Merge WebKit at r71558: Initial merge by git.

Change-Id: Ib345578fa29df7e4bc72b4f00e4a6fddcb754c4c

39 files changed, 680 insertions, 640 deletions

diff --git a/WebCore/bindings/gobject/GObjectEventListener.cpp b/WebCore/bindings/gobject/GObjectEventListener.cpp
index 3ce8461..553d717 100644
--- a/WebCore/bindings/gobject/GObjectEventListener.cpp
+++ b/WebCore/bindings/gobject/GObjectEventListener.cpp
@@ -19,20 +19,63 @@
 #include "config.h"
 #include "GObjectEventListener.h"
 
+#include "DOMWindow.h"
 #include "Event.h"
 #include "EventListener.h"
+#include "Node.h"
 #include "webkit/WebKitDOMEvent.h"
 #include "webkit/WebKitDOMEventPrivate.h"
+#include <glib-object.h>
+#include <glib.h>
 #include <wtf/HashMap.h>
-#include <wtf/text/CString.h>
 
 namespace WebCore {
 
+GObjectEventListener::GObjectEventListener(GObject* object, DOMWindow* window, Node* node, const char* domEventName, const char* signalName)
+    : EventListener(GObjectEventListenerType)
+    , m_object(object)
+    , m_coreNode(node)
+    , m_coreWindow(window)
+    , m_domEventName(domEventName)
+    , m_signalName(signalName)
+{
+    ASSERT(!m_coreWindow || !m_coreNode);
+    if (m_coreWindow)
+        m_coreWindow->addEventListener(domEventName, this, false);
+    if (m_coreNode)
+        m_coreNode->addEventListener(domEventName, this, false);
+    g_object_weak_ref(object, reinterpret_cast<GWeakNotify>(GObjectEventListener::gobjectDestroyedCallback), this);
+}
+
+GObjectEventListener::~GObjectEventListener()
+{
+    if (!m_coreWindow && !m_coreNode)
+        return;
+    g_object_weak_unref(m_object, reinterpret_cast<GWeakNotify>(GObjectEventListener::gobjectDestroyedCallback), this);
+}
+
+void GObjectEventListener::gobjectDestroyed()
+{
+    ASSERT(!m_coreWindow || !m_coreNode);
+
+    // We must set m_coreWindow and m_coreNode to null, because removeEventListener may call the
+    // destructor as a side effect and we must be in the proper state to prevent g_object_weak_unref.
+    if (DOMWindow* window = m_coreWindow) {
+        m_coreWindow = 0;
+        window->removeEventListener(m_domEventName.data(), this, false);
+        return;
+    }
+
+    Node* node = m_coreNode;
+    m_coreNode = 0; // See above.
+    node->removeEventListener(m_domEventName.data(), this, false);
+}
+
 void GObjectEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     gboolean handled = FALSE;
     WebKitDOMEvent* gobjectEvent = WEBKIT_DOM_EVENT(WebKit::kit(event));
-    g_signal_emit_by_name(m_object, m_signalName.utf8().data(), gobjectEvent, &handled);
+    g_signal_emit_by_name(m_object, m_signalName.data(), gobjectEvent, &handled);
 }
 
 bool GObjectEventListener::operator==(const EventListener& listener)
diff --git a/WebCore/bindings/gobject/GObjectEventListener.h b/WebCore/bindings/gobject/GObjectEventListener.h
index 7ca2cc7..e5ad2e5 100644
--- a/WebCore/bindings/gobject/GObjectEventListener.h
+++ b/WebCore/bindings/gobject/GObjectEventListener.h
@@ -21,15 +21,34 @@
 
 #include "EventListener.h"
 
-#include "PlatformString.h"
-#include <glib-object.h>
-#include <glib.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/CString.h>
+
+typedef struct _GObject GObject;
 
 namespace WebCore {
+
+class DOMWindow;
+class Node;
+
 class GObjectEventListener : public EventListener {
 public:
-    static PassRefPtr<GObjectEventListener> create(GObject* object, const char* signalName) { return adoptRef(new GObjectEventListener(object, signalName)); }
+
+    static void addEventListener(GObject* object, DOMWindow* window, const char* domEventName, const char* signalName)
+    {
+        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, window, 0, domEventName, signalName)));
+    }
+
+    static void addEventListener(GObject* object, Node* node, const char* domEventName, const char* signalName)
+    {
+        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, 0, node, domEventName, signalName)));
+    }
+
+    static void gobjectDestroyedCallback(GObjectEventListener* listener, GObject*)
+    {
+        listener->gobjectDestroyed();
+    }
+
     static const GObjectEventListener* cast(const EventListener* listener)
     {
         return listener->type() == GObjectEventListenerType
@@ -40,17 +59,20 @@ public:
     virtual bool operator==(const EventListener& other);
 
 private:
-    GObjectEventListener(GObject* object, const char* signalName)
-        : EventListener(GObjectEventListenerType)
-        , m_object(object)
-        , m_signalName(signalName)
-    {
-    }
+    GObjectEventListener(GObject*, DOMWindow*, Node*, const char* domEventName, const char* signalName);
+    ~GObjectEventListener();
+    void gobjectDestroyed();
 
     virtual void handleEvent(ScriptExecutionContext*, Event*);
 
     GObject* m_object;
-    String m_signalName;
+
+    // We do not need to keep a reference to these WebCore objects, because
+    // we only use them when the GObject and thus the WebCore object is alive.
+    Node* m_coreNode;
+    DOMWindow* m_coreWindow;
+    CString m_domEventName;
+    CString m_signalName;
 };
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSArrayBufferViewHelper.h b/WebCore/bindings/js/JSArrayBufferViewHelper.h
index 27a9a98..ba712c6 100644
--- a/WebCore/bindings/js/JSArrayBufferViewHelper.h
+++ b/WebCore/bindings/js/JSArrayBufferViewHelper.h
@@ -115,6 +115,8 @@ PassRefPtr<ArrayBufferView> constructArrayBufferView(JSC::ExecState* exec)
         RefPtr<ArrayBuffer> buffer = toArrayBuffer(exec->argument(0));
         if (buffer) {
             unsigned offset = (exec->argumentCount() > 1) ? exec->argument(1).toUInt32(exec) : 0;
+            if ((buffer->byteLength() - offset) % sizeof(T))
+                throwError(exec, createRangeError(exec, "ArrayBuffer length minus the byteOffset is not a multiple of the element size."));
             unsigned int length = (buffer->byteLength() - offset) / sizeof(T);
             if (exec->argumentCount() > 2)
                 length = exec->argument(2).toUInt32(exec);
diff --git a/WebCore/bindings/js/JSBindingsAllInOne.cpp b/WebCore/bindings/js/JSBindingsAllInOne.cpp
index cf08ca9..b786431 100644
--- a/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -84,6 +84,7 @@
 #include "JSHTMLInputElementCustom.cpp"
 #include "JSHTMLObjectElementCustom.cpp"
 #include "JSHTMLOptionsCollectionCustom.cpp"
+#include "JSHTMLOutputElementCustom.cpp"
 #include "JSHTMLSelectElementCustom.cpp"
 #include "JSHistoryCustom.cpp"
 #include "JSImageConstructor.cpp"
@@ -141,8 +142,7 @@
 #include "MemoryInfo.cpp"
 #include "ScheduledAction.cpp"
 #include "ScriptCachedFrameData.cpp"
-#include "ScriptCallFrame.cpp"
-#include "ScriptCallStack.cpp"
+#include "ScriptCallStackFactory.cpp"
 #include "ScriptController.cpp"
 #include "ScriptControllerWin.cpp"
 #include "ScriptDebugServer.cpp"
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
index f39c53c..204c348 100644
--- a/WebCore/bindings/js/JSCallbackData.cpp
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -65,12 +65,14 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
     if (!context)
         return JSValue();
 
-    JSValue result = context->isDocument() 
+    bool contextIsDocument = context->isDocument();
+    JSValue result = contextIsDocument
         ? JSMainThreadExecState::call(exec, function, callType, callData, callback(), args)
         : JSC::call(exec, function, callType, callData, callback(), args);
     globalObject()->globalData().timeoutChecker.stop();
 
-    Document::updateStyleForAllDocuments();
+    if (contextIsDocument)
+        Document::updateStyleForAllDocuments();
 
     if (exec->hadException()) {
         reportCurrentException(exec);
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 532b38b..e3f5a4e 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -343,8 +343,10 @@ JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec)
     CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     JSValue value = exec->argument(0);
-    if (!value.isObject())
-        return throwTypeError(exec);
+    if (!value.isObject()) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
     JSObject* o = asObject(value);
 
     if (o->inherits(&JSHTMLImageElement::s_info)) {
diff --git a/WebCore/bindings/js/JSConsoleCustom.cpp b/WebCore/bindings/js/JSConsoleCustom.cpp
index f0419c7..6df88f6 100644
--- a/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -29,8 +29,11 @@
 
 #include "Console.h"
 #include "JSScriptProfile.h"
+#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 #include "ScriptProfile.h"
 #include <runtime/JSArray.h>
+#include <wtf/OwnPtr.h>
 
 using namespace JSC;
 
@@ -52,6 +55,28 @@ JSValue JSConsole::profiles(ExecState* exec) const
     return constructArray(exec, list);
 }
 
+JSValue JSConsole::profile(ExecState* exec)
+{
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(exec, 1));
+    const String& title = valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    impl()->profile(title, exec, callStack.release());
+    return jsUndefined();
+}
+
+JSValue JSConsole::profileEnd(ExecState* exec)
+{
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(exec, 1));
+    const String& title = valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    impl()->profileEnd(title, exec, callStack.release());
+    return jsUndefined();
+}
+
 #endif
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLOutputElementCustom.cpp b/WebCore/bindings/js/JSHTMLOutputElementCustom.cpp
new file mode 100644
index 0000000..248a08e
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLOutputElementCustom.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#include "config.h"
+#include "JSHTMLOutputElement.h"
+
+#include "HTMLOutputElement.h"
+#include "JSDOMBinding.h"
+#include "JSDOMSettableTokenList.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSHTMLOutputElement::htmlFor(ExecState* exec) const
+{
+    HTMLOutputElement* output = static_cast<HTMLOutputElement*>(impl());
+    JSValue result = toJS(exec, globalObject(), WTF::getPtr(output->htmlFor()));
+    return result;
+}
+
+void JSHTMLOutputElement::setHtmlFor(ExecState* exec, JSValue value)
+{
+    HTMLOutputElement* output = static_cast<HTMLOutputElement*>(impl());
+    output->setFor(valueToStringWithNullCheck(exec, value));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 818d549..9cf4604 100644
--- a/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -47,7 +47,6 @@
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
 #include "InspectorController.h"
-#include "InspectorResource.h"
 #include "InspectorValues.h"
 #include "JSDOMWindow.h"
 #include "JSDOMWindowCustom.h"
diff --git a/WebCore/bindings/js/JSSVGLengthCustom.cpp b/WebCore/bindings/js/JSSVGLengthCustom.cpp
index 0cc7c6d..9a9138c 100644
--- a/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -22,22 +22,64 @@
 #if ENABLE(SVG)
 #include "JSSVGLength.h"
 
+#include <runtime/Error.h>
 #include "SVGAnimatedProperty.h"
+#include "SVGException.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSSVGLength::value(ExecState*) const
+JSValue JSSVGLength::value(ExecState* exec) const
 {
     SVGLength& podImp = impl()->propertyReference();
-    return jsNumber(podImp.value(impl()->contextElement()));
+    ExceptionCode ec = 0;
+    float value = podImp.value(impl()->contextElement(), ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+
+    return jsNumber(value);
+}
+
+void JSSVGLength::setValue(ExecState* exec, JSValue value)
+{
+    if (!value.isUndefinedOrNull() && !value.isNumber() && !value.isBoolean()) {
+        throwVMTypeError(exec);
+        return;
+    }
+
+    SVGLength& podImp = impl()->propertyReference();
+
+    ExceptionCode ec = 0;
+    podImp.setValue(value.toFloat(exec), impl()->contextElement(), ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return;
+    }
+
+    impl()->commitChange();
 }
 
 JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec)
 {
     SVGLength& podImp = impl()->propertyReference();
-    podImp.convertToSpecifiedUnits(exec->argument(0).toInt32(exec), impl()->contextElement());
+
+    // Mimic the behaviour of RequiresAllArguments=Raise.
+    if (exec->argumentCount() < 1)
+        return throwError(exec, createSyntaxError(exec, "Not enough arguments"));
+
+    unsigned short unitType = exec->argument(0).toUInt32(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    podImp.convertToSpecifiedUnits(unitType, impl()->contextElement(), ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
 
     impl()->commitChange();
     return jsUndefined();
diff --git a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
index 643ce64..e414278 100644
--- a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -171,15 +171,15 @@ JSValue JSWebGLRenderingContext::getAttachedShaders(ExecState* exec)
         return throwTypeError(exec);
     WebGLProgram* program = toWebGLProgram(exec->argument(0));
     if (exec->hadException())
-        return jsUndefined();
+        return jsNull();
     Vector<WebGLShader*> shaders;
     bool succeed = context->getAttachedShaders(program, shaders, ec);
     if (ec) {
         setDOMException(exec, ec);
-        return jsUndefined();
+        return jsNull();
     }
     if (!succeed)
-        return jsUndefined();
+        return jsNull();
     MarkedArgumentBuffer list;
     for (size_t ii = 0; ii < shaders.size(); ++ii)
         list.append(toJS(exec, globalObject(), shaders[ii]));
diff --git a/WebCore/bindings/js/ScriptCallStack.h b/WebCore/bindings/js/ScriptCallStack.h
deleted file mode 100644
index 17d1c46..0000000
--- a/WebCore/bindings/js/ScriptCallStack.h
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (c) 2008, Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ScriptCallStack_h
-#define ScriptCallStack_h
-
-#include "ScriptCallFrame.h"
-#include "ScriptState.h"
-#include <wtf/Noncopyable.h>
-#include <wtf/RefPtr.h>
-
-namespace JSC {
-    class ExecState;
-    class JSValue;
-}
-
-namespace WebCore {
-
-    class InspectorArray;
-
-    class ScriptCallStack : public Noncopyable {
-    public:
-        ScriptCallStack(JSC::ExecState*, unsigned skipArgumentCount = 0);
-        ~ScriptCallStack();
-
-        ScriptState* state() const { return m_exec; }
-        ScriptState* globalState() const { return m_exec->lexicalGlobalObject()->globalExec(); }
-        // frame retrieval methods
-        const ScriptCallFrame &at(unsigned);
-        unsigned size();
-        static bool stackTrace(int, const RefPtr<InspectorArray>&);
-
-    private:
-        void initialize();
-        bool m_initialized;
-
-        JSC::ExecState* m_exec;
-        Vector<ScriptCallFrame> m_frames;
-        JSC::JSFunction* m_caller;
-    };
-
-} // namespace WebCore
-
-#endif // ScriptCallStack_h
diff --git a/WebCore/bindings/js/ScriptCallStack.cpp b/WebCore/bindings/js/ScriptCallStackFactory.cpp
index de61b07..25fabdd 100644
--- a/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/WebCore/bindings/js/ScriptCallStackFactory.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,85 +29,62 @@
  */
 
 #include "config.h"
-#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 
+#include "JSDOMBinding.h"
+#include "ScriptArguments.h"
+#include "ScriptCallFrame.h"
+#include "ScriptCallStack.h"
+#include "ScriptValue.h"
 #include <interpreter/CallFrame.h>
 #include <interpreter/Interpreter.h>
+#include <runtime/ArgList.h>
 #include <runtime/JSFunction.h>
+#include <runtime/JSGlobalData.h>
 #include <runtime/JSValue.h>
 #include <runtime/UString.h>
-#include <runtime/JSGlobalData.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ScriptCallStack::ScriptCallStack(ExecState* exec, unsigned skipArgumentCount)
-    : m_initialized(false)
-    , m_exec(exec)
-    , m_caller(0)
-{
-    int signedLineNumber;
-    intptr_t sourceID;
-    UString urlString;
-    JSValue function;
-
-    exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
-
-    unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-
-    if (function) {
-        m_caller = asFunction(function);
-        m_frames.append(ScriptCallFrame(m_caller->name(m_exec), urlString, lineNumber, m_exec, skipArgumentCount));
-    } else {
-        // Caller is unknown, but we should still add the frame, because
-        // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), urlString, lineNumber, m_exec, skipArgumentCount));
-    }
-}
-
-ScriptCallStack::~ScriptCallStack()
-{
-}
-
-const ScriptCallFrame &ScriptCallStack::at(unsigned index)
+PassOwnPtr<ScriptCallStack> createScriptCallStack(JSC::ExecState* exec, size_t maxStackSize)
 {
-    // First frame is pre-populated in constructor, so don't trigger
-    // initialization unless looking beyond the first frame.
-    if (index > 0)
-        initialize();
-    ASSERT(m_frames.size() > index);
-    return m_frames[index];
-}
-
-unsigned ScriptCallStack::size()
-{
-    initialize();
-    return m_frames.size();
-}
-
-void ScriptCallStack::initialize()
-{
-    if (!m_caller || m_initialized)
-        return;
-
-    int signedLineNumber;
-    intptr_t sourceID;
-    UString urlString;
-    JSValue function;
-    // callFrame must exist if m_caller is not null.
-    CallFrame* callFrame = m_exec->callerFrame();
+    Vector<ScriptCallFrame> frames;
+    CallFrame* callFrame = exec;
     while (true) {
         ASSERT(callFrame);
-        m_exec->interpreter()->retrieveLastCaller(callFrame, signedLineNumber, sourceID, urlString, function);
-        if (!function)
-            break;
-        JSFunction* jsFunction = asFunction(function);
+        int signedLineNumber;
+        intptr_t sourceID;
+        UString urlString;
+        JSValue function;
+
+        exec->interpreter()->retrieveLastCaller(callFrame, signedLineNumber, sourceID, urlString, function);
+        UString functionName;
+        if (function)
+            functionName = asFunction(function)->name(exec);
+        else {
+            // Caller is unknown, but if frames is empty we should still add the frame, because
+            // something called us, and gave us arguments.
+            if (!frames.isEmpty())
+                break;
+        }
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(jsFunction->name(m_exec), urlString, lineNumber, m_exec, 0));
+        frames.append(ScriptCallFrame(ustringToString(functionName), ustringToString(urlString), lineNumber));
+        if (!function || frames.size() == maxStackSize)
+            break;
         callFrame = callFrame->callerFrame();
     }
-    m_initialized = true;
+    return new ScriptCallStack(frames);
+}
+
+PassOwnPtr<ScriptArguments> createScriptArguments(JSC::ExecState* exec, unsigned skipArgumentCount)
+{
+    Vector<ScriptValue> arguments;
+    size_t argumentCount = exec->argumentCount();
+    for (size_t i = skipArgumentCount; i < argumentCount; ++i)
+        arguments.append(ScriptValue(exec->argument(i)));
+    return new ScriptArguments(exec, arguments);
 }
 
 bool ScriptCallStack::stackTrace(int, const RefPtr<InspectorArray>&)
diff --git a/WebCore/bindings/js/ScriptCallFrame.h b/WebCore/bindings/js/ScriptCallStackFactory.h
index 31aec7e..744d88d 100644
--- a/WebCore/bindings/js/ScriptCallFrame.h
+++ b/WebCore/bindings/js/ScriptCallStackFactory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,41 +28,23 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptCallFrame_h
-#define ScriptCallFrame_h
+#ifndef ScriptCallStackFactory_h
+#define ScriptCallStackFactory_h
 
-#include "PlatformString.h"
-#include "ScriptValue.h"
-#include <wtf/Vector.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace JSC {
 class ExecState;
-class UString;
 }
 
 namespace WebCore {
 
-class ScriptCallFrame  {
-public:
-    ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, unsigned skipArgumentCount);
-    ~ScriptCallFrame();
+class ScriptArguments;
+class ScriptCallStack;
 
-    const String& functionName() const { return m_functionName; }
-    const String& sourceURL() const { return m_sourceURL; }
-    unsigned lineNumber() const { return m_lineNumber; }
-
-    // argument retrieval methods
-    const ScriptValue& argumentAt(unsigned) const;
-    unsigned argumentCount() const { return m_arguments.size(); }
-
-private:
-    String m_functionName;
-    String m_sourceURL;
-    unsigned m_lineNumber;
-
-    Vector<ScriptValue> m_arguments;
-};
+PassOwnPtr<ScriptCallStack> createScriptCallStack(JSC::ExecState*, size_t maxStackSize);
+PassOwnPtr<ScriptArguments> createScriptArguments(JSC::ExecState*, unsigned skipArgumentCount);
 
 } // namespace WebCore
 
-#endif // ScriptCallFrame_h
+#endif // ScriptCallStackFactory_h
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index e03c822..cf55080 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -197,6 +197,11 @@ void ScriptController::clearWindowShell(bool goingIntoPageCache)
         windowShell->window()->willRemoveFromWindowShell();
         windowShell->setWindow(m_frame->domWindow());
 
+        // An m_cacheableBindingRootObject persists between page navigations
+        // so needs to know about the new JSDOMWindow.
+        if (m_cacheableBindingRootObject)
+            m_cacheableBindingRootObject->updateGlobalObject(windowShell->window());
+
         if (Page* page = m_frame->page()) {
             attachDebugger(windowShell, page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
diff --git a/WebCore/bindings/js/ScriptState.cpp b/WebCore/bindings/js/ScriptState.cpp
index 3edd1bd..d6699f6 100644
--- a/WebCore/bindings/js/ScriptState.cpp
+++ b/WebCore/bindings/js/ScriptState.cpp
@@ -35,9 +35,28 @@
 #include "JSDOMWindowBase.h"
 #include "Node.h"
 #include "Page.h"
+#include <interpreter/CallFrame.h>
+#include <runtime/JSGlobalObject.h>
 
 namespace WebCore {
 
+ScriptStateProtectedPtr::~ScriptStateProtectedPtr()
+{
+}
+
+ScriptStateProtectedPtr::ScriptStateProtectedPtr(ScriptState* scriptState)
+    : m_globalObject(scriptState->lexicalGlobalObject())
+{
+}
+
+ScriptState* ScriptStateProtectedPtr::get() const
+{
+    if (m_globalObject)
+        return m_globalObject->globalExec();
+    return 0;
+}
+
+
 ScriptState* mainWorldScriptState(Frame* frame)
 {
     JSDOMWindowShell* shell = frame->script()->windowShell(mainThreadNormalWorld());
diff --git a/WebCore/bindings/js/ScriptState.h b/WebCore/bindings/js/ScriptState.h
index 6bef4f7..0c08611 100644
--- a/WebCore/bindings/js/ScriptState.h
+++ b/WebCore/bindings/js/ScriptState.h
@@ -32,10 +32,14 @@
 #ifndef ScriptState_h
 #define ScriptState_h
 
-#include "JSDOMBinding.h"
 #include <runtime/Protect.h>
 #include <wtf/Noncopyable.h>
 
+namespace JSC {
+class ExecState;
+class JSGlobalObject;
+}
+
 namespace WebCore {
 class DOMWrapperWorld;
 class Frame;
@@ -50,14 +54,9 @@ typedef JSC::ExecState ScriptState;
 
 class ScriptStateProtectedPtr : public Noncopyable {
 public:
-    ScriptStateProtectedPtr() { }
-    ScriptStateProtectedPtr(ScriptState* scriptState) : m_globalObject(scriptState->lexicalGlobalObject()) { }
-    ScriptState* get()
-    {
-        if (m_globalObject)
-            return m_globalObject->globalExec();
-        return 0;
-    }
+    explicit ScriptStateProtectedPtr(ScriptState*);
+    ~ScriptStateProtectedPtr();
+    ScriptState* get() const;
 private:
     JSC::ProtectedPtr<JSC::JSGlobalObject> m_globalObject;
 };
diff --git a/WebCore/bindings/objc/DOMSVG.h b/WebCore/bindings/objc/DOMSVG.h
index eda705e..1fdab9a 100644
--- a/WebCore/bindings/objc/DOMSVG.h
+++ b/WebCore/bindings/objc/DOMSVG.h
@@ -39,7 +39,6 @@
 #import <WebCore/DOMSVGAnimatedNumber.h>
 #import <WebCore/DOMSVGAnimatedNumberList.h>
 #import <WebCore/DOMSVGAnimatedPathData.h>
-#import <WebCore/DOMSVGAnimatedPoints.h>
 #import <WebCore/DOMSVGAnimatedPreserveAspectRatio.h>
 #import <WebCore/DOMSVGAnimatedRect.h>
 #import <WebCore/DOMSVGAnimatedString.h>
diff --git a/WebCore/bindings/scripts/CodeGenerator.pm b/WebCore/bindings/scripts/CodeGenerator.pm
index c4f87f0..d439c19 100644
--- a/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/WebCore/bindings/scripts/CodeGenerator.pm
@@ -50,8 +50,8 @@ my %numericTypeHash = ("int" => 1, "short" => 1, "long" => 1, "long long" => 1,
 
 my %primitiveTypeHash = ( "boolean" => 1, "void" => 1, "Date" => 1);
 
-my %podTypeHash = ("SVGNumber" => 1, "SVGTransform" => 1);
-my %podTypesWithWritablePropertiesHash = ("SVGMatrix" => 1, "SVGPoint" => 1, "SVGPreserveAspectRatio" => 1);
+my %podTypeHash = ("SVGTransform" => 1);
+my %podTypesWithWritablePropertiesHash = ("SVGMatrix" => 1);
 my %stringTypeHash = ("DOMString" => 1, "AtomicString" => 1);
 
 my %nonPointerTypeHash = ("DOMTimeStamp" => 1, "CompareHow" => 1, "SVGPaintType" => 1);
@@ -59,7 +59,9 @@ my %nonPointerTypeHash = ("DOMTimeStamp" => 1, "CompareHow" => 1, "SVGPaintType"
 my %svgNewStyleAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                                    "SVGAnimatedEnumeration" => 1, "SVGAnimatedInteger" => 1,
                                    "SVGAnimatedLength" => 1, "SVGAnimatedLengthList" => 1,
-                                   "SVGAnimatedRect" => 1);
+                                   "SVGAnimatedNumber" => 1, "SVGAnimatedNumberList" => 1,
+                                   "SVGAnimatedPreserveAspectRatio" => 1, "SVGAnimatedRect" => 1,
+                                   "SVGAnimatedString" => 1);
 
 my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedEnumeration" => 1, "SVGAnimatedInteger" => 1,
@@ -75,11 +77,21 @@ my %svgAttributesInHTMLHash = ("class" => 1, "id" => 1, "onabort" => 1, "onclick
                                "onmouseup" => 1, "onresize" => 1, "onscroll" => 1,
                                "onunload" => 1);
 
-my %svgNativeType = (
+my %svgTypeNeedingTearOff = (
     "SVGAngle" => "SVGPropertyTearOff<SVGAngle>",
     "SVGLength" => "SVGPropertyTearOff<SVGLength>",
     "SVGLengthList" => "SVGListPropertyTearOff<SVGLengthList>",
-    "SVGRect" => "SVGPropertyTearOff<FloatRect>"
+    "SVGNumber" => "SVGPropertyTearOff<float>",
+    "SVGNumberList" => "SVGListPropertyTearOff<SVGNumberList>",
+    "SVGPoint" => "SVGPropertyTearOff<FloatPoint>",
+    "SVGPointList" => "SVGListPropertyTearOff<SVGPointList>",
+    "SVGPreserveAspectRatio" => "SVGPropertyTearOff<SVGPreserveAspectRatio>",
+    "SVGRect" => "SVGPropertyTearOff<FloatRect>",
+    "SVGStringList" => "SVGStaticListPropertyTearOff<SVGStringList>"
+);
+
+my %svgTypeWithWritablePropertiesNeedingTearOff = (
+    "SVGPoint" => 1
 );
 
 # Cache of IDL file pathnames.
@@ -367,7 +379,16 @@ sub IsSVGTypeNeedingTearOff
     my $object = shift;
     my $type = shift;
 
-    return 1 if exists $svgNativeType{$type};
+    return 1 if exists $svgTypeNeedingTearOff{$type};
+    return 0;
+}
+
+sub IsSVGTypeWithWritablePropertiesNeedingTearOff
+{
+    my $object = shift;
+    my $type = shift;
+
+    return 1 if $svgTypeWithWritablePropertiesNeedingTearOff{$type};
     return 0;
 }
 
@@ -376,7 +397,7 @@ sub GetSVGTypeNeedingTearOff
     my $object = shift;
     my $type = shift;
 
-    return $svgNativeType{$type} if exists $svgNativeType{$type};
+    return $svgTypeNeedingTearOff{$type} if exists $svgTypeNeedingTearOff{$type};
     return undef;
 }
 
@@ -385,16 +406,19 @@ sub GetSVGWrappedTypeNeedingTearOff
     my $object = shift;
     my $type = shift;
 
-    my $svgNativeType = $object->GetSVGTypeNeedingTearOff($type);
-    return $svgNativeType if not $svgNativeType;
+    my $svgTypeNeedingTearOff = $object->GetSVGTypeNeedingTearOff($type);
+    return $svgTypeNeedingTearOff if not $svgTypeNeedingTearOff;
 
-    if ($svgNativeType =~ /SVGPropertyTearOff/) {
-        $svgNativeType =~ s/SVGPropertyTearOff<//;
-    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/) {
-        $svgNativeType =~ s/SVGListPropertyTearOff<//;
+    if ($svgTypeNeedingTearOff =~ /SVGPropertyTearOff/) {
+        $svgTypeNeedingTearOff =~ s/SVGPropertyTearOff<//;
+    } elsif ($svgTypeNeedingTearOff =~ /SVGListPropertyTearOff/) {
+        $svgTypeNeedingTearOff =~ s/SVGListPropertyTearOff<//;
+    } elsif ($svgTypeNeedingTearOff =~ /SVGStaticListPropertyTearOff/) {
+        $svgTypeNeedingTearOff =~ s/SVGStaticListPropertyTearOff<//;
     }
-    $svgNativeType =~ s/>//;
-    return $svgNativeType;
+
+    $svgTypeNeedingTearOff =~ s/>//;
+    return $svgTypeNeedingTearOff;
 }
 
 # FIXME: This method will go away once all SVG animated properties are converted to the new scheme.
@@ -476,13 +500,18 @@ sub AttributeNameForGetterAndSetter
     my ($generator, $attribute) = @_;
 
     my $attributeName = $attribute->signature->name;
+    my $attributeType = $generator->StripModule($attribute->signature->type);
 
     # Avoid clash with C++ keyword.
     $attributeName = "_operator" if $attributeName eq "operator";
 
+    # SVGAElement defines a non-virtual "String& target() const" method which clashes with "virtual String target() const" in Element.
+    # To solve this issue the SVGAElement method was renamed to "svgTarget", take care of that when calling this method.
+    $attributeName = "svgTarget" if $attributeName eq "target" and $attributeType eq "SVGAnimatedString";
+
     # SVG animated types need to use a special attribute name.
     # The rest of the special casing for SVG animated types is handled in the language-specific code generators.
-    $attributeName .= "Animated" if $generator->IsSVGAnimatedType($generator->StripModule($attribute->signature->type));
+    $attributeName .= "Animated" if $generator->IsSVGAnimatedType($attributeType);
 
     return $attributeName;
 }
diff --git a/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index dd9e3c7..6c450ad 100644
--- a/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -501,8 +501,7 @@ EOF
     my ${listenerName} = $name . "Listener";
 
     my $txtInstallEventListener = << "EOF";
-    RefPtr<WebCore::GObjectEventListener> ${listenerName} = WebCore::GObjectEventListener::create(reinterpret_cast<GObject*>(object), "${gobjectSignalName}");
-    coreObject->addEventListener("${name}", ${listenerName}, false);
+    WebCore::GObjectEventListener::addEventListener(object, coreObject, "${name}", "${gobjectSignalName}");
 EOF
     push(@txtInstallEventListeners, $txtInstallEventListener);
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 9244bc6..b18e57e 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1983,8 +1983,12 @@ sub GenerateImplementation
                     my $hasOptionalArguments = 0;
 
                     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
-                        push(@implContent, "    ScriptCallStack callStack(exec, $numParameters);\n");
+                        push(@implContent, "    OwnPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, $numParameters));\n");
+                        push(@implContent, "    size_t maxStackSize = imp->shouldCaptureFullStackTrace() ? ScriptCallStack::maxCallStackSizeToCapture : 1;\n");
+                        push(@implContent, "    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(exec, maxStackSize));\n");
+                        $implIncludes{"ScriptArguments.h"} = 1;
                         $implIncludes{"ScriptCallStack.h"} = 1;
+                        $implIncludes{"ScriptCallStackFactory.h"} = 1;
                     }
 
                     my $callWith = $function->signature->extendedAttributes->{"CallWith"};
@@ -2389,8 +2393,8 @@ sub GenerateImplementationFunctionCall()
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         $functionString .= ", " if $paramIndex;
-        ++$paramIndex;
-        $functionString .= "&callStack";
+        $paramIndex += 2;
+        $functionString .= "scriptArguments.release(), callStack.release()";
     }
 
     if (@{$function->raisesExceptions}) {
@@ -2455,11 +2459,7 @@ my %nativeType = (
     "SerializedScriptValue" => "RefPtr<SerializedScriptValue>",
     "IDBKey" => "RefPtr<IDBKey>",
     "SVGMatrix" => "AffineTransform",
-    "SVGNumber" => "float",
     "SVGPaintType" => "SVGPaint::SVGPaintType",
-    "SVGPreserveAspectRatio" => "SVGPreserveAspectRatio",
-    "SVGPoint" => "FloatPoint",
-    "SVGRect" => "FloatRect",
     "SVGTransform" => "SVGTransform",
     "boolean" => "bool",
     "double" => "double",
@@ -2504,7 +2504,7 @@ sub GetSVGPropertyTypes
         $svgPropertyType = $svgWrappedNativeType;
         $headerIncludes{"$svgWrappedNativeType.h"} = 1;
         $headerIncludes{"SVGAnimatedPropertyTearOff.h"} = 1;
-    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/) {
+    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/ or $svgNativeType =~ /SVGStaticListPropertyTearOff/) {
         $svgListPropertyType = $svgWrappedNativeType;
         $headerIncludes{"$svgWrappedNativeType.h"} = 1;
         $headerIncludes{"SVGAnimatedListPropertyTearOff.h"} = 1;
@@ -2528,7 +2528,7 @@ sub JSValueToNative
 
     return "$value.toBoolean(exec)" if $type eq "boolean";
     return "$value.toNumber(exec)" if $type eq "double";
-    return "$value.toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
+    return "$value.toFloat(exec)" if $type eq "float";
     return "$value.toInt32(exec)" if $type eq "long";
     return "$value.toUInt32(exec)" if $type eq "unsigned long" or $type eq "unsigned short";
     return "static_cast<$type>($value.toInteger(exec))" if $type eq "long long" or $type eq "unsigned long long";
@@ -2558,8 +2558,6 @@ sub JSValueToNative
         return "createIDBKeyFromValue(exec, $value)";
     }
 
-    $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
-    $implIncludes{"FloatRect.h"} = 1 if $type eq "SVGRect";
     $implIncludes{"HTMLOptionElement.h"} = 1 if $type eq "HTMLOptionElement";
     $implIncludes{"JSCustomVoidCallback.h"} = 1 if $type eq "VoidCallback";
     $implIncludes{"Event.h"} = 1 if $type eq "Event";
@@ -2681,7 +2679,22 @@ sub NativeToJSValue
         # Convert from abstract SVGProperty to real type, so the right toJS() method can be invoked.
         $value = "static_cast<" . GetNativeType($type) . ">($value)";
     } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $implClassName =~ /List$/) {
-        $value = $codeGenerator->GetSVGTypeNeedingTearOff($type) . "::create($value)";
+        my $tearOffType = $codeGenerator->GetSVGTypeNeedingTearOff($type);
+        if ($codeGenerator->IsSVGTypeWithWritablePropertiesNeedingTearOff($type) and $inFunctionCall eq 0 and not defined $signature->extendedAttributes->{"Immutable"}) {
+            $tearOffType =~ s/SVGPropertyTearOff</SVGStaticPropertyTearOff<$implClassName, /;
+            $implIncludes{"SVGStaticPropertyTearOff.h"} = 1;
+
+            my $getter = $value;
+            $getter =~ s/imp->//;
+            $getter =~ s/\(\)//;
+            my $updater = "update" . $codeGenerator->WK_ucfirst($getter);
+            $value = "${tearOffType}::create(imp, $value, &${implClassName}::$updater)";
+        } elsif ($tearOffType =~ /SVGStaticListPropertyTearOff/) {
+            my $extraImp = "GetOwnerElementForType<$implClassName, IsDerivedFromSVGElement<$implClassName>::value>::ownerElement(imp), ";
+            $value = "${tearOffType}::create($extraImp$value)";
+        } elsif (not $tearOffType =~ /SVGPointList/) {
+            $value = "${tearOffType}::create($value)";
+        }
     }
 
     return "toJS(exec, $globalObject, WTF::getPtr($value))";
diff --git a/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 8351c87..69e24a9 100644
--- a/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -1,4 +1,4 @@
-#
+# 
 # Copyright (C) 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
 # Copyright (C) 2006 Anders Carlsson <andersca@mac.com> 
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
@@ -59,8 +59,7 @@ my @depsContent = ();
 my %protocolTypeHash = ("XPathNSResolver" => 1, "EventListener" => 1, "EventTarget" => 1, "NodeFilter" => 1,
                         "SVGLocatable" => 1, "SVGTransformable" => 1, "SVGStylable" => 1, "SVGFilterPrimitiveStandardAttributes" => 1, 
                         "SVGTests" => 1, "SVGLangSpace" => 1, "SVGExternalResourcesRequired" => 1, "SVGURIReference" => 1,
-                        "SVGZoomAndPan" => 1, "SVGFitToViewBox" => 1, "SVGAnimatedPathData" => 1, "SVGAnimatedPoints" => 1,
-                        "ElementTimeControl" => 1);
+                        "SVGZoomAndPan" => 1, "SVGFitToViewBox" => 1, "SVGAnimatedPathData" => 1, "ElementTimeControl" => 1);
 my %nativeObjCTypeHash = ("URL" => 1, "Color" => 1);
 
 # FIXME: this should be replaced with a function that recurses up the tree
@@ -71,7 +70,7 @@ my %baseTypeHash = ("Object" => 1, "Node" => 1, "NodeList" => 1, "NamedNodeMap"
                     "NodeIterator" => 1, "TreeWalker" => 1, "AbstractView" => 1, "Blob" => 1,
                     "SVGAngle" => 1, "SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1, "SVGAnimatedEnumeration" => 1,
                     "SVGAnimatedInteger" => 1, "SVGAnimatedLength" => 1, "SVGAnimatedLengthList" => 1,
-                    "SVGAnimatedNumber" => 1, "SVGAnimatedNumberList" => 1, "SVGAnimatedPoints" => 1,
+                    "SVGAnimatedNumber" => 1, "SVGAnimatedNumberList" => 1,
                     "SVGAnimatedPreserveAspectRatio" => 1, "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                     "SVGAnimatedTransformList" => 1, "SVGLength" => 1, "SVGLengthList" => 1, "SVGMatrix" => 1,
                     "SVGNumber" => 1, "SVGNumberList" => 1, "SVGPathSeg" => 1, "SVGPathSegList" => 1, "SVGPoint" => 1,
@@ -600,12 +599,6 @@ sub AddIncludesForType
         return;
     }
 
-    if ($type eq "SVGPoint") {
-        $implIncludes{"FloatPoint.h"} = 1;
-        $implIncludes{"DOMSVGPointInternal.h"} = 1;
-        return;
-    }
-
     if ($type eq "SVGMatrix") {
         $implIncludes{"AffineTransform.h"} = 1;
         $implIncludes{"DOMSVGMatrixInternal.h"} = 1;
@@ -613,11 +606,6 @@ sub AddIncludesForType
         return;
     }
 
-    if ($type eq "SVGNumber") {
-        $implIncludes{"DOMSVGNumberInternal.h"} = 1;
-        return;
-    }
-
     if ($type =~ /(\w+)(Abs|Rel)$/) {
         $implIncludes{"$1.h"} = 1;
         $implIncludes{"DOM${type}Internal.h"} = 1;
@@ -656,6 +644,16 @@ sub AddIncludesForType
     $implIncludes{"DOM${type}Internal.h"} = 1;
 }
 
+sub GetSVGTypeWithNamespace
+{
+    my $type = shift;
+    my $typeWithNamespace = "WebCore::" . $codeGenerator->GetSVGTypeNeedingTearOff($type);
+
+    # Special case for DOMSVGNumber
+    $typeWithNamespace =~ s/</\<WebCore::/ unless $type eq "SVGNumber";
+    return $typeWithNamespace;
+}
+
 sub GetSVGPropertyTypes
 {
     my $implType = shift;
@@ -671,13 +669,18 @@ sub GetSVGPropertyTypes
 
     # Append space to avoid compilation errors when using  PassRefPtr<$svgNativeType>
     $svgNativeType = "WebCore::$svgNativeType ";
-    $svgNativeType =~ s/</\<WebCore::/;
+    $svgNativeType =~ s/</\<WebCore::/ if not $svgNativeType =~ /float/;
 
     my $svgWrappedNativeType = $codeGenerator->GetSVGWrappedTypeNeedingTearOff($implType);
     if ($svgNativeType =~ /SVGPropertyTearOff/) {
-        $svgPropertyType = "WebCore::$svgWrappedNativeType";
-        $svgPropertyType =~ s/</\<WebCore::/;
-    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/) {
+        if ($svgWrappedNativeType eq "float") {
+            # Special case for DOMSVGNumber
+            $svgPropertyType = $svgWrappedNativeType;
+        } else {
+            $svgPropertyType = "WebCore::$svgWrappedNativeType";
+            $svgPropertyType =~ s/</\<WebCore::/;
+        }
+    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/ or $svgNativeType =~ /SVGStaticListPropertyTearOff/) {
         $svgListPropertyType = "WebCore::$svgWrappedNativeType";
         $svgListPropertyType =~ s/</\<WebCore::/;
     }
@@ -1127,7 +1130,12 @@ sub GenerateImplementation
         $implIncludes{"$1.h"} = 1;
     } else {
         if (!$podType) {
-            $implIncludes{"$implClassName.h"} = 1 if not $codeGenerator->AvoidInclusionOfType($implClassName);
+            if (!$codeGenerator->AvoidInclusionOfType($implClassName)) {
+                $implIncludes{"$implClassName.h"} = 1 ;
+            } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($implClassName)) {
+                my $includeType = $codeGenerator->GetSVGWrappedTypeNeedingTearOff($implClassName);
+                $implIncludes{"${includeType}.h"} = 1;
+            }
         } else {
             $implIncludes{"$podType.h"} = 1 unless $podType eq "float";
         }
@@ -1236,13 +1244,7 @@ sub GenerateImplementation
 
                 # TODO: Handle special case for DOMSVGLength. We do need Custom code support for this.
                 if ($svgPropertyType eq "WebCore::SVGLength" and $attributeName eq "value") {
-                    $getterContentHead = "value(0 /* FIXME */";
-                }
-            } else {
-                # Special case for DOMSVGNumber
-                if ($podType and $podType eq "float") {
-                    $getterContentHead = "*IMPL";
-                    $getterContentTail = "";
+                    $getterContentHead = "value(IMPL->contextElement(), ";
                 }
             }
 
@@ -1287,10 +1289,15 @@ sub GenerateImplementation
                 $getterContentHead = "kit($getterContentHead";
                 $getterContentTail .= ")";
             } elsif ($svgPropertyType) {
-                $getterContentHead = "IMPL->propertyReference().$getterContentHead";
+                # Special case for DOMSVGNumber
+                if ($svgPropertyType eq "float") {
+                    # Intentional leave out closing brace, it's already contained in getterContentTail
+                    $getterContentHead = "IMPL->propertyReference(";
+                } else {    
+                    $getterContentHead = "IMPL->propertyReference().$getterContentHead";
+                }
             } elsif ($codeGenerator->IsSVGNewStyleAnimatedType($implClassName) and $codeGenerator->IsSVGTypeNeedingTearOff($idlType)) {
-                my $idlTypeWithNamespace = "WebCore::" . $codeGenerator->GetSVGTypeNeedingTearOff($idlType);
-                $idlTypeWithNamespace =~ s/</\<WebCore::/;
+                my $idlTypeWithNamespace = GetSVGTypeWithNamespace($idlType);
                 $getterContentHead = "kit(static_cast<$idlTypeWithNamespace*>($getterContentHead)";
                 $getterContentTail .= ")";
             } elsif (IsProtocolType($idlType) and $idlType ne "EventTarget") {
@@ -1303,12 +1310,30 @@ sub GenerateImplementation
                 $getterContentHead = "$getterContentHead";
                 $getterContentTail .= "->toString()";                
             } elsif (ConversionNeeded($attribute->signature->type)) {
-                if ($codeGenerator->IsSVGTypeNeedingTearOff($attribute->signature->type) and not $implClassName =~ /List$/) {
-                    my $idlType = $attribute->signature->type;
-                    my $idlTypeWithNamespace = "WebCore::" . $codeGenerator->GetSVGTypeNeedingTearOff($idlType);
-                    $idlTypeWithNamespace =~ s/</\<WebCore::/;
-                    $getterContentHead = "kit(WTF::getPtr(${idlTypeWithNamespace}::create($getterContentHead";
-                    $getterContentTail .= ")))";
+                my $type = $attribute->signature->type;
+                if ($codeGenerator->IsSVGTypeNeedingTearOff($type) and not $implClassName =~ /List$/) {
+                    my $idlTypeWithNamespace = GetSVGTypeWithNamespace($type);
+                    if ($codeGenerator->IsSVGTypeWithWritablePropertiesNeedingTearOff($type) and not defined $attribute->signature->extendedAttributes->{"Immutable"}) {
+                        $idlTypeWithNamespace =~ s/SVGPropertyTearOff</SVGStaticPropertyTearOff<$implClassNameWithNamespace, /;
+                        $implIncludes{"SVGStaticPropertyTearOff.h"} = 1;
+
+                        my $getter = $getterContentHead;
+                        $getter =~ s/IMPL->//;
+                        $getter =~ s/\(//;
+                        my $updater = "update" . $codeGenerator->WK_ucfirst($getter);
+                        $getterContentHead = "kit(WTF::getPtr(${idlTypeWithNamespace}::create(IMPL, $getterContentHead$getterContentTail, &${implClassNameWithNamespace}::$updater";
+                        $getterContentTail .= "))";
+                    } elsif ($idlTypeWithNamespace =~ /SVGStaticListPropertyTearOff/) {
+                        my $extraImp = "WebCore::GetOwnerElementForType<$implClassNameWithNamespace, WebCore::IsDerivedFromSVGElement<$implClassNameWithNamespace>::value>::ownerElement(IMPL), ";
+                        $getterContentHead = "kit(WTF::getPtr(${idlTypeWithNamespace}::create($extraImp$getterContentHead";
+                        $getterContentTail .= ")))";
+                    } elsif ($idlTypeWithNamespace =~ /SVGPointList/) {
+                        $getterContentHead = "kit(WTF::getPtr($getterContentHead";
+                        $getterContentTail .= "))";
+                    } else {
+                        $getterContentHead = "kit(WTF::getPtr(${idlTypeWithNamespace}::create($getterContentHead";
+                        $getterContentTail .= ")))";
+                    }
                 } else {
                     $getterContentHead = "kit(WTF::getPtr($getterContentHead";
                     $getterContentTail .= "))";
@@ -1381,24 +1406,31 @@ sub GenerateImplementation
                     push(@implContent, "    $svgPropertyType& podImpl = IMPL->propertyReference();\n");
                     my $ec = $hasSetterException ? ", ec" : "";
                     push(@implContent, "    $exceptionInit\n") if $hasSetterException;
-                    push(@implContent, "    podImpl.$coreSetterName($arg$ec);\n");
+
+                    # Special case for DOMSVGNumber
+                    if ($svgPropertyType eq "float") {
+                        push(@implContent, "    podImpl = $arg;\n");
+                    } else {
+                        # FIXME: Special case for DOMSVGLength. We do need Custom code support for this.
+                        if ($svgPropertyType eq "WebCore::SVGLength" and $attributeName eq "value") {
+                            push(@implContent, "    podImpl.$coreSetterName($arg, IMPL->contextElement()$ec);\n");
+                        } else {
+                            push(@implContent, "    podImpl.$coreSetterName($arg$ec);\n");
+                        }
+                    }
+
                     if ($hasSetterException) {
                         push(@implContent, "    if (!ec)\n");
                         push(@implContent, "        IMPL->commitChange();\n");
                         push(@implContent, "    $exceptionRaiseOnError\n");
                     } else {
-                        push(@implContent, "        IMPL->commitChange();\n");
+                        push(@implContent, "    IMPL->commitChange();\n");
                     }
                 } elsif ($svgListPropertyType) {
                     $getterContentHead = "$getterExpressionPrefix";
                     push(@implContent, "    IMPL->$coreSetterName($arg);\n");
                 } elsif ($podType) {
-                    # Special case for DOMSVGNumber
-                    if ($podType eq "float") {
-                        push(@implContent, "    *IMPL = $arg;\n");
-                    } else {
-                        push(@implContent, "    IMPL->$coreSetterName($arg);\n");
-                    }
+                    push(@implContent, "    IMPL->$coreSetterName($arg);\n");
                 } else {
                     my $setterExpressionPrefix = $codeGenerator->SetterExpressionPrefix(\%implIncludes, $interfaceName, $attribute);
                     my $ec = $hasSetterException ? ", ec" : "";
@@ -1519,8 +1551,8 @@ sub GenerateImplementation
             my $svgMatrixInverse = ($podType and $podType eq "AffineTransform" and $functionName eq "inverse");
             my $svgLengthConvertToSpecifiedUnits = ($svgPropertyType and $svgPropertyType eq "WebCore::SVGLength" and $functionName eq "convertToSpecifiedUnits");
 
+            push(@parameterNames, "IMPL->contextElement()") if $svgLengthConvertToSpecifiedUnits; 
             push(@parameterNames, "ec") if $raisesExceptions and !($svgMatrixRotateFromVector || $svgMatrixInverse);
-            push(@parameterNames, "0 /* FIXME */") if $svgLengthConvertToSpecifiedUnits; 
 
             # Handle arguments that are 'SVGProperty' based (SVGAngle/SVGLength). We need to convert from SVGPropertyTearOff<Type>* to Type,
             # to be able to call the desired WebCore function. If the conversion fails, we can't extract Type and need to raise an exception.
@@ -1533,8 +1565,7 @@ sub GenerateImplementation
                 next if not $codeGenerator->IsSVGTypeNeedingTearOff($idlType) or $implClassName =~ /List$/;
 
                 my $implGetter = GetObjCTypeGetter($paramName, $idlType);
-                my $idlTypeWithNamespace = "WebCore::" . $codeGenerator->GetSVGTypeNeedingTearOff($idlType);
-                $idlTypeWithNamespace =~ s/</\<WebCore::/;
+                my $idlTypeWithNamespace = GetSVGTypeWithNamespace($idlType);
 
                 push(@functionContent, "    $idlTypeWithNamespace* ${paramName}Core = $implGetter;\n");
                 push(@functionContent, "    if (!${paramName}Core) {\n");
@@ -1555,7 +1586,7 @@ sub GenerateImplementation
 
             if ($svgPropertyType) {
                 push(@functionContent, "    $svgPropertyType& podImpl = IMPL->propertyReference();\n");
-                $content = "podImpl.$content;\n    IMPL->commitChange()"; 
+                $content = "podImpl.$content"; 
             } else {
                 $content = $caller . "->$content";
             }
@@ -1579,9 +1610,14 @@ sub GenerateImplementation
                 if ($raisesExceptions) {
                     push(@functionContent, "    $exceptionInit\n");
                     push(@functionContent, "    $content;\n");
+                    if ($svgPropertyType) {
+                        push(@functionContent, "    if (!ec)\n");
+                        push(@functionContent, "        IMPL->commitChange();\n");
+                    }
                     push(@functionContent, "    $exceptionRaiseOnError\n");
                 } else {
                     push(@functionContent, "    $content;\n");
+                    push(@functionContent, "    IMPL->commitChange()\n") if $svgPropertyType;
                 }
             } elsif (defined $needsCustom{"NodeToReturn"}) {
                 # Special case the insertBefore, replaceChild, removeChild 
@@ -1603,9 +1639,7 @@ sub GenerateImplementation
             } else {
                 if (ConversionNeeded($function->signature->type)) {
                     if ($codeGenerator->IsSVGTypeNeedingTearOff($function->signature->type) and not $implClassName =~ /List$/) {
-                        my $idlType = $function->signature->type;
-                        my $idlTypeWithNamespace = "WebCore::" . $codeGenerator->GetSVGTypeNeedingTearOff($idlType);
-                        $idlTypeWithNamespace =~ s/</\<WebCore::/;
+                        my $idlTypeWithNamespace = GetSVGTypeWithNamespace($function->signature->type);
                         $content = "kit(WTF::getPtr(${idlTypeWithNamespace}::create($content)))";
                     } elsif ($codeGenerator->IsPodType($function->signature->type)) {
                         $content = "kit($content)";
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index cfb8a6d..2a76692 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -130,22 +130,13 @@ sub GenerateModule
     $module = $dataNode->module;
 }
 
-sub AvoidInclusionOfType
-{
-    my $type = shift;
-
-    # Special case: SVGRect.h / SVGPoint.h / SVGNumber.h / SVGMatrix.h do not exist.
-    return 1 if $type eq "SVGRect" or $type eq "SVGPoint" or $type eq "SVGNumber" or $type eq "SVGMatrix";
-    return 0;
-}
-
 sub AddIncludesForType
 {
     my $type = $codeGenerator->StripModule(shift);
 
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
-    if (!$codeGenerator->IsPrimitiveType($type) and !AvoidInclusionOfType($type) and $type ne "Date") {
+    if (!$codeGenerator->IsPrimitiveType($type) and !$codeGenerator->AvoidInclusionOfType($type) and $type ne "Date") {
         # default, include the same named file
         $implIncludes{GetV8HeaderName(${type})} = 1;
 
@@ -231,12 +222,13 @@ sub GetSVGPropertyTypes
     my $svgWrappedNativeType = $codeGenerator->GetSVGWrappedTypeNeedingTearOff($implType);
     if ($svgNativeType =~ /SVGPropertyTearOff/) {
         $svgPropertyType = $svgWrappedNativeType;
-        $implIncludes{"SVGAnimatedPropertyTearOff.h"} = 1,
-    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/) {
+        $implIncludes{"SVGAnimatedPropertyTearOff.h"} = 1;
+    } elsif ($svgNativeType =~ /SVGListPropertyTearOff/ or $svgNativeType =~ /SVGStaticListPropertyTearOff/) {
         $svgListPropertyType = $svgWrappedNativeType;
-        $implIncludes{"SVGAnimatedListPropertyTearOff.h"} = 1,
+        $implIncludes{"SVGAnimatedListPropertyTearOff.h"} = 1;
     }
 
+    $svgPropertyType = "SVGPoint" if $svgPropertyType eq "FloatPoint";
     return ($svgPropertyType, $svgListPropertyType, $svgNativeType);
 }
 
@@ -280,7 +272,17 @@ sub GenerateHeader
     push(@headerContent, "\nnamespace WebCore {\n");
     push(@headerContent, "\ntemplate<typename PODType> class V8SVGPODTypeWrapper;\n") if $podType;
     push(@headerContent, "\ntemplate<typename PropertyType> class SVGPropertyTearOff;\n") if $svgPropertyType;
+<<<<<<< HEAD
     push(@headerContent, "\ntemplate<typename PropertyType> class SVGListPropertyTearOff;\n") if $svgListPropertyType;
+=======
+    if ($svgListPropertyType) {
+        if ($svgListPropertyType =~ /SVGStaticListPropertyTearOff/) {
+            push(@headerContent, "\ntemplate<typename PropertyType> class SVGStaticListPropertyTearOff;\n");
+        } else {
+            push(@headerContent, "\ntemplate<typename PropertyType> class SVGListPropertyTearOff;\n");
+        }
+    }
+>>>>>>> webkit.org at r71558
     push(@headerContent, "\nclass FloatRect;\n") if $svgPropertyType && $svgPropertyType eq "FloatRect";
     push(@headerContent, "\nclass $className {\n");
 
@@ -479,7 +481,7 @@ sub GetHeaderClassInclude
     if ($className =~ /SVGPathSeg/) {
         $className =~ s/Abs|Rel//;
     }
-    return "" if (AvoidInclusionOfType($className));
+    return "" if ($codeGenerator->AvoidInclusionOfType($className));
     return "DeprecatedSVGAnimatedTemplate.h" if $codeGenerator->IsSVGAnimatedType($className) and !$codeGenerator->IsSVGNewStyleAnimatedType($className); 
     return "${className}.h";
 }
@@ -728,7 +730,7 @@ sub GenerateNormalAttrGetter
         $attrIsPodType = 0;
     }
 
-    my $getterStringUsesImp = $implClassName ne "float";
+    my $getterStringUsesImp = $implClassName ne "SVGNumber";
     my $svgNativeType = $codeGenerator->GetSVGTypeNeedingTearOff($implClassName);
 
     # Getter
@@ -761,8 +763,12 @@ END
             push(@implContentDecls, <<END);
     $svgNativeType* wrapper = V8${implClassName}::toNative(info.Holder());
     $svgWrappedNativeType& impInstance = wrapper->propertyReference();
+END
+            if ($getterStringUsesImp) {
+                push(@implContentDecls, <<END);
     $svgWrappedNativeType* imp = &impInstance;
 END
+            }
         }
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
         if ($interfaceName eq "DOMWindow") {
@@ -928,8 +934,29 @@ END
     } elsif ($codeGenerator->IsSVGTypeNeedingTearOff($attrType) and not $implClassName =~ /List$/) {
         $implIncludes{"V8$attrType.h"} = 1;
         $implIncludes{"SVGPropertyTearOff.h"} = 1;
+<<<<<<< HEAD
         my $svgNativeType = $codeGenerator->GetSVGTypeNeedingTearOff($attrType);
         push(@implContentDecls, "    return toV8(WTF::getPtr(${svgNativeType}::create($result)));\n");
+=======
+        my $tearOffType = $codeGenerator->GetSVGTypeNeedingTearOff($attrType);
+        if ($codeGenerator->IsSVGTypeWithWritablePropertiesNeedingTearOff($attrType) and not defined $attribute->signature->extendedAttributes->{"Immutable"}) {
+            $tearOffType =~ s/SVGPropertyTearOff</SVGStaticPropertyTearOff<$implClassName, /;
+            $implIncludes{"SVGStaticPropertyTearOff.h"} = 1;
+
+            my $getter = $result;
+            $getter =~ s/imp->//;
+            $getter =~ s/\(\)//;
+            my $updater = "update" . $codeGenerator->WK_ucfirst($getter);
+            push(@implContentDecls, "    return toV8(WTF::getPtr(${tearOffType}::create(imp, $result, &${implClassName}::$updater)));\n");
+        } elsif ($tearOffType =~ /SVGStaticListPropertyTearOff/) {
+            my $extraImp = "GetOwnerElementForType<$implClassName, IsDerivedFromSVGElement<$implClassName>::value>::ownerElement(imp), ";
+            push(@implContentDecls, "    return toV8(WTF::getPtr(${tearOffType}::create($extraImp$result)));\n");
+        } elsif ($tearOffType =~ /SVGPointList/) {
+            push(@implContentDecls, "    return toV8(WTF::getPtr($result));\n");
+        } else {
+            push(@implContentDecls, "    return toV8(WTF::getPtr(${tearOffType}::create($result)));\n");
+        }
+>>>>>>> webkit.org at r71558
     } elsif ($attrIsPodType) {
         $implIncludes{"V8${attrType}.h"} = 1;
         push(@implContentDecls, "    return toV8(wrapper.release().get());\n");
@@ -1071,7 +1098,7 @@ END
         push(@implContentDecls, "    ExceptionCode ec = 0;\n");
     }
 
-    if ($implClassName eq "float") {
+    if ($implClassName eq "SVGNumber") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
         if ($attribute->signature->type eq "EventListener") {
@@ -1361,11 +1388,15 @@ END
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         push(@implContentDecls, <<END);
-    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, $numParameters));
+    OwnPtr<ScriptArguments> scriptArguments(createScriptArguments(args, $numParameters));
+    size_t maxStackSize = imp->shouldCaptureFullStackTrace() ? ScriptCallStack::maxCallStackSizeToCapture : 1;
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(maxStackSize));
     if (!callStack)
         return v8::Undefined();
 END
+        $implIncludes{"ScriptArguments.h"} = 1;
         $implIncludes{"ScriptCallStack.h"} = 1;
+        $implIncludes{"ScriptCallStackFactory.h"} = 1;
     }
     if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
         push(@implContentDecls, <<END);
@@ -2673,9 +2704,7 @@ sub GetNativeTypeForConversions
     my $dataNode = shift;
     my $type = shift;
 
-    $type = "FloatPoint" if $type eq "SVGPoint";
     $type = "AffineTransform" if $type eq "SVGMatrix";
-    $type = "float" if $type eq "SVGNumber";
     $type = "V8SVGPODTypeWrapper<$type>" if $dataNode->extendedAttributes->{"PODType"};
     $type = $codeGenerator->GetSVGTypeNeedingTearOff($type) if $codeGenerator->IsSVGTypeNeedingTearOff($type); 
     return $type;
@@ -2788,8 +2817,8 @@ sub GenerateFunctionCallString()
 
     if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
         $functionString .= ", " if $index;
-        $functionString .= "callStack.get()";
-        $index++;
+        $functionString .= "scriptArguments.release(), callStack.release()";
+        $index += 2;
     }
 
     if ($function->signature->extendedAttributes->{"NeedsUserGestureCheck"}) {
@@ -2944,7 +2973,6 @@ sub IsRefPtrType
     return 0 if $type eq "unsigned";
     return 0 if $type eq "unsigned long";
     return 0 if $type eq "unsigned short";
-    return 0 if $type eq "SVGAnimatedPoints";
 
     return 1;
 }
@@ -2977,11 +3005,8 @@ sub GetNativeType
     return "bool" if $type eq "boolean";
     return "String" if $type eq "DOMString";
     return "Range::CompareHow" if $type eq "CompareHow";
-    return "FloatPoint" if $type eq "SVGPoint";
     return "AffineTransform" if $type eq "SVGMatrix";
     return "SVGTransform" if $type eq "SVGTransform";
-    return "float" if $type eq "SVGNumber";
-    return "SVGPreserveAspectRatio" if $type eq "SVGPreserveAspectRatio";
     return "SVGPaint::SVGPaintType" if $type eq "SVGPaintType";
     return "DOMTimeStamp" if $type eq "DOMTimeStamp";
     return "unsigned" if $type eq "unsigned int";
@@ -3032,8 +3057,6 @@ sub BasicTypeCanFailConversion
     my $type = GetTypeFromSignature($signature);
 
     return 1 if $type eq "SVGMatrix";
-    return 1 if $type eq "SVGPoint";
-    return 1 if $type eq "SVGPreserveAspectRatio";
     return 1 if $type eq "SVGTransform";
     return 0;
 }
@@ -3063,7 +3086,6 @@ sub JSValueToNative
     return "$value" if $type eq "JSObject";
     return "$value->BooleanValue()" if $type eq "boolean";
     return "static_cast<$type>($value->NumberValue())" if $type eq "float" or $type eq "double";
-    return "$value->NumberValue()" if $type eq "SVGNumber";
 
     return "toInt32($value${maybeOkParam})" if $type eq "long";
     return "toUInt32($value${maybeOkParam})" if $type eq "unsigned long" or $type eq "unsigned short";
@@ -3097,10 +3119,6 @@ sub JSValueToNative
         $implIncludes{"FloatRect.h"} = 1;
     }
 
-    if ($type eq "SVGPoint") {
-        $implIncludes{"FloatPoint.h"} = 1;
-    }
-
     # Default, assume autogenerated type conversion routines
     if ($type eq "EventTarget") {
         $implIncludes{"V8Node.h"} = 1;
@@ -3492,7 +3510,6 @@ sub IsSVGListTypeNeedingSpecialHandling
 {
     my $className = shift;
 
-    return 1 if $className eq "SVGPointList";
     return 1 if $className eq "SVGTransformList";
 
     return 0;
diff --git a/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 5236267..7e06068 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -31,7 +31,9 @@
 #include "JSTestObj.h"
 #include "JSlog.h"
 #include "KURL.h"
+#include "ScriptArguments.h"
 #include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 #include "SerializedScriptValue.h"
 #include "TestObj.h"
 #include <runtime/Error.h>
@@ -994,12 +996,14 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomArgsAndException(Ex
     JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
     TestObj* imp = static_cast<TestObj*>(castedThis->impl());
     ExceptionCode ec = 0;
-    ScriptCallStack callStack(exec, 1);
+    OwnPtr<ScriptArguments> scriptArguments(createScriptArguments(exec, 1));
+    size_t maxStackSize = imp->shouldCaptureFullStackTrace() ? ScriptCallStack::maxCallStackSizeToCapture : 1;
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(exec, maxStackSize));
     log* intArg = tolog(exec->argument(0));
     if (exec->hadException())
         return JSValue::encode(jsUndefined());
 
-    imp->customArgsAndException(intArg, &callStack, ec);
+    imp->customArgsAndException(intArg, scriptArguments.release(), callStack.release(), ec);
     setDOMException(exec, ec);
     return JSValue::encode(jsUndefined());
 }
diff --git a/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 4be1177..4c921bb 100644
--- a/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -26,7 +26,9 @@
 #include "IDBBindingUtilities.h"
 #include "IDBKey.h"
 #include "RuntimeEnabledFeatures.h"
+#include "ScriptArguments.h"
 #include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
@@ -715,11 +717,13 @@ static v8::Handle<v8::Value> customArgsAndExceptionCallback(const v8::Arguments&
     TestObj* imp = V8TestObj::toNative(args.Holder());
     ExceptionCode ec = 0;
     {
-    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, 1));
+    OwnPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
+    size_t maxStackSize = imp->shouldCaptureFullStackTrace() ? ScriptCallStack::maxCallStackSizeToCapture : 1;
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(maxStackSize));
     if (!callStack)
         return v8::Undefined();
     EXCEPTION_BLOCK(log*, intArg, V8log::HasInstance(args[0]) ? V8log::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0);
-    imp->customArgsAndException(intArg, callStack.get(), ec);
+    imp->customArgsAndException(intArg, scriptArguments.release(), callStack.release(), ec);
     if (UNLIKELY(ec))
         goto fail;
     return v8::Handle<v8::Value>();
diff --git a/WebCore/bindings/v8/ScriptCallFrame.h b/WebCore/bindings/v8/ScriptCallFrame.h
deleted file mode 100644
index ff77d4a..0000000
--- a/WebCore/bindings/v8/ScriptCallFrame.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ScriptCallFrame_h
-#define ScriptCallFrame_h
-
-#include "KURL.h"
-
-#include <wtf/Vector.h>
-
-namespace v8 {
-    class Arguments;
-}
-
-namespace WebCore {
-    class ScriptValue;
-
-    // FIXME: Implement retrieving line number and source URL and storing here
-    // for all call frames, not just the first one.
-    // See <https://bugs.webkit.org/show_bug.cgi?id=22556> and
-    // <https://bugs.webkit.org/show_bug.cgi?id=21180>
-    class ScriptCallFrame  {
-    public:
-        ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber, const v8::Arguments&, unsigned skipArgumentCount);
-        ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber);
-        ~ScriptCallFrame();
-
-        const String& functionName() const { return m_functionName; }
-        const String& sourceURL() const { return m_sourceURL; }
-        unsigned lineNumber() const { return m_lineNumber; }
-
-        // argument retrieval methods
-        const ScriptValue& argumentAt(unsigned) const;
-        unsigned argumentCount() const { return m_arguments.size(); }
-
-    private:
-        String m_functionName;
-        String m_sourceURL;
-        unsigned m_lineNumber;
-
-        Vector<ScriptValue> m_arguments;
-    };
-
-} // namespace WebCore
-
-#endif // ScriptCallFrame_h
diff --git a/WebCore/bindings/v8/ScriptCallStack.h b/WebCore/bindings/v8/ScriptCallStack.h
deleted file mode 100644
index 98e5195..0000000
--- a/WebCore/bindings/v8/ScriptCallStack.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ScriptCallStack_h
-#define ScriptCallStack_h
-
-#include "ScriptCallFrame.h"
-#include "ScriptState.h"
-#include "ScriptValue.h"
-#include <wtf/Noncopyable.h>
-#include <wtf/RefPtr.h>
-
-namespace v8 {
-    class Arguments;
-}
-
-namespace WebCore {
-
-class InspectorArray;
-
-class ScriptCallStack : public Noncopyable {
-public:
-    static const int maxCallStackSizeToCapture;
-    static const v8::StackTrace::StackTraceOptions stackTraceOptions;
-
-    static PassOwnPtr<ScriptCallStack> create(const v8::Arguments&, unsigned skipArgumentCount = 0, int framCountLimit = 1);
-    static PassOwnPtr<ScriptCallStack> create(ScriptState*, v8::Handle<v8::StackTrace>);
-    ~ScriptCallStack();
-
-    // Returns false if there is no running JavaScript or if fetching the stack failed.
-    // Sets stackTrace to be an array of stack frame objects.
-    // A stack frame object looks like:
-    // {
-    //   scriptName: <file name for the associated script resource>
-    //   functionName: <name of the JavaScript function>
-    //   lineNumber: <1 based line number>
-    //   column: <1 based column offset on the line>
-    // }
-    static bool stackTrace(int frameLimit, const RefPtr<InspectorArray>& stackTrace);
-
-    const ScriptCallFrame& at(unsigned);
-    unsigned size();
-
-    ScriptState* state() const { return m_scriptState; }
-    ScriptState* globalState() const { return m_scriptState; }
-
-private:
-    ScriptCallStack(ScriptState* scriptState, PassOwnPtr<ScriptCallFrame> topFrame, Vector<OwnPtr<ScriptCallFrame> >& scriptCallFrames);
-    ScriptCallStack(ScriptState* scriptState, v8::Handle<v8::StackTrace> stackTrace);
-
-    OwnPtr<ScriptCallFrame> m_topFrame;
-    ScriptState* m_scriptState;
-    Vector<OwnPtr<ScriptCallFrame> > m_scriptCallFrames;
-};
-
-} // namespace WebCore
-
-#endif // ScriptCallStack_h
diff --git a/WebCore/bindings/v8/ScriptCallStack.cpp b/WebCore/bindings/v8/ScriptCallStackFactory.cpp
index 3e29c7a..62fbeef 100644
--- a/WebCore/bindings/v8/ScriptCallStack.cpp
+++ b/WebCore/bindings/v8/ScriptCallStackFactory.cpp
@@ -1,10 +1,10 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
- *
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- *
+ * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -29,131 +29,88 @@
  */
 
 #include "config.h"
-#include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 
 #include "InspectorValues.h"
-#include "ScriptController.h"
-#include "ScriptDebugServer.h"
+#include "ScriptArguments.h"
+#include "ScriptCallFrame.h"
+#include "ScriptCallStack.h"
 #include "ScriptScope.h"
+#include "ScriptValue.h"
 #include "V8Binding.h"
 
 #include <v8-debug.h>
 
 namespace WebCore {
 
-static void getFrameLocation(v8::Handle<v8::StackFrame> frame, String* sourceName, int* sourceLineNumber, String* functionName)
+static ScriptCallFrame toScriptCallFrame(v8::Handle<v8::StackFrame> frame)
 {
-    ASSERT(!frame.IsEmpty());
+    String sourceName;
     v8::Local<v8::String> sourceNameValue(frame->GetScriptNameOrSourceURL());
-    v8::Local<v8::String> functionNameValue(frame->GetFunctionName());
-    *sourceName = sourceNameValue.IsEmpty() ? "" : toWebCoreString(sourceNameValue);
-    *functionName = functionNameValue.IsEmpty() ? "" : toWebCoreString(functionNameValue);
-    *sourceLineNumber = frame->GetLineNumber();
-}
-
-static void getTopFrameLocation(v8::Handle<v8::StackTrace> stackTrace, String* sourceName, int* sourceLineNumber, String* functionName)
-{
-    if (stackTrace->GetFrameCount() <= 0) {
-        // Successfully grabbed stack trace, but there are no frames. It may happen in case of a syntax error for example.
-        // Fallback to setting lineNumber to 0, and source and function name to "undefined".
-        *sourceName = "undefined";
-        *sourceLineNumber = 0;
-        *functionName = "undefined";
-    } else {
-        v8::Handle<v8::StackFrame> frame = stackTrace->GetFrame(0);
-        getFrameLocation(frame, sourceName, sourceLineNumber, functionName);
-    }
-}
+    if (!sourceNameValue.IsEmpty())
+        sourceName = toWebCoreString(sourceNameValue);
 
-static PassOwnPtr<ScriptCallFrame> toScriptCallFrame(v8::Handle<v8::StackFrame> frame)
-{
-    String sourceName;
-    int sourceLineNumber;
     String functionName;
-    getFrameLocation(frame, &sourceName, &sourceLineNumber, &functionName);
-    return new ScriptCallFrame(functionName, sourceName, sourceLineNumber);
+    v8::Local<v8::String> functionNameValue(frame->GetFunctionName());
+    if (!functionNameValue.IsEmpty())
+        functionName = toWebCoreString(functionNameValue);
+
+    int sourceLineNumber = frame->GetLineNumber();
+    return ScriptCallFrame(functionName, sourceName, sourceLineNumber);
 }
 
-static void toScriptCallFramesVector(v8::Local<v8::Context> context, v8::Handle<v8::StackTrace> stackTrace, Vector<OwnPtr<ScriptCallFrame> >& scriptCallFrames)
+static void toScriptCallFramesVector(v8::Local<v8::Context> context, v8::Handle<v8::StackTrace> stackTrace, Vector<ScriptCallFrame>& scriptCallFrames, size_t maxStackSize)
 {
+    // TODO(yurys): remove this???
     v8::Context::Scope contextScope(context);
     int frameCount = stackTrace->GetFrameCount();
+    if (frameCount > static_cast<int>(maxStackSize))
+        frameCount = maxStackSize;
     for (int i = 0; i < frameCount; i++) {
         v8::Local<v8::StackFrame> stackFrame = stackTrace->GetFrame(i);
         scriptCallFrames.append(toScriptCallFrame(stackFrame));
     }
+    
+    if (!frameCount) {
+        // Successfully grabbed stack trace, but there are no frames. It may happen in case of a syntax error for example.
+        // Fallback to setting lineNumber to 0, and source and function name to "undefined".
+        scriptCallFrames.append(ScriptCallFrame("undefined", "undefined", 0));
+    }
 }
 
-const int ScriptCallStack::maxCallStackSizeToCapture = 200;
-const v8::StackTrace::StackTraceOptions ScriptCallStack::stackTraceOptions = static_cast<v8::StackTrace::StackTraceOptions>(
-     v8::StackTrace::kLineNumber
-    | v8::StackTrace::kColumnOffset
-    | v8::StackTrace::kScriptNameOrSourceURL
-    | v8::StackTrace::kFunctionName);
-
-
-PassOwnPtr<ScriptCallStack> ScriptCallStack::create(const v8::Arguments& arguments, unsigned skipArgumentCount, int framCountLimit)
+PassOwnPtr<ScriptCallStack> createScriptCallStack(v8::Local<v8::Context> context, v8::Handle<v8::StackTrace> stackTrace, size_t maxStackSize)
 {
     v8::HandleScope scope;
-    v8::Local<v8::Context> context = v8::Context::GetCurrent();
     v8::Context::Scope contextScope(context);
-    v8::Handle<v8::StackTrace> stackTrace(v8::StackTrace::CurrentStackTrace(framCountLimit, ScriptCallStack::stackTraceOptions));
-
-    if (stackTrace.IsEmpty())
-        return 0;
-
-    String sourceName;
-    int sourceLineNumber;
-    String functionName;
-    getTopFrameLocation(stackTrace, &sourceName, &sourceLineNumber, &functionName);
-
-    Vector<OwnPtr<ScriptCallFrame> > scriptCallFrames;
-    if (framCountLimit > 1)
-        toScriptCallFramesVector(context, stackTrace, scriptCallFrames);
 
-    return new ScriptCallStack(ScriptState::forContext(context), new ScriptCallFrame(functionName, sourceName, sourceLineNumber, arguments, skipArgumentCount), scriptCallFrames);
+    Vector<ScriptCallFrame> scriptCallFrames;
+    toScriptCallFramesVector(context, stackTrace, scriptCallFrames, maxStackSize);
+    return new ScriptCallStack(scriptCallFrames);
 }
 
-PassOwnPtr<ScriptCallStack> ScriptCallStack::create(ScriptState* state, v8::Handle<v8::StackTrace> stackTrace)
+PassOwnPtr<ScriptCallStack> createScriptCallStack(size_t maxStackSize)
 {
     v8::HandleScope scope;
-    Vector<OwnPtr<ScriptCallFrame> > scriptCallFrames;
-    toScriptCallFramesVector(state->context(), stackTrace, scriptCallFrames);
-
-    String sourceName;
-    int sourceLineNumber;
-    String functionName;
-    getTopFrameLocation(stackTrace, &sourceName, &sourceLineNumber, &functionName);
-
-    return new ScriptCallStack(state, new ScriptCallFrame(functionName, sourceName, sourceLineNumber), scriptCallFrames);
-}
-
-ScriptCallStack::ScriptCallStack(ScriptState* scriptState, PassOwnPtr<ScriptCallFrame> topFrame, Vector<OwnPtr<ScriptCallFrame> >& scriptCallFrames)
-    : m_topFrame(topFrame)
-    , m_scriptState(scriptState)
-{
-    m_scriptCallFrames.swap(scriptCallFrames);
+    v8::Local<v8::Context> context = v8::Context::GetCurrent();
+    // TODO(yurys): remove?
+    v8::Context::Scope contextScope(context);
+    v8::Handle<v8::StackTrace> stackTrace(v8::StackTrace::CurrentStackTrace(maxStackSize, stackTraceOptions));
+    return createScriptCallStack(context, stackTrace, maxStackSize);
 }
 
-ScriptCallStack::~ScriptCallStack()
+PassOwnPtr<ScriptArguments> createScriptArguments(const v8::Arguments& v8arguments, unsigned skipArgumentCount)
 {
-}
+    v8::HandleScope scope;
+    v8::Local<v8::Context> context = v8::Context::GetCurrent();
+    ScriptState* state = ScriptState::forContext(context);
 
-const ScriptCallFrame& ScriptCallStack::at(unsigned index)
-{
-    if (!index && m_topFrame)
-        return *m_topFrame;
-    return *m_scriptCallFrames.at(index);
-}
+    Vector<ScriptValue> arguments;
+    for (int i = skipArgumentCount; i < v8arguments.Length(); ++i)
+        arguments.append(ScriptValue(v8arguments[i]));
 
-unsigned ScriptCallStack::size()
-{
-    if (m_scriptCallFrames.isEmpty())
-        return 1;
-    return m_scriptCallFrames.size();
+    return new ScriptArguments(state, arguments);
 }
 
-
 bool ScriptCallStack::stackTrace(int frameLimit, const RefPtr<InspectorArray>& stackTrace)
 {
 #if ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/v8/ScriptCallFrame.cpp b/WebCore/bindings/v8/ScriptCallStackFactory.h
index f0c7343..613af7b 100644
--- a/WebCore/bindings/v8/ScriptCallFrame.cpp
+++ b/WebCore/bindings/v8/ScriptCallStackFactory.h
@@ -1,10 +1,10 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
- *
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- *
+ * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -28,42 +28,29 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "ScriptCallFrame.h"
+#ifndef ScriptCallStackFactory_h
+#define ScriptCallStackFactory_h
 
 #include <v8.h>
-
-#include "PlatformString.h"
-#include "V8Binding.h"
-#include "V8Proxy.h"
-#include "ScriptValue.h"
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber, const v8::Arguments& arguments, unsigned skipArgumentCount)
-    : m_functionName(functionName)
-    , m_sourceURL(urlString)
-    , m_lineNumber(lineNumber)
-{
-    for (int i = skipArgumentCount; i < arguments.Length(); ++i)
-        m_arguments.append(ScriptValue(arguments[i]));
-}
+class ScriptState;
 
-ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber)
-    : m_functionName(functionName)
-    , m_sourceURL(urlString)
-    , m_lineNumber(lineNumber)
-{
-}
+const v8::StackTrace::StackTraceOptions stackTraceOptions = static_cast<v8::StackTrace::StackTraceOptions>(
+      v8::StackTrace::kLineNumber
+    | v8::StackTrace::kColumnOffset
+    | v8::StackTrace::kScriptNameOrSourceURL
+    | v8::StackTrace::kFunctionName);
 
-ScriptCallFrame::~ScriptCallFrame()
-{
-}
+class ScriptArguments;
+class ScriptCallStack;
 
-const ScriptValue& ScriptCallFrame::argumentAt(unsigned index) const
-{
-    ASSERT(m_arguments.size() > index);
-    return m_arguments[index];
-}
+PassOwnPtr<ScriptCallStack> createScriptCallStack(v8::Local<v8::Context>, v8::Handle<v8::StackTrace>, size_t maxStackSize);
+PassOwnPtr<ScriptCallStack> createScriptCallStack(size_t maxStackSize);
+PassOwnPtr<ScriptArguments> createScriptArguments(const v8::Arguments& v8arguments, unsigned skipArgumentCount);
 
 } // namespace WebCore
+
+#endif // ScriptCallStackFactory_h
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 913a892..648ae98 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -35,6 +35,7 @@
 #include "PlatformBridge.h"
 #include "Document.h"
 #include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 #include "ScriptableDocumentParser.h"
 #include "DOMWindow.h"
 #include "Event.h"
@@ -481,7 +482,7 @@ void ScriptController::clearWindowShell(bool)
 #if ENABLE(INSPECTOR)
 void ScriptController::setCaptureCallStackForUncaughtExceptions(bool value)
 {
-    v8::V8::SetCaptureStackTraceForUncaughtExceptions(value, ScriptCallStack::maxCallStackSizeToCapture, ScriptCallStack::stackTraceOptions);
+    v8::V8::SetCaptureStackTraceForUncaughtExceptions(value, ScriptCallStack::maxCallStackSizeToCapture, stackTraceOptions);
 }
 #endif
 
diff --git a/WebCore/bindings/v8/ScriptState.h b/WebCore/bindings/v8/ScriptState.h
index ce350da..11813b0 100644
--- a/WebCore/bindings/v8/ScriptState.h
+++ b/WebCore/bindings/v8/ScriptState.h
@@ -95,7 +95,7 @@ public:
             m_context.Clear();
         }
     }
-    ScriptState* get() { return m_scriptState; }
+    ScriptState* get() const { return m_scriptState; }
 private:
     ScriptState* m_scriptState;
     v8::Persistent<v8::Context> m_context;
diff --git a/WebCore/bindings/v8/V8ConsoleMessage.cpp b/WebCore/bindings/v8/V8ConsoleMessage.cpp
index 8b6bb17..40f9a7a 100644
--- a/WebCore/bindings/v8/V8ConsoleMessage.cpp
+++ b/WebCore/bindings/v8/V8ConsoleMessage.cpp
@@ -37,6 +37,7 @@
 #include "OwnPtr.h"
 #include "Page.h"
 #include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 #include "V8Binding.h"
 #include "V8Proxy.h"
 
@@ -117,18 +118,17 @@ void V8ConsoleMessage::handler(v8::Handle<v8::Message> message, v8::Handle<v8::V
     // Currently stack trace is only collected when inspector is open.
     if (!stackTrace.IsEmpty() && stackTrace->GetFrameCount() > 0) {
         v8::Local<v8::Context> context = v8::Context::GetEntered();
-        ScriptState* scriptState = ScriptState::forContext(context);
-        callStack = ScriptCallStack::create(scriptState, stackTrace);
+        callStack = createScriptCallStack(context, stackTrace, ScriptCallStack::maxCallStackSizeToCapture);
     }
 
     v8::Handle<v8::Value> resourceName = message->GetScriptResourceName();
     bool useURL = resourceName.IsEmpty() || !resourceName->IsString();
     String resourceNameString = useURL ? frame->document()->url() : toWebCoreString(resourceName);
     V8ConsoleMessage consoleMessage(errorMessage, resourceNameString, message->GetLineNumber());
-    consoleMessage.dispatchNow(page, callStack.get());
+    consoleMessage.dispatchNow(page, callStack.release());
 }
 
-void V8ConsoleMessage::dispatchNow(Page* page, ScriptCallStack* callStack)
+void V8ConsoleMessage::dispatchNow(Page* page, PassOwnPtr<ScriptCallStack> callStack)
 {
     ASSERT(page);
 
diff --git a/WebCore/bindings/v8/V8ConsoleMessage.h b/WebCore/bindings/v8/V8ConsoleMessage.h
index 387b5ee..6b892dd 100644
--- a/WebCore/bindings/v8/V8ConsoleMessage.h
+++ b/WebCore/bindings/v8/V8ConsoleMessage.h
@@ -33,6 +33,7 @@
 
 #include "PlatformString.h"
 #include <v8.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -81,7 +82,7 @@ namespace WebCore {
         const String m_sourceID;
         const unsigned m_lineNumber;
 
-        void dispatchNow(Page*, ScriptCallStack*);
+        void dispatchNow(Page*, PassOwnPtr<ScriptCallStack>);
 
         // All delayed messages are stored in this vector. If the vector
         // is 0, there are no delayed messages.
diff --git a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index ffea07c..2566b67 100644
--- a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -94,6 +94,8 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
             if (!ok)
                 return throwError("Could not convert argument 1 to a number");
         }
+        if ((buf->byteLength() - offset) % sizeof(ElementType))
+            return throwError("ArrayBuffer length minus the byteOffset is not a multiple of the element size.", V8Proxy::RangeError);
         uint32_t length = (buf->byteLength() - offset) / sizeof(ElementType);
         if (argLen > 2) {
             length = toUInt32(args[2], ok);
diff --git a/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index fc83b61..b17b8e9 100644
--- a/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -33,9 +33,12 @@
 #include "V8Console.h"
 
 #include "Console.h"
+#include "ScriptArguments.h"
 #include "ScriptCallStack.h"
+#include "ScriptCallStackFactory.h"
 #include "ScriptProfile.h"
 #include "V8Binding.h"
+#include "V8BindingMacros.h"
 #include "V8Proxy.h"
 #include "V8ScriptProfile.h"
 
@@ -62,11 +65,9 @@ v8::Handle<v8::Value> V8Console::traceCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Console.traceCallback");
     Console* imp = V8Console::toNative(args.Holder());
-    v8::HandleScope handleScope;
-    ScriptState* scriptState = ScriptState::current();
-    v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(ScriptCallStack::maxCallStackSizeToCapture, ScriptCallStack::stackTraceOptions);
-    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(scriptState, stackTrace));
-    imp->trace(callStack.get());
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture));
+    OwnPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 0));
+    imp->trace(scriptArguments.release(), callStack.release());
     return v8::Handle<v8::Value>();
 }
 
@@ -74,9 +75,34 @@ v8::Handle<v8::Value> V8Console::assertCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Console.assertCallback");
     Console* imp = V8Console::toNative(args.Holder());
-    OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(args, 1, ScriptCallStack::maxCallStackSizeToCapture));
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture));
     bool condition = args[0]->BooleanValue();
-    imp->assertCondition(condition, callStack.get());
+    OwnPtr<ScriptArguments> scriptArguments(createScriptArguments(args, 1));
+    imp->assertCondition(condition, scriptArguments.release(), callStack.release());
+    return v8::Handle<v8::Value>();
+}
+
+v8::Handle<v8::Value> V8Console::profileCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.Console.profile");
+    Console* imp = V8Console::toNative(args.Holder());
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(1));
+    if (!callStack)
+        return v8::Undefined();
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<WithUndefinedOrNullCheck>, title, args[0]);
+    imp->profile(title, ScriptState::current(), callStack.release());
+    return v8::Handle<v8::Value>();
+}
+
+v8::Handle<v8::Value> V8Console::profileEndCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.Console.profileEnd");
+    Console* imp = V8Console::toNative(args.Holder());
+    OwnPtr<ScriptCallStack> callStack(createScriptCallStack(1));
+    if (!callStack)
+        return v8::Undefined();
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<WithUndefinedOrNullCheck>, title, args[0]);
+    imp->profileEnd(title, ScriptState::current(), callStack.release());
     return v8::Handle<v8::Value>();
 }
 
diff --git a/WebCore/bindings/v8/custom/V8DOMSettableTokenListCustom.cpp b/WebCore/bindings/v8/custom/V8DOMSettableTokenListCustom.cpp
index 4eeb1e0..e1c9be4 100644
--- a/WebCore/bindings/v8/custom/V8DOMSettableTokenListCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMSettableTokenListCustom.cpp
@@ -34,8 +34,9 @@ namespace WebCore {
 
 v8::Handle<v8::Value> V8DOMSettableTokenList::indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
 {
-    // FIXME: Implement this function.
-    return v8String("");
+    INC_STATS("DOM.DOMSettableTokenList.IndexedPropertyGetter");
+    DOMSettableTokenList* list = V8DOMSettableTokenList::toNative(info.Holder());
+    return v8StringOrNull(list->item(index));
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptCallFrame.cpp b/WebCore/bindings/v8/custom/V8HTMLOutputElementCustom.cpp
index 2f74b96..ad86dd2 100644
--- a/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLOutputElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,35 +29,27 @@
  */
 
 #include "config.h"
-#include "ScriptCallFrame.h"
+#include "V8HTMLOutputElement.h"
 
-#include <runtime/ArgList.h>
-#include <runtime/UString.h>
-
-using namespace JSC;
+#include "HTMLOutputElement.h"
+#include "V8Binding.h"
+#include "V8DOMSettableTokenList.h"
+#include "V8Proxy.h"
 
 namespace WebCore {
 
-ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, ExecState* exec, unsigned skipArgumentCount)
-    : m_functionName(ustringToString(functionName))
-    , m_sourceURL(ustringToString(urlString))
-    , m_lineNumber(lineNumber)
-{
-    if (!exec)
-        return;
-    size_t argumentCount = exec->argumentCount();
-    for (size_t i = skipArgumentCount; i < argumentCount; ++i)
-        m_arguments.append(ScriptValue(exec->argument(i)));
-}
-
-ScriptCallFrame::~ScriptCallFrame()
+v8::Handle<v8::Value> V8HTMLOutputElement::htmlForAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
+    INC_STATS("DOM.HTMLOutputElement.htmlFor._get");
+    HTMLOutputElement* imp = V8HTMLOutputElement::toNative(info.Holder());
+    return toV8(imp->htmlFor());
 }
 
-const ScriptValue &ScriptCallFrame::argumentAt(unsigned index) const
+void V8HTMLOutputElement::htmlForAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
-    ASSERT(m_arguments.size() > index);
-    return m_arguments[index];
+    INC_STATS("DOM.HTMLOutputElement.htmlFor._set");
+    HTMLOutputElement* imp = V8HTMLOutputElement::toNative(info.Holder());
+    imp->setFor(toWebCoreString(value));
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp b/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp
index 3582a36..ec6324d 100644
--- a/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SVGLengthCustom.cpp
@@ -35,25 +35,58 @@
 
 #include "SVGPropertyTearOff.h"
 #include "V8Binding.h"
+#include "V8BindingMacros.h"
 
 namespace WebCore {
 
 v8::Handle<v8::Value> V8SVGLength::valueAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
-    INC_STATS("DOM.SVGLength.value");
+    INC_STATS("DOM.SVGLength.value._get");
     SVGPropertyTearOff<SVGLength>* wrapper = V8SVGLength::toNative(info.Holder());
     SVGLength& imp = wrapper->propertyReference();
-    return v8::Number::New(imp.value(wrapper->contextElement()));
+    ExceptionCode ec = 0;
+    float value = imp.value(wrapper->contextElement(), ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return v8::Number::New(value);
+}
+
+void V8SVGLength::valueAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.SVGLength.value._set");
+    if (!isUndefinedOrNull(value) && !value->IsNumber() && !value->IsBoolean()) {
+        V8Proxy::throwTypeError();
+        return;
+    }
+
+    SVGPropertyTearOff<SVGLength>* wrapper = V8SVGLength::toNative(info.Holder());
+    SVGLength& imp = wrapper->propertyReference();
+    ExceptionCode ec = 0;
+    imp.setValue(static_cast<float>(value->NumberValue()), wrapper->contextElement(), ec);
+    if (UNLIKELY(ec))
+        V8Proxy::setDOMException(ec);
+    else
+        wrapper->commitChange();
 }
 
 v8::Handle<v8::Value> V8SVGLength::convertToSpecifiedUnitsCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.SVGLength.convertToSpecifiedUnits");
+    if (args.Length() < 1)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
     SVGPropertyTearOff<SVGLength>* wrapper = V8SVGLength::toNative(args.Holder());
     SVGLength& imp = wrapper->propertyReference();
-    imp.convertToSpecifiedUnits(toInt32(args[0]), wrapper->contextElement());
-    wrapper->commitChange();
-    return v8::Undefined();
+    ExceptionCode ec = 0;
+    EXCEPTION_BLOCK(int, unitType, toUInt32(args[0]));
+    imp.convertToSpecifiedUnits(unitType, wrapper->contextElement(), ec);
+    if (UNLIKELY(ec))
+        V8Proxy::setDOMException(ec);
+    else
+        wrapper->commitChange();
+    return v8::Handle<v8::Value>();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 9346a05..b2240ed 100644
--- a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -236,10 +236,10 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::getAttachedShadersCallback(const
     bool succeed = context->getAttachedShaders(program, shaders, ec);
     if (ec) {
         V8Proxy::setDOMException(ec);
-        return v8::Undefined();
+        return v8::Null();
     }
     if (!succeed)
-        return v8::Undefined();
+        return v8::Null();
     v8::Local<v8::Array> array = v8::Array::New(shaders.size());
     for (size_t ii = 0; ii < shaders.size(); ++ii)
         array->Set(v8::Integer::New(ii), toV8(shaders[ii]));