)
+        return;
+
+    Document* document = frame->document();
+    if (!document)
+        return;
+
+    document->updateRendering();
+}
+
+void ScriptController::initJavaJSBindings()
+{
+    mainThread = pthread_self();
+    JSC::Bindings::JavaJSObject::initializeJNIThreading();
+    JSC::Bindings::Instance::setDidExecuteFunction(updateRenderingForBindings);
+}
+#endif
+
+}
diff --git a/WebCore/bindings/js/ScriptControllerQt.cpp b/WebCore/bindings/js/ScriptControllerQt.cpp
new file mode 100644
index 0000000..a09c7b7
--- /dev/null
+++ b/WebCore/bindings/js/ScriptControllerQt.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 George Staikos <staikos@kde.org>
+ * Copyright (C) 2006 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2006 Rob Buis <buis@kde.org>
+ * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008 Collabora Ltd.  All rights reserved.
+ * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "DOMWindow.h"
+#include "PluginView.h"
+#include "qt_instance.h"
+#include "runtime_root.h"
+#include "runtime.h"
+
+#include <QWidget>
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(WebCore::Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+        
+    PluginView* pluginView = static_cast<PluginView*>(widget);
+    if (pluginView->isNPAPIPlugin())
+        return pluginView->bindingInstance();
+
+    QWidget* platformWidget = widget->platformWidget();
+    if (!platformWidget)
+        return 0;
+    return JSC::Bindings::QtInstance::getQtInstance(platformWidget, bindingRootObject());
+}
+
+}
+// vim: ts=4 sw=4 et
diff --git a/WebCore/bindings/js/ScriptControllerWin.cpp b/WebCore/bindings/js/ScriptControllerWin.cpp
new file mode 100644
index 0000000..703cf7c
--- /dev/null
+++ b/WebCore/bindings/js/ScriptControllerWin.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "PluginView.h"
+#include "runtime.h"
+
+using namespace JSC::Bindings;
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptControllerWx.cpp b/WebCore/bindings/js/ScriptControllerWx.cpp
new file mode 100644
index 0000000..1c14928
--- /dev/null
+++ b/WebCore/bindings/js/ScriptControllerWx.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2008 Apple Computer, Inc.  All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptController.h"
+
+#include "PluginView.h"
+#include "runtime_root.h"
+#include "runtime.h"
+
+namespace WebCore {
+
+PassRefPtr<JSC::Bindings::Instance> ScriptController::createScriptInstanceForWidget(Widget* widget)
+{
+    if (!widget->isPluginView())
+        return 0;
+
+    return static_cast<PluginView*>(widget)->bindingInstance();
+}
+
+}
diff --git a/WebCore/bindings/js/StringSourceProvider.h b/WebCore/bindings/js/StringSourceProvider.h
new file mode 100644
index 0000000..faa848c
--- /dev/null
+++ b/WebCore/bindings/js/StringSourceProvider.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StringSourceProvider_h
+#define StringSourceProvider_h
+
+#include <kjs/SourceCode.h>
+
+namespace WebCore {
+
+    class StringSourceProvider : public JSC::SourceProvider {
+    public:
+        static PassRefPtr<StringSourceProvider> create(const String& source, const String& url) { return adoptRef(new StringSourceProvider(source, url)); }
+
+        JSC::UString getRange(int start, int end) const { return JSC::UString(m_source.characters() + start, end - start); }
+        const UChar* data() const { return m_source.characters(); }
+        int length() const { return m_source.length(); }
+
+    private:
+        StringSourceProvider(const String& source, const String& url)
+            : SourceProvider(url)
+            , m_source(source)
+        {
+        }
+        
+        String m_source;
+    };
+
+    inline JSC::SourceCode makeSource(const String& source, const JSC::UString& url = JSC::UString(), int firstLine = 1)
+    {
+        return JSC::SourceCode(StringSourceProvider::create(source, url), firstLine);
+    }
+}
+
+#endif