Merge webkit.org at r61121: Initial merge by git.

Change-Id: Icd6db395c62285be384d137164d95d7466c98760

37 files changed, 326 insertions, 198 deletions

diff --git a/WebCore/bindings/v8/NPV8Object.cpp b/WebCore/bindings/v8/NPV8Object.cpp
index d8076f3..af0933f 100644
--- a/WebCore/bindings/v8/NPV8Object.cpp
+++ b/WebCore/bindings/v8/NPV8Object.cpp
@@ -49,7 +49,6 @@
 #endif
 
 #include <stdio.h>
-#include <v8.h>
 #include <wtf/StringExtras.h>
 
 using namespace WebCore;
diff --git a/WebCore/bindings/v8/ScriptArray.cpp b/WebCore/bindings/v8/ScriptArray.cpp
index 01b0898..a199a6c 100644
--- a/WebCore/bindings/v8/ScriptArray.cpp
+++ b/WebCore/bindings/v8/ScriptArray.cpp
@@ -39,8 +39,6 @@
 #include "V8Binding.h"
 #include "V8Proxy.h"
 
-#include <v8.h>
-
 namespace WebCore {
 
 ScriptArray::ScriptArray(ScriptState* scriptState, v8::Handle<v8::Array> v8Array)
diff --git a/WebCore/bindings/v8/ScriptCallStack.cpp b/WebCore/bindings/v8/ScriptCallStack.cpp
index 31b05ee..89809b2 100644
--- a/WebCore/bindings/v8/ScriptCallStack.cpp
+++ b/WebCore/bindings/v8/ScriptCallStack.cpp
@@ -37,7 +37,6 @@
 #include "V8Binding.h"
 
 #include <v8-debug.h>
-#include <v8.h>
 
 namespace WebCore {
 
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index f6cf3a4..d3ec33f 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -469,10 +469,12 @@ void ScriptController::updateDocument()
 
 void ScriptController::namedItemAdded(HTMLDocument* doc, const AtomicString& name)
 {
+    m_proxy->windowShell()->namedItemAdded(doc, name);
 }
 
 void ScriptController::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
 {
+    m_proxy->windowShell()->namedItemRemoved(doc, name);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptDebugServer.cpp b/WebCore/bindings/v8/ScriptDebugServer.cpp
index fdbb26b..39e409e 100644
--- a/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -256,6 +256,40 @@ void ScriptDebugServer::stepOutOfFunction()
 #endif
 }
 
+bool ScriptDebugServer::editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage)
+{
+#if ENABLE(V8_SCRIPT_DEBUG_SERVER)
+    ensureDebuggerScriptCompiled();
+    v8::HandleScope scope;
+
+    OwnPtr<v8::Context::Scope> contextScope;
+    if (!m_pausedPage)
+        contextScope.set(new v8::Context::Scope(v8::Debug::GetDebugContext()));
+
+    v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("editScriptSource")));
+    v8::Handle<v8::Value> argv[] = { v8String(sourceID), v8String(newContent) };
+
+    v8::TryCatch tryCatch;
+    tryCatch.SetVerbose(false);
+    v8::Handle<v8::Value> result = function->Call(m_debuggerScript.get(), 2, argv);
+    if (tryCatch.HasCaught()) {
+        v8::Local<v8::Message> message = tryCatch.Message();
+        if (!message.IsEmpty())
+            newSourceOrErrorMessage = toWebCoreStringWithNullOrUndefinedCheck(message->Get());
+        return false;
+    }
+    ASSERT(!result.IsEmpty());
+    newSourceOrErrorMessage = toWebCoreStringWithNullOrUndefinedCheck(result);
+
+    // Call stack may have changed after if the edited function was on the stack.
+    if (m_currentCallFrame)
+        m_currentCallFrame.clear();
+    return true;
+#else
+    return false;
+#endif
+}
+
 PassRefPtr<JavaScriptCallFrame> ScriptDebugServer::currentCallFrame()
 {
     if (!m_currentCallFrame) {
@@ -267,6 +301,11 @@ PassRefPtr<JavaScriptCallFrame> ScriptDebugServer::currentCallFrame()
     return m_currentCallFrame;
 }
 
+bool ScriptDebugServer::isDebuggerAlwaysEnabled()
+{
+    return true;
+}
+
 #if ENABLE(V8_SCRIPT_DEBUG_SERVER)
 void ScriptDebugServer::v8DebugEventCallback(const v8::Debug::EventDetails& eventDetails)
 {
@@ -320,7 +359,8 @@ void ScriptDebugServer::dispatchDidParseSource(ScriptDebugListener* listener, v8
         toWebCoreStringWithNullOrUndefinedCheck(object->Get(v8::String::New("id"))),
         toWebCoreStringWithNullOrUndefinedCheck(object->Get(v8::String::New("name"))),
         toWebCoreStringWithNullOrUndefinedCheck(object->Get(v8::String::New("source"))),
-        object->Get(v8::String::New("lineOffset"))->ToInteger()->Value());
+        object->Get(v8::String::New("lineOffset"))->ToInteger()->Value(),
+        static_cast<ScriptWorldType>(object->Get(v8::String::New("scriptWorldType"))->Int32Value()));
 }
 
 void ScriptDebugServer::ensureDebuggerScriptCompiled()
diff --git a/WebCore/bindings/v8/ScriptDebugServer.h b/WebCore/bindings/v8/ScriptDebugServer.h
index 7c8c5cc..9439c16 100644
--- a/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/WebCore/bindings/v8/ScriptDebugServer.h
@@ -74,6 +74,8 @@ public:
     void stepOverStatement();
     void stepOutOfFunction();
 
+    bool editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage);
+
     void recompileAllJSFunctionsSoon() { }
     void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) { }
 
@@ -92,6 +94,8 @@ public:
 
     PassRefPtr<JavaScriptCallFrame> currentCallFrame();
 
+    bool isDebuggerAlwaysEnabled();
+
 private:
     ScriptDebugServer();
     ~ScriptDebugServer() { }
diff --git a/WebCore/bindings/v8/ScriptEventListener.cpp b/WebCore/bindings/v8/ScriptEventListener.cpp
index cad7a1c..57a2824 100644
--- a/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -36,7 +36,7 @@
 #include "EventListener.h"
 #include "Frame.h"
 #include "ScriptScope.h"
-#include "Tokenizer.h"
+#include "DocumentParser.h"
 #include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "XSSAuditor.h"
@@ -64,10 +64,10 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
             return 0;
         }
 
-        if (frame->document()->tokenizer()) {
+        if (frame->document()->parser()) {
             // FIXME: Change to use script->eventHandlerLineNumber() when implemented.
-            lineNumber = frame->document()->tokenizer()->lineNumber();
-            columnNumber = frame->document()->tokenizer()->columnNumber();
+            lineNumber = frame->document()->parser()->lineNumber();
+            columnNumber = frame->document()->parser()->columnNumber();
         }
         sourceURL = node->document()->url().string();
     }
@@ -97,10 +97,10 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
         return 0;
     }
 
-    if (frame->document()->tokenizer()) {
+    if (frame->document()->parser()) {
         // FIXME: Change to use script->eventHandlerLineNumber() when implemented.
-        lineNumber = frame->document()->tokenizer()->lineNumber();
-        columnNumber = frame->document()->tokenizer()->columnNumber();
+        lineNumber = frame->document()->parser()->lineNumber();
+        columnNumber = frame->document()->parser()->columnNumber();
     }
     sourceURL = frame->document()->url().string();
     return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, lineNumber, columnNumber, WorldContextHandle(UseMainWorld));
diff --git a/WebCore/bindings/v8/ScriptProfiler.cpp b/WebCore/bindings/v8/ScriptProfiler.cpp
index 1f09420..ab0b9fe 100644
--- a/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -46,7 +46,9 @@ void ScriptProfiler::start(ScriptState* state, const String& title)
 PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
     v8::HandleScope hs;
-    const v8::CpuProfile* profile = v8::CpuProfiler::StopProfiling(v8String(title));
+    const v8::CpuProfile* profile = state ?
+        v8::CpuProfiler::StopProfiling(v8String(title), state->context()->GetSecurityToken()) :
+        v8::CpuProfiler::StopProfiling(v8String(title));
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
diff --git a/WebCore/bindings/v8/SerializedScriptValue.cpp b/WebCore/bindings/v8/SerializedScriptValue.cpp
index 50ac86b..8e91920 100644
--- a/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -38,13 +38,13 @@
 #include "FileList.h"
 #include "ImageData.h"
 #include "SharedBuffer.h"
+#include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8File.h"
 #include "V8FileList.h"
 #include "V8ImageData.h"
 #include "V8Proxy.h"
 
-#include <v8.h>
 #include <wtf/Assertions.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -1012,6 +1012,52 @@ private:
 
 } // namespace
 
+void SerializedScriptValue::deserializeAndSetProperty(v8::Handle<v8::Object> object, const char* propertyName,
+                                                      v8::PropertyAttribute attribute, SerializedScriptValue* value)
+{
+    if (!value)
+        return;
+    v8::Handle<v8::Value> deserialized = value->deserialize();
+    object->ForceSet(v8::String::NewSymbol(propertyName), deserialized, attribute);
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(v8::Handle<v8::Value> value, bool& didThrow)
+{
+    return adoptRef(new SerializedScriptValue(value, didThrow));
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(v8::Handle<v8::Value> value)
+{
+    bool didThrow;
+    return adoptRef(new SerializedScriptValue(value, didThrow));
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::createFromWire(String data)
+{
+    return adoptRef(new SerializedScriptValue(data, WireData));
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(String data)
+{
+    return adoptRef(new SerializedScriptValue(data, StringValue));
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
+{
+    return adoptRef(new SerializedScriptValue());
+}
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::release()
+{
+    RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data, WireData));
+    m_data = String();
+    return result.release();
+}
+
+SerializedScriptValue::SerializedScriptValue()
+{
+}
+
 SerializedScriptValue::SerializedScriptValue(v8::Handle<v8::Value> value, bool& didThrow)
 {
     didThrow = false;
diff --git a/WebCore/bindings/v8/SerializedScriptValue.h b/WebCore/bindings/v8/SerializedScriptValue.h
index 8205a42..3710b5a 100644
--- a/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/WebCore/bindings/v8/SerializedScriptValue.h
@@ -32,7 +32,6 @@
 #define SerializedScriptValue_h
 
 #include "ScriptValue.h"
-#include "V8Binding.h"
 #include <v8.h>
 #include <wtf/RefCounted.h>
 
@@ -40,63 +39,21 @@ namespace WebCore {
 
 class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
 public:
-    // Deserializes the given value and sets it as a property on the
-    // object.
-    static void deserializeAndSetProperty(v8::Handle<v8::Object> object,
-                                          const char* propertyName,
-                                          v8::PropertyAttribute attribute,
-                                          SerializedScriptValue* value)
-    {
-        if (!value)
-            return;
-        v8::Handle<v8::Value> deserialized = value->deserialize();
-        object->ForceSet(v8::String::NewSymbol(propertyName), deserialized, attribute);
-    }
+    static void deserializeAndSetProperty(v8::Handle<v8::Object> object, const char* propertyName,
+                                          v8::PropertyAttribute, SerializedScriptValue*);
 
-    // Creates a serialized representation of the given V8 value.
-    static PassRefPtr<SerializedScriptValue> create(v8::Handle<v8::Value> value)
-    {
-        bool didThrow;
-        return adoptRef(new SerializedScriptValue(value, didThrow));
-    }
-
-    // Creates a serialized representation of the given V8 value.
-    //
     // If a serialization error occurs (e.g., cyclic input value) this
     // function returns an empty representation, schedules a V8 exception to
     // be thrown using v8::ThrowException(), and sets |didThrow|. In this case
     // the caller must not invoke any V8 operations until control returns to
     // V8. When serialization is successful, |didThrow| is false.
-    static PassRefPtr<SerializedScriptValue> create(v8::Handle<v8::Value> value, bool& didThrow)
-    {
-        return adoptRef(new SerializedScriptValue(value, didThrow));
-    }
-
-    // Creates a serialized value with the given data obtained from a
-    // prior call to toWireString().
-    static PassRefPtr<SerializedScriptValue> createFromWire(String data)
-    {
-        return adoptRef(new SerializedScriptValue(data, WireData));
-    }
-
-    // Creates a serialized representation of WebCore string.
-    static PassRefPtr<SerializedScriptValue> create(String data)
-    {
-        return adoptRef(new SerializedScriptValue(data, StringValue));
-    }
+    static PassRefPtr<SerializedScriptValue> create(v8::Handle<v8::Value> value, bool& didThrow);
+    static PassRefPtr<SerializedScriptValue> create(v8::Handle<v8::Value>);
+    static PassRefPtr<SerializedScriptValue> createFromWire(String data);
+    static PassRefPtr<SerializedScriptValue> create(String data);
+    static PassRefPtr<SerializedScriptValue> create();
 
-    // Creates an empty serialized value.
-    static PassRefPtr<SerializedScriptValue> create()
-    {
-        return adoptRef(new SerializedScriptValue());
-    }
-
-    PassRefPtr<SerializedScriptValue> release()
-    {
-        RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data, WireData));
-        m_data = String();
-        return result.release();
-    }
+    PassRefPtr<SerializedScriptValue> release();
 
     String toWireString() const { return m_data; }
 
@@ -110,10 +67,8 @@ private:
         WireData
     };
 
-    SerializedScriptValue() { }
-
+    SerializedScriptValue();
     SerializedScriptValue(v8::Handle<v8::Value>, bool& didThrow);
-
     SerializedScriptValue(String data, StringDataMode mode);
 
     String m_data;
diff --git a/WebCore/bindings/v8/V8Binding.cpp b/WebCore/bindings/v8/V8Binding.cpp
index e0904d7..97805c0 100644
--- a/WebCore/bindings/v8/V8Binding.cpp
+++ b/WebCore/bindings/v8/V8Binding.cpp
@@ -44,8 +44,6 @@
 #include "V8Proxy.h"
 #include <wtf/text/CString.h>
 
-#include <v8.h>
-
 namespace WebCore {
 
 // WebCoreStringResource is a helper class for v8ExternalString. It is used
diff --git a/WebCore/bindings/v8/V8DOMWindowShell.cpp b/WebCore/bindings/v8/V8DOMWindowShell.cpp
index c7c77d3..99fea4c 100644
--- a/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -50,6 +50,7 @@
 #include "V8DOMWindow.h"
 #include "V8Document.h"
 #include "V8GCForContextDispose.h"
+#include "V8HTMLDocument.h"
 #include "V8HiddenPropertyName.h"
 #include "V8History.h"
 #include "V8Location.h"
@@ -414,6 +415,12 @@ void V8DOMWindowShell::clearDocumentWrapper()
     }
 }
 
+static void checkDocumentWrapper(v8::Handle<v8::Object> wrapper, Document* document)
+{
+    ASSERT(V8Document::toNative(wrapper) == document);
+    ASSERT(!document->isHTMLDocument() || (V8Document::toNative(v8::Handle<v8::Object>::Cast(wrapper->GetPrototype())) == document));
+}
+
 void V8DOMWindowShell::updateDocumentWrapperCache()
 {
     v8::HandleScope handleScope;
@@ -432,6 +439,10 @@ void V8DOMWindowShell::updateDocumentWrapperCache()
     }
 
     v8::Handle<v8::Value> documentWrapper = toV8(m_frame->document());
+    ASSERT(documentWrapper == m_document || m_document.IsEmpty());
+    if (m_document.IsEmpty())
+        updateDocumentWrapper(v8::Handle<v8::Object>::Cast(documentWrapper));
+    checkDocumentWrapper(m_document, m_frame->document());
 
     // If instantiation of the document wrapper fails, clear the cache
     // and let the DOMWindow accessor handle access to the document.
@@ -509,6 +520,39 @@ void V8DOMWindowShell::updateDocument()
     updateSecurityOrigin();
 }
 
+v8::Handle<v8::Value> getter(v8::Local<v8::String> property, const v8::AccessorInfo& info)
+{
+    // FIXME(antonm): consider passing AtomicStringImpl directly.
+    AtomicString name = v8StringToAtomicWebCoreString(property);
+    HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
+    ASSERT(htmlDocument);
+    return V8HTMLDocument::GetNamedProperty(htmlDocument, name);
+}
+
+void V8DOMWindowShell::namedItemAdded(HTMLDocument* doc, const AtomicString& name)
+{
+    initContextIfNeeded();
+
+    v8::HandleScope handleScope;
+    v8::Context::Scope contextScope(m_context);
+
+    ASSERT(!m_document.IsEmpty());
+    checkDocumentWrapper(m_document, doc);
+    m_document->SetAccessor(v8String(name), getter);
+}
+
+void V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
+{
+    initContextIfNeeded();
+
+    v8::HandleScope handleScope;
+    v8::Context::Scope contextScope(m_context);
+
+    ASSERT(!m_document.IsEmpty());
+    checkDocumentWrapper(m_document, doc);
+    m_document->Delete(v8String(name));
+}
+
 void V8DOMWindowShell::updateSecurityOrigin()
 {
     v8::HandleScope scope;
diff --git a/WebCore/bindings/v8/V8DOMWindowShell.h b/WebCore/bindings/v8/V8DOMWindowShell.h
index f4eaff2..3cf1b52 100644
--- a/WebCore/bindings/v8/V8DOMWindowShell.h
+++ b/WebCore/bindings/v8/V8DOMWindowShell.h
@@ -31,6 +31,7 @@
 #ifndef V8DOMWindowShell_h
 #define V8DOMWindowShell_h
 
+#include "AtomicString.h"
 #include "WrapperTypeInfo.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
@@ -41,6 +42,7 @@ namespace WebCore {
 
 class DOMWindow;
 class Frame;
+class HTMLDocument;
 class String;
 
 // V8WindowShell represents all the per-global object state for a Frame that
@@ -54,6 +56,9 @@ public:
     // Update document object of the frame.
     void updateDocument();
 
+    void namedItemAdded(HTMLDocument*, const AtomicString&);
+    void namedItemRemoved(HTMLDocument*, const AtomicString&);
+
     // Update the security origin of a document
     // (e.g., after setting docoument.domain).
     void updateSecurityOrigin();
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index f8426dc..596090d 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -82,7 +82,6 @@
 
 #include <algorithm>
 #include <utility>
-#include <v8.h>
 #include <v8-debug.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
@@ -286,6 +285,8 @@ v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, WrapperT
     if (!instance.IsEmpty()) {
         // Avoid setting the DOM wrapper for failed allocations.
         setDOMWrapper(instance, type, impl);
+        if (type == &V8HTMLDocument::info)
+            instance = V8HTMLDocument::WrapInShadowObject(instance, static_cast<Node*>(impl));
     }
     return instance;
 }
diff --git a/WebCore/bindings/v8/V8GCController.cpp b/WebCore/bindings/v8/V8GCController.cpp
index fa7c357..5611199 100644
--- a/WebCore/bindings/v8/V8GCController.cpp
+++ b/WebCore/bindings/v8/V8GCController.cpp
@@ -46,7 +46,6 @@
 
 #include <algorithm>
 #include <utility>
-#include <v8.h>
 #include <v8-debug.h>
 #include <wtf/HashMap.h>
 #include <wtf/StdLibExtras.h>
diff --git a/WebCore/bindings/v8/V8IsolatedContext.cpp b/WebCore/bindings/v8/V8IsolatedContext.cpp
index 3237ede..b5e4590 100644
--- a/WebCore/bindings/v8/V8IsolatedContext.cpp
+++ b/WebCore/bindings/v8/V8IsolatedContext.cpp
@@ -38,7 +38,6 @@
 #include "ScriptController.h"
 #include "V8DOMWindow.h"
 #include "V8HiddenPropertyName.h"
-#include <v8.h>
 
 namespace WebCore {
 
diff --git a/WebCore/bindings/v8/V8NPObject.cpp b/WebCore/bindings/v8/V8NPObject.cpp
index f9cc94a..7f2051e 100644
--- a/WebCore/bindings/v8/V8NPObject.cpp
+++ b/WebCore/bindings/v8/V8NPObject.cpp
@@ -243,6 +243,12 @@ v8::Handle<v8::Value> npObjectGetIndexedProperty(v8::Local<v8::Object> self, uin
     return npObjectGetProperty(self, identifier, v8::Number::New(index));
 }
 
+v8::Handle<v8::Integer> npObjectQueryProperty(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    NPIdentifier identifier = getStringIdentifier(name);
+    return npObjectGetProperty(info.Holder(), identifier, name).IsEmpty() ? v8::Handle<v8::Integer>() : v8::Integer::New(v8::None);
+}
+
 static v8::Handle<v8::Value> npObjectSetProperty(v8::Local<v8::Object> self, NPIdentifier identifier, v8::Local<v8::Value> value)
 {
     NPObject* npObject = v8ObjectToNPObject(self);
@@ -373,7 +379,7 @@ v8::Local<v8::Object> createV8ObjectForNPObject(NPObject* object, NPObject* root
     if (npObjectDesc.IsEmpty()) {
         npObjectDesc = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New());
         npObjectDesc->InstanceTemplate()->SetInternalFieldCount(npObjectInternalFieldCount);
-        npObjectDesc->InstanceTemplate()->SetNamedPropertyHandler(npObjectNamedPropertyGetter, npObjectNamedPropertySetter, 0, 0, npObjectNamedPropertyEnumerator);
+        npObjectDesc->InstanceTemplate()->SetNamedPropertyHandler(npObjectNamedPropertyGetter, npObjectNamedPropertySetter, npObjectQueryProperty, 0, npObjectNamedPropertyEnumerator);
         npObjectDesc->InstanceTemplate()->SetIndexedPropertyHandler(npObjectIndexedPropertyGetter, npObjectIndexedPropertySetter, 0, 0, npObjectIndexedPropertyEnumerator);
         npObjectDesc->InstanceTemplate()->SetCallAsFunctionHandler(npObjectInvokeDefaultHandler);
     }
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index 7f52374..7a5df96 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -67,7 +67,6 @@
 #include <algorithm>
 #include <stdio.h>
 #include <utility>
-#include <v8.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/StdLibExtras.h>
diff --git a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp
index 6ae3a3e..2c89b95 100644
--- a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp
@@ -36,7 +36,7 @@
 #include "V8Binding.h"
 #include "V8Proxy.h"
 #include "V8Int8Array.h"
-#include "V8FloatArray.h"
+#include "V8Float32Array.h"
 #include "V8Int32Array.h"
 #include "V8Int16Array.h"
 #include "V8Uint8Array.h"
@@ -52,7 +52,7 @@ v8::Handle<v8::Value> toV8(ArrayBufferView* impl)
     if (impl->isByteArray())
         return toV8(static_cast<Int8Array*>(impl));
     if (impl->isFloatArray())
-        return toV8(static_cast<FloatArray*>(impl));
+        return toV8(static_cast<Float32Array*>(impl));
     if (impl->isIntArray())
         return toV8(static_cast<Int32Array*>(impl));
     if (impl->isShortArray())
diff --git a/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index 4cc6ac2..7d1cfc1 100644
--- a/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -33,8 +33,10 @@
 #include "V8Console.h"
 
 #include "Console.h"
+#include "MemoryInfo.h"
 #include "ScriptProfile.h"
 #include "V8Binding.h"
+#include "V8MemoryInfo.h"
 #include "V8Proxy.h"
 #include "V8ScriptProfile.h"
 
@@ -42,11 +44,23 @@ namespace WebCore {
 
 typedef Vector<RefPtr<ScriptProfile> > ProfilesArray;
 
-v8::Handle<v8::Value> V8Console::profilesAccessorGetter(v8::Local<v8::String>, const v8::AccessorInfo&)
+v8::Handle<v8::Value> V8Console::profilesAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Console.profilesAccessorGetter");
-    // FIXME: Provide a real implementation.
-    return v8::Array::New(0);
+    Console* imp = V8Console::toNative(info.Holder());
+    const ProfilesArray& profiles = imp->profiles();
+    v8::Handle<v8::Array> result = v8::Array::New(profiles.size());
+    int index = 0;
+    ProfilesArray::const_iterator end = profiles.end();
+    for (ProfilesArray::const_iterator iter = profiles.begin(); iter != end; ++iter)
+        result->Set(v8::Integer::New(index++), toV8(iter->get()));
+    return result;
+}
+
+v8::Handle<v8::Value> V8Console::memoryAccessorGetter(v8::Local<v8::String>, const v8::AccessorInfo&)
+{
+    INC_STATS("DOM.Console.memoryAccessorGetter");
+    return toV8(MemoryInfo::create());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomPositionCallback.cpp b/WebCore/bindings/v8/custom/V8CustomPositionCallback.cpp
index 5e20e376..18f27cb 100644
--- a/WebCore/bindings/v8/custom/V8CustomPositionCallback.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomPositionCallback.cpp
@@ -26,15 +26,16 @@
 #include "config.h"
 #include "V8CustomPositionCallback.h"
 
-#include "Frame.h"
+#include "ScriptExecutionContext.h"
 #include "V8CustomVoidCallback.h"  // For invokeCallback
 #include "V8Geoposition.h"
+#include "V8Proxy.h"
 
 namespace WebCore {
 
-V8CustomPositionCallback::V8CustomPositionCallback(v8::Local<v8::Object> callback, Frame* frame)
-    : m_callback(v8::Persistent<v8::Object>::New(callback))
-    , m_frame(frame)
+V8CustomPositionCallback::V8CustomPositionCallback(v8::Local<v8::Object> callback, ScriptExecutionContext* context)
+    : PositionCallback(context)
+    , m_callback(v8::Persistent<v8::Object>::New(callback))
 {
 }
 
@@ -47,7 +48,17 @@ void V8CustomPositionCallback::handleEvent(Geoposition* position)
 {
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> context = V8Proxy::context(m_frame.get());
+    // ActiveDOMObject will null our pointer to the ScriptExecutionContext when it goes away.
+    ScriptExecutionContext* scriptContext = scriptExecutionContext();
+    if (!scriptContext)
+        return;
+
+    // The lookup of the proxy will fail if the Frame has been detached.
+    V8Proxy* proxy = V8Proxy::retrieve(scriptContext);
+    if (!proxy)
+        return;
+
+    v8::Handle<v8::Context> context = proxy->context();
     if (context.IsEmpty())
         return;
 
@@ -57,11 +68,11 @@ void V8CustomPositionCallback::handleEvent(Geoposition* position)
         toV8(position)
     };
 
-    // Protect the frame until the callback returns.
-    RefPtr<Frame> protector(m_frame);
+    // Protect the script context until the callback returns.
+    RefPtr<ScriptExecutionContext> protector(scriptContext);
 
     bool callbackReturnValue = false;
-    invokeCallback(m_callback, 1, argv, callbackReturnValue, m_frame->document());
+    invokeCallback(m_callback, 1, argv, callbackReturnValue, scriptContext);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomPositionCallback.h b/WebCore/bindings/v8/custom/V8CustomPositionCallback.h
index d2290ee..61db922 100644
--- a/WebCore/bindings/v8/custom/V8CustomPositionCallback.h
+++ b/WebCore/bindings/v8/custom/V8CustomPositionCallback.h
@@ -27,6 +27,7 @@
 #define V8CustomPositionCallback_h
 
 #include "PositionCallback.h"
+
 #include <v8.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -35,23 +36,23 @@ namespace WebCore {
 
 class Frame;
 class Geoposition;
+class ScriptExecutionContext;
 
 class V8CustomPositionCallback : public PositionCallback {
 public:
-    static PassRefPtr<V8CustomPositionCallback> create(v8::Local<v8::Value> value, Frame* frame)
+    static PassRefPtr<V8CustomPositionCallback> create(v8::Local<v8::Value> value, ScriptExecutionContext* context)
     {
         ASSERT(value->IsObject());
-        return adoptRef(new V8CustomPositionCallback(value->ToObject(), frame));
+        return adoptRef(new V8CustomPositionCallback(value->ToObject(), context));
     }
     virtual ~V8CustomPositionCallback();
 
     virtual void handleEvent(Geoposition*);
 
 private:
-    V8CustomPositionCallback(v8::Local<v8::Object>, Frame*);
+    V8CustomPositionCallback(v8::Local<v8::Object>, ScriptExecutionContext*);
 
     v8::Persistent<v8::Object> m_callback;
-    RefPtr<Frame> m_frame;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.cpp b/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.cpp
index bd42d94..36b5e04 100644
--- a/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.cpp
@@ -26,15 +26,16 @@
 #include "config.h"
 #include "V8CustomPositionErrorCallback.h"
 
-#include "Frame.h"
+#include "ScriptExecutionContext.h"
 #include "V8CustomVoidCallback.h"  // For invokeCallback
 #include "V8PositionError.h"
+#include "V8Proxy.h"
 
 namespace WebCore {
 
-V8CustomPositionErrorCallback::V8CustomPositionErrorCallback(v8::Local<v8::Object> callback, Frame* frame)
-    : m_callback(v8::Persistent<v8::Object>::New(callback))
-    , m_frame(frame)
+V8CustomPositionErrorCallback::V8CustomPositionErrorCallback(v8::Local<v8::Object> callback, ScriptExecutionContext* context)
+    : PositionErrorCallback(context)
+    , m_callback(v8::Persistent<v8::Object>::New(callback))
 {
 }
 
@@ -47,7 +48,17 @@ void V8CustomPositionErrorCallback::handleEvent(PositionError* error)
 {
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> context = V8Proxy::context(m_frame.get());
+    // ActiveDOMObject will null our pointer to the ScriptExecutionContext when it goes away.
+    ScriptExecutionContext* scriptContext = scriptExecutionContext();
+    if (!scriptContext)
+        return;
+
+    // The lookup of the proxy will fail if the Frame has been detached.
+    V8Proxy* proxy = V8Proxy::retrieve(scriptContext);
+    if (!proxy)
+        return;
+
+    v8::Handle<v8::Context> context = proxy->context();
     if (context.IsEmpty())
         return;
 
@@ -57,11 +68,11 @@ void V8CustomPositionErrorCallback::handleEvent(PositionError* error)
         toV8(error)
     };
 
-    // Protect the frame until the callback returns.
-    RefPtr<Frame> protector(m_frame);
+    // Protect the script context until the callback returns.
+    RefPtr<ScriptExecutionContext> protector(scriptContext);
 
     bool callbackReturnValue = false;
-    invokeCallback(m_callback, 1, argv, callbackReturnValue, m_frame->document());
+    invokeCallback(m_callback, 1, argv, callbackReturnValue, scriptContext);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.h b/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.h
index aaf56a7..5211b60 100644
--- a/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.h
+++ b/WebCore/bindings/v8/custom/V8CustomPositionErrorCallback.h
@@ -27,6 +27,7 @@
 #define V8CustomPositionErrorCallback_h
 
 #include "PositionErrorCallback.h"
+
 #include <v8.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -35,23 +36,23 @@ namespace WebCore {
 
 class Frame;
 class PositionError;
+class ScriptExecutionContext;
 
 class V8CustomPositionErrorCallback : public PositionErrorCallback {
 public:
-    static PassRefPtr<V8CustomPositionErrorCallback> create(v8::Local<v8::Value> value, Frame* frame)
+    static PassRefPtr<V8CustomPositionErrorCallback> create(v8::Local<v8::Value> value, ScriptExecutionContext* context)
     {
         ASSERT(value->IsObject());
-        return adoptRef(new V8CustomPositionErrorCallback(value->ToObject(), frame));
+        return adoptRef(new V8CustomPositionErrorCallback(value->ToObject(), context));
     }
     virtual ~V8CustomPositionErrorCallback();
 
     virtual void handleEvent(PositionError*);
 
 private:
-    V8CustomPositionErrorCallback(v8::Local<v8::Object>, Frame*);
+    V8CustomPositionErrorCallback(v8::Local<v8::Object>, ScriptExecutionContext*);
 
     v8::Persistent<v8::Object> m_callback;
-    RefPtr<Frame> m_frame;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp b/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
index 3bdc79b..6603344 100644
--- a/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
@@ -39,6 +39,7 @@
 #include "V8Proxy.h"
 #include "V8SQLError.h"
 #include "V8SQLTransaction.h"
+#include <wtf/Assertions.h>
 
 namespace WebCore {
 
@@ -52,9 +53,16 @@ bool V8SQLStatementErrorCallback::handleEvent(ScriptExecutionContext* context, S
 
     v8::Context::Scope scope(v8Context);
 
+    v8::Handle<v8::Value> transactionHandle = toV8(transaction);
+    v8::Handle<v8::Value> errorHandle = toV8(error);
+    if (transactionHandle.IsEmpty() || errorHandle.IsEmpty()) {
+        CRASH();
+        return true;
+    }
+
     v8::Handle<v8::Value> argv[] = {
-        toV8(transaction),
-        toV8(error)
+        transactionHandle,
+        errorHandle
     };
 
     // Protect the context until the callback returns.
diff --git a/WebCore/bindings/v8/custom/V8CustomVoidCallback.cpp b/WebCore/bindings/v8/custom/V8CustomVoidCallback.cpp
index bc7bb6c..25e7e0d 100644
--- a/WebCore/bindings/v8/custom/V8CustomVoidCallback.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomVoidCallback.cpp
@@ -40,6 +40,7 @@ namespace WebCore {
 V8CustomVoidCallback::V8CustomVoidCallback(v8::Local<v8::Object> callback, ScriptExecutionContext *context)
     : m_callback(v8::Persistent<v8::Object>::New(callback))
     , m_scriptExecutionContext(context)
+    , m_worldContext(UseCurrentWorld)
 {
 }
 
@@ -52,7 +53,7 @@ void V8CustomVoidCallback::handleEvent()
 {
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> v8Context = toV8Context(m_scriptExecutionContext.get(), WorldContextHandle(UseCurrentWorld));
+    v8::Handle<v8::Context> v8Context = toV8Context(m_scriptExecutionContext.get(), m_worldContext);
     if (v8Context.IsEmpty())
         return;
 
diff --git a/WebCore/bindings/v8/custom/V8CustomVoidCallback.h b/WebCore/bindings/v8/custom/V8CustomVoidCallback.h
index 03a47bc..94bb782 100644
--- a/WebCore/bindings/v8/custom/V8CustomVoidCallback.h
+++ b/WebCore/bindings/v8/custom/V8CustomVoidCallback.h
@@ -32,6 +32,7 @@
 #define V8CustomVoidCallback_h
 
 #include "VoidCallback.h"
+#include "WorldContextHandle.h"
 #include <v8.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -56,6 +57,7 @@ private:
 
     v8::Persistent<v8::Object> m_callback;
     RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
+    WorldContextHandle m_worldContext;
 };
 
 // Returns false if callback failed (null, wrong type, or threw exception).
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 4867cfe..25564ee 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -72,7 +72,7 @@
 #if ENABLE(3D_CANVAS)
 #include "V8ArrayBuffer.h"
 #include "V8Int8Array.h"
-#include "V8FloatArray.h"
+#include "V8Float32Array.h"
 #include "V8Int32Array.h"
 #include "V8Int16Array.h"
 #include "V8Uint8Array.h"
@@ -308,7 +308,7 @@ v8::Handle<v8::Value> V8DOMWindow::WebGLUnsignedIntArrayAccessorGetter(v8::Local
 v8::Handle<v8::Value> V8DOMWindow::WebGLFloatArrayAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     DOMWindow* window = V8DOMWindow::toNative(info.Holder());
-    return V8DOMWrapper::getConstructor(&V8FloatArray::info, window);
+    return V8DOMWrapper::getConstructor(&V8Float32Array::info, window);
 }
 
 #endif
diff --git a/WebCore/bindings/v8/custom/V8FloatArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
index ebc65db..93c5e91 100644
--- a/WebCore/bindings/v8/custom/V8FloatArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
@@ -33,34 +33,34 @@
 #if ENABLE(3D_CANVAS)
 
 #include "ArrayBuffer.h"
-#include "FloatArray.h"
+#include "Float32Array.h"
 
 #include "V8Binding.h"
 #include "V8ArrayBuffer.h"
 #include "V8ArrayBufferViewCustom.h"
-#include "V8FloatArray.h"
+#include "V8Float32Array.h"
 #include "V8Proxy.h"
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8FloatArray::constructorCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8Float32Array::constructorCallback(const v8::Arguments& args)
 {
-    INC_STATS("DOM.FloatArray.Contructor");
+    INC_STATS("DOM.Float32Array.Contructor");
 
-    return constructWebGLArray<FloatArray, float>(args, &info, v8::kExternalFloatArray);
+    return constructWebGLArray<Float32Array, float>(args, &info, v8::kExternalFloatArray);
 }
 
-v8::Handle<v8::Value> V8FloatArray::setCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8Float32Array::setCallback(const v8::Arguments& args)
 {
-    INC_STATS("DOM.FloatArray.set()");
-    return setWebGLArrayHelper<FloatArray, V8FloatArray>(args);
+    INC_STATS("DOM.Float32Array.set()");
+    return setWebGLArrayHelper<Float32Array, V8Float32Array>(args);
 }
 
-v8::Handle<v8::Value> toV8(FloatArray* impl)
+v8::Handle<v8::Value> toV8(Float32Array* impl)
 {
     if (!impl)
         return v8::Null();
-    v8::Handle<v8::Object> wrapper = V8FloatArray::wrap(impl);
+    v8::Handle<v8::Object> wrapper = V8Float32Array::wrap(impl);
     if (!wrapper.IsEmpty())
         wrapper->SetIndexedPropertiesToExternalArrayData(impl->baseAddress(), v8::kExternalFloatArray, impl->length());
     return wrapper;
diff --git a/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp b/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp
index 7173be1..649c45f 100644
--- a/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8GeolocationCustom.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "V8Geolocation.h"
 
+#include "Frame.h"
 #include "Geolocation.h"
-
 #include "V8Binding.h"
 #include "V8CustomPositionCallback.h"
 #include "V8CustomPositionErrorCallback.h"
@@ -56,8 +56,7 @@ static PassRefPtr<PositionCallback> createPositionCallback(v8::Local<v8::Value>
         return 0;
     }
 
-    Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-    return V8CustomPositionCallback::create(value, frame);
+    return V8CustomPositionCallback::create(value, getScriptExecutionContext());
 }
 
 static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(v8::Local<v8::Value> value, bool& succeeded)
@@ -75,8 +74,7 @@ static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(v8::Local<v
         return 0;
     }
 
-    Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-    return V8CustomPositionErrorCallback::create(value, frame);
+    return V8CustomPositionErrorCallback::create(value, getScriptExecutionContext());
 }
 
 static PassRefPtr<PositionOptions> createPositionOptions(v8::Local<v8::Value> value, bool& succeeded)
diff --git a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 66e326c..d2f8c96 100644
--- a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -105,7 +105,7 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::toDataURLCallback(const v8::Arguments
     HTMLCanvasElement* canvas = V8HTMLCanvasElement::toNative(holder);
     String type = toWebCoreString(args[0]);
     ExceptionCode ec = 0;
-    String result = canvas->toDataURL(type, quality, ec);
+    String result = canvas->toDataURL(type, &quality, ec);
     V8Proxy::setDOMException(ec);
     return v8StringOrUndefined(result);
 }
diff --git a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index 86f2eb5..e6f1b8f 100644
--- a/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -49,48 +49,37 @@
 
 namespace WebCore {
 
-v8::Handle<v8::Boolean> V8HTMLDocument::namedPropertyDeleter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+v8::Local<v8::Object> V8HTMLDocument::WrapInShadowObject(v8::Local<v8::Object> wrapper, Node* impl)
 {
-    // Only handle document.all.  Insert the marker object into the
-    // shadow internal field to signal that document.all is no longer
-    // shadowed.
-    AtomicString key = v8StringToAtomicWebCoreString(name);
-    DEFINE_STATIC_LOCAL(const AtomicString, all, ("all"));
-    if (key != all)
-        return deletionNotHandledByInterceptor();
-
-    ASSERT(info.Holder()->InternalFieldCount() == V8HTMLDocument::internalFieldCount);
-    v8::Local<v8::Value> marker = info.Holder()->GetInternalField(V8HTMLDocument::markerIndex);
-    info.Holder()->SetInternalField(V8HTMLDocument::shadowIndex, marker);
-    return v8::True();
-}
-
-v8::Handle<v8::Value> V8HTMLDocument::namedPropertyGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
-{
-    INC_STATS("DOM.HTMLDocument.NamedPropertyGetter");
-    AtomicString key = v8StringToAtomicWebCoreString(name);
-
-    // Special case for document.all.  If the value in the shadow
-    // internal field is not the marker object, then document.all has
-    // been temporarily shadowed and we return the value.
-    DEFINE_STATIC_LOCAL(const AtomicString, all, ("all"));
-    if (key == all) {
-        ASSERT(info.Holder()->InternalFieldCount() == V8HTMLDocument::internalFieldCount);
-        v8::Local<v8::Value> marker = info.Holder()->GetInternalField(V8HTMLDocument::markerIndex);
-        v8::Local<v8::Value> value = info.Holder()->GetInternalField(V8HTMLDocument::shadowIndex);
-        if (marker != value)
-            return value;
+    DEFINE_STATIC_LOCAL(v8::Persistent<v8::Function>, shadowConstructor, ());
+    if (shadowConstructor.IsEmpty()) {
+        v8::Local<v8::FunctionTemplate> shadowTemplate = v8::FunctionTemplate::New();
+        if (shadowTemplate.IsEmpty())
+            return v8::Local<v8::Object>();
+        shadowTemplate->SetClassName(v8::String::New("HTMLDocument"));
+        shadowTemplate->Inherit(V8HTMLDocument::GetTemplate());
+        shadowTemplate->InstanceTemplate()->SetInternalFieldCount(V8HTMLDocument::internalFieldCount);
+        shadowConstructor = v8::Persistent<v8::Function>::New(shadowTemplate->GetFunction());
+        if (shadowConstructor.IsEmpty())
+            return v8::Local<v8::Object>();
     }
 
-    HTMLDocument* htmlDocument = V8HTMLDocument::toNative(info.Holder());
+    ASSERT(!shadowConstructor.IsEmpty());
+    v8::Local<v8::Object> shadow = shadowConstructor->NewInstance();
+    if (shadow.IsEmpty())
+        return v8::Local<v8::Object>();
+    V8DOMWrapper::setDOMWrapper(shadow, &V8HTMLDocument::info, impl);
+    shadow->SetPrototype(wrapper);
+    return shadow;
+}
 
-    // Fast case for named elements that are not there.
-    if (!htmlDocument->hasNamedItem(key.impl()) && !htmlDocument->hasExtraNamedItem(key.impl()))
-        return v8::Handle<v8::Value>();
+v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocument, const AtomicString& key)
+{
+    ASSERT(htmlDocument->hasNamedItem(key.impl()) || htmlDocument->hasExtraNamedItem(key.impl()));
 
     RefPtr<HTMLCollection> items = htmlDocument->documentNamedItems(key);
     if (!items->length())
-        return notHandledByInterceptor();
+        return v8::Handle<v8::Value>();
 
     if (items->length() == 1) {
         Node* node = items->firstItem();
@@ -104,13 +93,6 @@ v8::Handle<v8::Value> V8HTMLDocument::namedPropertyGetter(v8::Local<v8::String>
     return toV8(items.release());
 }
 
-v8::Handle<v8::Value> V8HTMLDocument::indexedPropertyGetter(uint32_t index, const v8::AccessorInfo &info) 
-{
-    INC_STATS("DOM.HTMLDocument.IndexedPropertyGetter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::NewFromUnsigned(index);
-    return namedPropertyGetter(indexV8->ToString(), info);
-}
-
 // HTMLDocument ----------------------------------------------------------------
 
 // Concatenates "args" to a string. If args is empty, returns empty string.
@@ -193,10 +175,8 @@ v8::Handle<v8::Value> V8HTMLDocument::allAccessorGetter(v8::Local<v8::String> na
 
 void V8HTMLDocument::allAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
-    INC_STATS("DOM.HTMLDocument.all._set");
-    v8::Handle<v8::Object> holder = info.Holder();
-    ASSERT(info.Holder()->InternalFieldCount() == V8HTMLDocument::internalFieldCount);
-    info.Holder()->SetInternalField(V8HTMLDocument::shadowIndex, value);
+    // Just emulate a normal JS behaviour---install a property on this.
+    info.This()->ForceSet(name, value);
 }
 
 v8::Handle<v8::Value> toV8(HTMLDocument* impl, bool forceNewObject)
@@ -210,12 +190,6 @@ v8::Handle<v8::Value> toV8(HTMLDocument* impl, bool forceNewObject)
         if (V8Proxy* proxy = V8Proxy::retrieve(impl->frame()))
             proxy->windowShell()->updateDocumentWrapper(wrapper);
     }
-    // Create marker object and insert it in two internal fields.
-    // This is used to implement temporary shadowing of document.all.
-    ASSERT(wrapper->InternalFieldCount() == V8HTMLDocument::internalFieldCount);
-    v8::Local<v8::Object> marker = v8::Object::New();
-    wrapper->SetInternalField(V8HTMLDocument::markerIndex, marker);
-    wrapper->SetInternalField(V8HTMLDocument::shadowIndex, marker);
     return wrapper;
 }
 
diff --git a/WebCore/bindings/v8/custom/V8NamedNodesCollection.cpp b/WebCore/bindings/v8/custom/V8NamedNodesCollection.cpp
index 905b23d..d9da174 100644
--- a/WebCore/bindings/v8/custom/V8NamedNodesCollection.cpp
+++ b/WebCore/bindings/v8/custom/V8NamedNodesCollection.cpp
@@ -46,7 +46,7 @@ Node* V8NamedNodesCollection::itemWithName(const AtomicString& id) const
 {
     for (unsigned i = 0; i < m_nodes.size(); ++i) {
         Node* node = m_nodes[i].get();
-        if (node->hasAttributes() && node->attributes()->id() == id)
+        if (node->hasID() && static_cast<Element*>(node)->getIdAttribute() == id)
             return node;
     }
     return 0;
diff --git a/WebCore/bindings/v8/custom/V8NodeListCustom.cpp b/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
index 20a5471..8cc3983 100644
--- a/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
@@ -45,7 +45,7 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
 {
     INC_STATS("DOM.NodeList.NamedPropertyGetter");
     NodeList* list = V8NodeList::toNative(info.Holder());
-    String key = toWebCoreString(name);
+    AtomicString key = v8ValueToAtomicWebCoreString(name);
 
     // Length property cannot be overridden.
     DEFINE_STATIC_LOCAL(const AtomicString, length, ("length"));
diff --git a/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp b/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
index 51a57c0..58f34bf 100644
--- a/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
@@ -35,8 +35,6 @@
 #include "SerializedScriptValue.h"
 #include "V8Proxy.h"
 
-#include <v8.h>
-
 namespace WebCore {
 
 v8::Handle<v8::Value> V8PopStateEvent::stateAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
diff --git a/WebCore/bindings/v8/custom/V8StorageCustom.cpp b/WebCore/bindings/v8/custom/V8StorageCustom.cpp
index 70d8a09..d0a0d92 100755
--- a/WebCore/bindings/v8/custom/V8StorageCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8StorageCustom.cpp
@@ -79,6 +79,19 @@ v8::Handle<v8::Value> V8Storage::namedPropertyGetter(v8::Local<v8::String> name,
     return storageGetter(name, info);
 }
 
+v8::Handle<v8::Integer> V8Storage::namedPropertyQuery(v8::Local<v8::String> v8Name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.Storage.NamedPropertyQuery");
+
+    Storage* storage = V8Storage::toNative(info.Holder());
+    String name = toWebCoreString(v8Name);
+
+    if (storage->contains(name) && name != "length")
+        return v8::Integer::New(v8::None);
+
+    return v8::Handle<v8::Integer>();
+}
+
 static v8::Handle<v8::Value> storageSetter(v8::Local<v8::String> v8Name, v8::Local<v8::Value> v8Value, const v8::AccessorInfo& info)
 {
     Storage* storage = V8Storage::toNative(info.Holder());
diff --git a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 7a031b1..5da4b3e 100644
--- a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -44,7 +44,7 @@
 #include "V8ArrayBufferView.h"
 #include "V8WebGLBuffer.h"
 #include "V8Int8Array.h"
-#include "V8FloatArray.h"
+#include "V8Float32Array.h"
 #include "V8WebGLFramebuffer.h"
 #include "V8Int32Array.h"
 #include "V8WebGLProgram.h"
@@ -392,21 +392,21 @@ static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments&
                                                            FunctionToCall functionToCall) {
     // Forms:
     // * glUniform1fv(WebGLUniformLocation location, Array data);
-    // * glUniform1fv(WebGLUniformLocation location, FloatArray data);
+    // * glUniform1fv(WebGLUniformLocation location, Float32Array data);
     // * glUniform2fv(WebGLUniformLocation location, Array data);
-    // * glUniform2fv(WebGLUniformLocation location, FloatArray data);
+    // * glUniform2fv(WebGLUniformLocation location, Float32Array data);
     // * glUniform3fv(WebGLUniformLocation location, Array data);
-    // * glUniform3fv(WebGLUniformLocation location, FloatArray data);
+    // * glUniform3fv(WebGLUniformLocation location, Float32Array data);
     // * glUniform4fv(WebGLUniformLocation location, Array data);
-    // * glUniform4fv(WebGLUniformLocation location, FloatArray data);
+    // * glUniform4fv(WebGLUniformLocation location, Float32Array data);
     // * glVertexAttrib1fv(GLint index, Array data);
-    // * glVertexAttrib1fv(GLint index, FloatArray data);
+    // * glVertexAttrib1fv(GLint index, Float32Array data);
     // * glVertexAttrib2fv(GLint index, Array data);
-    // * glVertexAttrib2fv(GLint index, FloatArray data);
+    // * glVertexAttrib2fv(GLint index, Float32Array data);
     // * glVertexAttrib3fv(GLint index, Array data);
-    // * glVertexAttrib3fv(GLint index, FloatArray data);
+    // * glVertexAttrib3fv(GLint index, Float32Array data);
     // * glVertexAttrib4fv(GLint index, Array data);
-    // * glVertexAttrib4fv(GLint index, FloatArray data);
+    // * glVertexAttrib4fv(GLint index, Float32Array data);
 
     if (args.Length() != 2) {
         V8Proxy::setDOMException(SYNTAX_ERR);
@@ -424,8 +424,8 @@ static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments&
 
     WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(args.Holder());
 
-    if (V8FloatArray::HasInstance(args[1])) {
-        FloatArray* array = V8FloatArray::toNative(args[1]->ToObject());
+    if (V8Float32Array::HasInstance(args[1])) {
+        Float32Array* array = V8Float32Array::toNative(args[1]->ToObject());
         ASSERT(array != NULL);
         ExceptionCode ec = 0;
         switch (functionToCall) {
@@ -592,13 +592,13 @@ static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
 {
     // Forms:
     // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix2fv(GLint location, GLboolean transpose, FloatArray data);
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Float32Array data);
     // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix3fv(GLint location, GLboolean transpose, FloatArray data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Float32Array data);
     // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
-    // * glUniformMatrix4fv(GLint location, GLboolean transpose, FloatArray data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Float32Array data);
     //
-    // FIXME: need to change to accept FloatArray as well.
+    // FIXME: need to change to accept Float32Array as well.
     if (args.Length() != 3) {
         V8Proxy::setDOMException(SYNTAX_ERR);
         return notHandledByInterceptor();
@@ -610,8 +610,8 @@ static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
     WebGLUniformLocation* location = toWebGLUniformLocation(args[0], ok);
     
     bool transpose = args[1]->BooleanValue();
-    if (V8FloatArray::HasInstance(args[2])) {
-        FloatArray* array = V8FloatArray::toNative(args[2]->ToObject());
+    if (V8Float32Array::HasInstance(args[2])) {
+        Float32Array* array = V8Float32Array::toNative(args[2]->ToObject());
         ASSERT(array != NULL);
         ExceptionCode ec = 0;
         switch (matrixSize) {