Merge WebKit at r64523 : Initial merge by git.

Change-Id: Ibb796c6802e757b1d9b40f58205cfbe4da95fcd4

22 files changed, 523 insertions, 36 deletions

diff --git a/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 153f995..eb027c3 100644
--- a/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -48,6 +48,7 @@ bool RuntimeEnabledFeatures::isWebGLEnabled = false;
 bool RuntimeEnabledFeatures::isPushStateEnabled = false;
 bool RuntimeEnabledFeatures::isTouchEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceOrientationEnabled = true;
+bool RuntimeEnabledFeatures::isSpeechInputEnabled = true;
 
 #if ENABLE(VIDEO)
 
diff --git a/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index b059d6e..c9eb21f 100644
--- a/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -119,6 +119,10 @@ public:
     static bool deviceOrientationEventEnabled() { return isDeviceOrientationEnabled; }
     static bool ondeviceorientationEnabled() { return isDeviceOrientationEnabled; }
 
+    static void setSpeechInputEnabled(bool isEnabled) { isSpeechInputEnabled = isEnabled; }
+    static bool speechInputEnabled() { return isSpeechInputEnabled; }
+    static bool speechEnabled() { return isSpeechInputEnabled; }
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -133,6 +137,7 @@ private:
     static bool isPushStateEnabled;
     static bool isTouchEnabled;
     static bool isDeviceOrientationEnabled;
+    static bool isSpeechInputEnabled;
 };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp b/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp
index 1513b66..44928eb 100644
--- a/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp
+++ b/WebCore/bindings/gobject/WebKitHTMLElementWrapperFactory.cpp
@@ -37,6 +37,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLAppletElement.h"
 #include "HTMLAreaElement.h"
+#include "HTMLAudioElement.h"
 #include "HTMLBRElement.h"
 #include "HTMLBaseElement.h"
 #include "HTMLBaseFontElement.h"
@@ -95,6 +96,7 @@
 #include "webkit/WebKitDOMHTMLAnchorElementPrivate.h"
 #include "webkit/WebKitDOMHTMLAppletElementPrivate.h"
 #include "webkit/WebKitDOMHTMLAreaElementPrivate.h"
+#include "webkit/WebKitDOMHTMLAudioElementPrivate.h"
 #include "webkit/WebKitDOMHTMLBRElementPrivate.h"
 #include "webkit/WebKitDOMHTMLBaseElementPrivate.h"
 #include "webkit/WebKitDOMHTMLBaseFontElementPrivate.h"
@@ -175,6 +177,11 @@ static gpointer createAreaWrapper(PassRefPtr<HTMLElement> element)
     return wrapHTMLAreaElement(static_cast<HTMLAreaElement*>(element.get()));
 }
 
+static gpointer createAudioWrapper(PassRefPtr<HTMLElement> element)
+{
+    return wrapHTMLAudioElement(static_cast<HTMLAudioElement*>(element.get()));
+}
+
 static gpointer createBaseWrapper(PassRefPtr<HTMLElement> element)
 {
     return wrapHTMLBaseElement(static_cast<HTMLBaseElement*>(element.get()));
@@ -446,6 +453,7 @@ gpointer createHTMLElementWrapper(PassRefPtr<WebCore::HTMLElement> element)
     if (map.isEmpty()) {
        map.set(aTag.localName().impl(), createAnchorWrapper);
        map.set(appletTag.localName().impl(), createAppletWrapper);
+       map.set(audioTag.localName().impl(), createAudioWrapper);
        map.set(areaTag.localName().impl(), createAreaWrapper);
        map.set(baseTag.localName().impl(), createBaseWrapper);
        map.set(basefontTag.localName().impl(), createBaseFontWrapper);
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.cpp b/WebCore/bindings/js/JSCustomVoidCallback.cpp
index d5c4ac3..96b5412 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -48,7 +48,10 @@ JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject
 
 JSCustomVoidCallback::~JSCustomVoidCallback()
 {
-    m_scriptExecutionContext->postTask(DeleteCallbackDataTask::create(m_data));
+    if (m_scriptExecutionContext->isContextThread())
+        delete m_data;
+    else
+        m_scriptExecutionContext->postTask(DeleteCallbackDataTask::create(m_data));
 #ifndef NDEBUG
     m_data = 0;
 #endif
diff --git a/WebCore/bindings/js/JSIDBAnyCustom.cpp b/WebCore/bindings/js/JSIDBAnyCustom.cpp
index b7c845e..92f725a 100644
--- a/WebCore/bindings/js/JSIDBAnyCustom.cpp
+++ b/WebCore/bindings/js/JSIDBAnyCustom.cpp
@@ -33,15 +33,15 @@
 
 #include "IDBAny.h"
 #include "IDBDatabaseRequest.h"
-#include "IDBIndexRequest.h"
+#include "IDBFactory.h"
+#include "IDBIndex.h"
 #include "IDBKey.h"
 #include "IDBObjectStoreRequest.h"
-#include "IndexedDatabaseRequest.h"
 #include "JSIDBDatabaseRequest.h"
-#include "JSIDBIndexRequest.h"
+#include "JSIDBFactory.h"
+#include "JSIDBIndex.h"
 #include "JSIDBKey.h"
 #include "JSIDBObjectStoreRequest.h"
-#include "JSIndexedDatabaseRequest.h"
 #include "SerializedScriptValue.h"
 
 using namespace JSC;
@@ -60,14 +60,14 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, IDBAny* idbAny)
         return jsNull();
     case IDBAny::IDBDatabaseRequestType:
         return toJS(exec, globalObject, idbAny->idbDatabaseRequest());
-    case IDBAny::IDBIndexRequestType:
-        return toJS(exec, globalObject, idbAny->idbIndexRequest());
+    case IDBAny::IDBIndexType:
+        return toJS(exec, globalObject, idbAny->idbIndex());
     case IDBAny::IDBKeyType:
         return toJS(exec, globalObject, idbAny->idbKey());
     case IDBAny::IDBObjectStoreRequestType:
         return toJS(exec, globalObject, idbAny->idbObjectStoreRequest());
-    case IDBAny::IndexedDatabaseRequestType:
-        return toJS(exec, globalObject, idbAny->indexedDatabaseRequest());
+    case IDBAny::IDBFactoryType:
+        return toJS(exec, globalObject, idbAny->idbFactory());
     case IDBAny::SerializedScriptValueType:
         return idbAny->serializedScriptValue()->deserialize(exec, globalObject);
     }
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.cpp b/WebCore/bindings/js/JSPluginElementFunctions.cpp
index cf43e91..893b967 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -35,12 +35,18 @@ using namespace HTMLNames;
 
 // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
+static inline bool isPluginElement(Node* node)
+{
+    return node->hasTagName(objectTag) || node->hasTagName(embedTag) || node->hasTagName(appletTag);
+}
+
 Instance* pluginInstance(Node* node)
 {
     if (!node)
         return 0;
-    if (!(node->hasTagName(objectTag) || node->hasTagName(embedTag) || node->hasTagName(appletTag)))
+    if (!isPluginElement(node))
         return 0;
+
     HTMLPlugInElement* plugInElement = static_cast<HTMLPlugInElement*>(node);
     // The plugin element holds an owning reference, so we don't have to.
     Instance* instance = plugInElement->getInstance().get();
@@ -49,22 +55,40 @@ Instance* pluginInstance(Node* node)
     return instance;
 }
 
+static JSObject* pluginScriptObjectFromPluginViewBase(HTMLPlugInElement* pluginElement, JSGlobalObject* globalObject)
+{
+    Widget* pluginWidget = pluginElement->pluginWidget();
+    if (!pluginWidget)
+        return 0;
+    
+    if (!pluginWidget->isPluginViewBase())
+        return 0;
+
+    PluginViewBase* pluginViewBase = static_cast<PluginViewBase*>(pluginWidget);
+    return pluginViewBase->scriptObject(globalObject);
+}
+
+static JSObject* pluginScriptObjectFromPluginViewBase(JSHTMLElement* jsHTMLElement)
+{
+    HTMLElement* element = jsHTMLElement->impl();
+    if (!isPluginElement(element))
+        return 0;
+
+    HTMLPlugInElement* pluginElement = static_cast<HTMLPlugInElement*>(element);
+    return pluginScriptObjectFromPluginViewBase(pluginElement, jsHTMLElement->globalObject());
+}
+
 JSObject* pluginScriptObject(ExecState* exec, JSHTMLElement* jsHTMLElement)
 {
     HTMLElement* element = jsHTMLElement->impl();
-    if (!(element->hasTagName(objectTag) || element->hasTagName(embedTag) || element->hasTagName(appletTag)))
+    if (!isPluginElement(element))
         return 0;
 
     HTMLPlugInElement* pluginElement = static_cast<HTMLPlugInElement*>(element);
 
     // First, see if we can ask the plug-in view for its script object.
-    if (Widget* pluginWidget = pluginElement->pluginWidget()) {
-        if (pluginWidget->isPluginViewBase()) {
-            PluginViewBase* pluginViewBase = static_cast<PluginViewBase*>(pluginWidget);
-            if (JSObject* scriptObject = pluginViewBase->scriptObject(exec, jsHTMLElement->globalObject()))
-                return scriptObject;
-        }
-    }
+    if (JSObject* scriptObject = pluginScriptObjectFromPluginViewBase(pluginElement, jsHTMLElement->globalObject()))
+        return scriptObject;
 
     // Otherwise, fall back to getting the object from the instance.
 
@@ -127,15 +151,39 @@ bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSV
 
 static EncodedJSValue JSC_HOST_CALL callPlugin(ExecState* exec)
 {
-    Instance* instance = pluginInstance(static_cast<JSHTMLElement*>(exec->callee())->impl());
-    instance->begin();
-    JSValue result = instance->invokeDefaultMethod(exec);
-    instance->end();
+    JSHTMLElement* element = static_cast<JSHTMLElement*>(exec->callee());
+
+    // Get the plug-in script object.
+    JSObject* scriptObject = pluginScriptObject(exec, element);
+    ASSERT(scriptObject);
+
+    size_t argumentCount = exec->argumentCount();
+    MarkedArgumentBuffer argumentList;
+    for (size_t i = 0; i < argumentCount; i++)
+        argumentList.append(exec->argument(i));
+
+    CallData callData;
+    CallType callType = getCallData(scriptObject, callData);
+    ASSERT(callType == CallTypeHost);
+
+    // Call the object.
+    JSValue result = call(exec, scriptObject, callType, callData, exec->hostThisValue(), argumentList);
     return JSValue::encode(result);
 }
 
 CallType runtimeObjectGetCallData(JSHTMLElement* element, CallData& callData)
 {
+    // First, ask the plug-in view base for its runtime object.
+    if (JSObject* scriptObject = pluginScriptObjectFromPluginViewBase(element)) {
+        CallData scriptObjectCallData;
+        
+        if (scriptObject->getCallData(scriptObjectCallData) == CallTypeNone)
+            return CallTypeNone;
+
+        callData.native.function = callPlugin;
+        return CallTypeHost;
+    }
+    
     Instance* instance = pluginInstance(element->impl());
     if (!instance || !instance->supportsInvokeDefaultMethod())
         return CallTypeNone;
diff --git a/WebCore/bindings/scripts/CodeGenerator.pm b/WebCore/bindings/scripts/CodeGenerator.pm
index 363fdc5..adc47d0 100644
--- a/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/WebCore/bindings/scripts/CodeGenerator.pm
@@ -343,6 +343,11 @@ sub WK_ucfirst
     my ($object, $param) = @_;
     my $ret = ucfirst($param);
     $ret =~ s/Xml/XML/ if $ret =~ /^Xml[^a-z]/;
+
+    # For HTML5 FileSystem API Flags attributes.
+    $ret =~ s/^CREATE/Create/ if $ret =~ /^CREATE$/;
+    $ret =~ s/^EXCLUSIVE/Exclusive/ if $ret =~ /^EXCLUSIVE$/;
+
     return $ret;
 }
 
@@ -357,6 +362,11 @@ sub WK_lcfirst
     $ret =~ s/jS/js/ if $ret =~ /^jS/;
     $ret =~ s/xML/xml/ if $ret =~ /^xML/;
     $ret =~ s/xSLT/xslt/ if $ret =~ /^xSLT/;
+
+    # For HTML5 FileSystem API Flags attributes.
+    $ret =~ s/^cREATE/isCreate/ if $ret =~ /^cREATE$/;
+    $ret =~ s/^eXCLUSIVE/isExclusive/ if $ret =~ /^eXCLUSIVE$/;
+
     return $ret;
 }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index ae4ac39..bc5aace 100644
--- a/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -822,6 +822,15 @@ sub GenerateFunction {
         }
     }
 
+    # Not quite sure what to do with this yet, but we need to take into
+    # account the difference in parameters between the IDL file and the
+    # actual implementation.
+    if ($function->signature->extendedAttributes->{"NeedsUserGestureCheck"}) {
+        $functionSig .= ", gboolean isUserGesture";
+        $callImplParams .= ", " if $callImplParams;
+        $callImplParams .= "false";
+    }
+
     if ($returnType ne "void" && $returnValueIsGDOMType && $functionSigType ne "DOMObject") {
         if ($functionSigType ne "EventTarget") {
             $implIncludes{"webkit/WebKitDOM${functionSigType}Private.h"} = 1;
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 05f532c..247430f 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -219,6 +219,14 @@ sub GetVisibleClassName
     return $className;
 }
 
+sub GetCallbackClassName
+{
+    my $className = shift;
+
+    return "JSCustomVoidCallback" if $className eq "VoidCallback";
+    return "JS$className";
+}
+
 sub AvoidInclusionOfType
 {
     my $type = shift;
@@ -1913,7 +1921,7 @@ sub GenerateImplementation
                         }
 
                         my $name = $parameter->name;
-                    
+
                         if ($parameter->type eq "XPathNSResolver") {
                             push(@implContent, "    RefPtr<XPathNSResolver> customResolver;\n");
                             push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(exec->argument($argsIndex));\n");
@@ -1923,6 +1931,15 @@ sub GenerateImplementation
                             push(@implContent, "            return JSValue::encode(jsUndefined());\n");
                             push(@implContent, "        resolver = customResolver.get();\n");
                             push(@implContent, "    }\n");
+                        } elsif ($parameter->extendedAttributes->{"Callback"}) {
+                            my $callbackClassName = GetCallbackClassName($parameter->type);
+                            $implIncludes{"$callbackClassName.h"} = 1;
+                            $implIncludes{"ExceptionCode.h"} = 1;
+                            push(@implContent, "    if (exec->argumentCount() <= $argsIndex || !exec->argument($argsIndex).isObject()) {\n");
+                            push(@implContent, "        setDOMException(exec, TYPE_MISMATCH_ERR);\n");
+                            push(@implContent, "        return jsUndefined();\n");
+                            push(@implContent, "    }\n");
+                            push(@implContent, "    RefPtr<" . $parameter->type . "> $name = " . $callbackClassName . "::create(asObject(exec->argument($argsIndex)), castedThis->globalObject());\n");
                         } else {
                             push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "exec->argument($argsIndex)") . ";\n");
 
@@ -2151,7 +2168,10 @@ sub GenerateCallbackImplementation
     # Destructor
     push(@implContent, "${className}::~${className}()\n");
     push(@implContent, "{\n");
-    push(@implContent, "    m_scriptExecutionContext->postTask(DeleteCallbackDataTask::create(m_data));\n");
+    push(@implContent, "    if (m_scriptExecutionContext->isContextThread())\n");
+    push(@implContent, "        delete m_data;\n");
+    push(@implContent, "    else\n");
+    push(@implContent, "        m_scriptExecutionContext->postTask(DeleteCallbackDataTask::create(m_data));\n");
     push(@implContent, "#ifndef NDEBUG\n");
     push(@implContent, "    m_data = 0;\n");
     push(@implContent, "#endif\n");
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index c963e04..c852f7b 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -1139,7 +1139,7 @@ END
     my $raisesExceptions = @{$function->raisesExceptions};
     if (!$raisesExceptions) {
         foreach my $parameter (@{$function->parameters}) {
-            if (TypeCanFailConversion($parameter) or $parameter->extendedAttributes->{"IsIndex"}) {
+            if ((!$parameter->extendedAttributes->{"Callback"} and TypeCanFailConversion($parameter)) or $parameter->extendedAttributes->{"IsIndex"}) {
                 $raisesExceptions = 1;
             }
         }
@@ -1183,6 +1183,21 @@ END
             push(@implContentDecls, "    }\n");
         }
 
+        if ($parameter->extendedAttributes->{"Callback"}) {
+            my $className = GetCallbackClassName($parameter->type);
+            $implIncludes{"$className.h"} = 1;
+            $implIncludes{"ExceptionCode.h"} = 1;
+            push(@implContentDecls, "    if (args.Length() <= $paramIndex || !args[$paramIndex]->IsObject())\n");
+            push(@implContentDecls, "        return throwError(TYPE_MISMATCH_ERR);\n");
+            if ($parameter->type eq "VoidCallback") {
+                push(@implContentDecls, "    RefPtr<" . $parameter->type . "> $parameterName = " . $className . "::create(args[$paramIndex], getScriptExecutionContext());\n");
+            } else {
+                push(@implContentDecls, "    RefPtr<" . $parameter->type . "> $parameterName = " . $className . "::create(args[$paramIndex]);\n");
+            }
+            $paramIndex++;
+            next;
+        }
+
         if ($parameter->type eq "SerializedScriptValue") {
             $implIncludes{"SerializedScriptValue.h"} = 1;
             push(@implContentDecls, "    bool ${parameterName}DidThrow = false;\n");
@@ -3235,6 +3250,14 @@ sub GetVisibleInterfaceName
     return $interfaceName;
 }
 
+sub GetCallbackClassName
+{
+    my $interfaceName = shift;
+
+    return "V8CustomVoidCallback" if $interfaceName eq "VoidCallback";
+    return "V8$interfaceName";
+}
+
 sub DebugPrint
 {
     my $output = shift;
diff --git a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
index 179b301..b8c551e 100644
--- a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
+++ b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
@@ -176,6 +176,38 @@ void WebDOMTestObj::setTestObjAttr(const WebDOMTestObj& newTestObjAttr)
     impl()->setTestObjAttr(toWebCore(newTestObjAttr));
 }
 
+WebDOMTestObj WebDOMTestObj::XMLObjAttr() const
+{
+    if (!impl())
+        return WebDOMTestObj();
+
+    return toWebKit(WTF::getPtr(impl()->xmlObjAttr()));
+}
+
+void WebDOMTestObj::setXMLObjAttr(const WebDOMTestObj& newXMLObjAttr)
+{
+    if (!impl())
+        return;
+
+    impl()->setXMLObjAttr(toWebCore(newXMLObjAttr));
+}
+
+bool WebDOMTestObj::CREATE() const
+{
+    if (!impl())
+        return false;
+
+    return impl()->isCreate();
+}
+
+void WebDOMTestObj::setCREATE(bool newCREATE)
+{
+    if (!impl())
+        return;
+
+    impl()->setCreate(newCREATE);
+}
+
 WebDOMString WebDOMTestObj::reflectedStringAttr() const
 {
     if (!impl())
diff --git a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
index 09c77db..c3b65ca 100644
--- a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
+++ b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
@@ -69,6 +69,10 @@ public:
     void setStringAttr(const WebDOMString&);
     WebDOMTestObj testObjAttr() const;
     void setTestObjAttr(const WebDOMTestObj&);
+    WebDOMTestObj XMLObjAttr() const;
+    void setXMLObjAttr(const WebDOMTestObj&);
+    bool CREATE() const;
+    void setCREATE(bool);
     WebDOMString reflectedStringAttr() const;
     void setReflectedStringAttr(const WebDOMString&);
     int reflectedIntegralAttr() const;
diff --git a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index b4b6787..6a8399e 100644
--- a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -475,6 +475,48 @@ webkit_dom_test_obj_set_test_obj_attr(WebKitDOMTestObj* self, WebKitDOMTestObj*
     item->setTestObjAttr(converted_value);
 }
 
+WebKitDOMTestObj* 
+webkit_dom_test_obj_get_xml_obj_attr(WebKitDOMTestObj* self)
+{
+    WebCore::JSMainThreadNullState state;
+    g_return_val_if_fail(self, 0);
+    WebCore::TestObj * item = WebKit::core(self);
+    PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->xmlObjAttr());
+    WebKitDOMTestObj*  res = static_cast<WebKitDOMTestObj* >(WebKit::kit(g_res.get()));
+    return res;
+}
+
+void
+webkit_dom_test_obj_set_xml_obj_attr(WebKitDOMTestObj* self, WebKitDOMTestObj*  value)
+{
+    WebCore::JSMainThreadNullState state;
+    g_return_if_fail(self);
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(value);
+    WebCore::TestObj * converted_value = WebKit::core(value);
+    g_return_if_fail(converted_value);
+    item->setXMLObjAttr(converted_value);
+}
+
+gboolean
+webkit_dom_test_obj_get_create(WebKitDOMTestObj* self)
+{
+    WebCore::JSMainThreadNullState state;
+    g_return_val_if_fail(self, 0);
+    WebCore::TestObj * item = WebKit::core(self);
+    gboolean res = item->isCreate();
+    return res;
+}
+
+void
+webkit_dom_test_obj_set_create(WebKitDOMTestObj* self, gboolean value)
+{
+    WebCore::JSMainThreadNullState state;
+    g_return_if_fail(self);
+    WebCore::TestObj * item = WebKit::core(self);
+    item->setCreate(value);
+}
+
 gchar* 
 webkit_dom_test_obj_get_reflected_string_attr(WebKitDOMTestObj* self)
 {
@@ -932,6 +974,8 @@ enum {
     PROP_UNSIGNED_LONG_LONG_ATTR,
     PROP_STRING_ATTR,
     PROP_TEST_OBJ_ATTR,
+    PROP_XML_OBJ_ATTR,
+    PROP_CREATE,
     PROP_REFLECTED_STRING_ATTR,
     PROP_REFLECTED_INTEGRAL_ATTR,
     PROP_REFLECTED_BOOLEAN_ATTR,
@@ -1000,6 +1044,11 @@ static void webkit_dom_test_obj_set_property(GObject* object, guint prop_id, con
         coreSelf->setStringAttr(WebCore::String::fromUTF8(g_value_get_string(value)));
         break;
     }
+    case PROP_CREATE:
+    {
+        coreSelf->setCreate((g_value_get_boolean(value)));
+        break;
+    }
     case PROP_REFLECTED_STRING_ATTR:
     {
         coreSelf->setAttribute(WebCore::HTMLNames::reflectedstringattrAttr, WebCore::String::fromUTF8(g_value_get_string(value)));
@@ -1155,6 +1204,17 @@ static void webkit_dom_test_obj_get_property(GObject* object, guint prop_id, GVa
         g_value_set_object(value, WebKit::kit(ptr.get()));
         break;
     }
+    case PROP_XML_OBJ_ATTR:
+    {
+        RefPtr<WebCore::TestObj> ptr = coreSelf->xmlObjAttr();
+        g_value_set_object(value, WebKit::kit(ptr.get()));
+        break;
+    }
+    case PROP_CREATE:
+    {
+        g_value_set_boolean(value, coreSelf->isCreate());
+        break;
+    }
     case PROP_REFLECTED_STRING_ATTR:
     {
         g_value_take_string(value, convertToUTF8String(coreSelf->getAttribute(WebCore::HTMLNames::reflectedstringattrAttr)));
@@ -1355,6 +1415,20 @@ G_MAXUINT64, /* min */
                                                            WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
                                                            WEBKIT_PARAM_READWRITE));
     g_object_class_install_property(gobjectClass,
+                                    PROP_XML_OBJ_ATTR,
+                                    g_param_spec_object("xml-obj-attr", /* name */
+                                                           "test_obj_xml-obj-attr", /* short description */
+                                                           "read-write  WebKitDOMTestObj*  TestObj.xml-obj-attr", /* longer - could do with some extra doc stuff here */
+                                                           WEBKIT_TYPE_DOM_TEST_OBJ, /* gobject type */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
+                                    PROP_CREATE,
+                                    g_param_spec_boolean("create", /* name */
+                                                           "test_obj_create", /* short description */
+                                                           "read-write  gboolean TestObj.create", /* longer - could do with some extra doc stuff here */
+                                                           FALSE, /* default */
+                                                           WEBKIT_PARAM_READWRITE));
+    g_object_class_install_property(gobjectClass,
                                     PROP_REFLECTED_STRING_ATTR,
                                     g_param_spec_string("reflected-string-attr", /* name */
                                                            "test_obj_reflected-string-attr", /* short description */
diff --git a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
index baf278c..c9a1821 100644
--- a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
+++ b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
@@ -163,6 +163,18 @@ webkit_dom_test_obj_get_test_obj_attr(WebKitDOMTestObj* self);
 WEBKIT_API void
 webkit_dom_test_obj_set_test_obj_attr(WebKitDOMTestObj* self, WebKitDOMTestObj*  value);
 
+WEBKIT_API WebKitDOMTestObj* 
+webkit_dom_test_obj_get_xml_obj_attr(WebKitDOMTestObj* self);
+
+WEBKIT_API void
+webkit_dom_test_obj_set_xml_obj_attr(WebKitDOMTestObj* self, WebKitDOMTestObj*  value);
+
+WEBKIT_API gboolean
+webkit_dom_test_obj_get_create(WebKitDOMTestObj* self);
+
+WEBKIT_API void
+webkit_dom_test_obj_set_create(WebKitDOMTestObj* self, gboolean value);
+
 WEBKIT_API gchar* 
 webkit_dom_test_obj_get_reflected_string_attr(WebKitDOMTestObj* self);
 
diff --git a/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp b/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
index 043a6ed..6f6b568 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
+++ b/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
@@ -43,7 +43,10 @@ JSTestCallback::JSTestCallback(JSObject* callback, JSDOMGlobalObject* globalObje
 
 JSTestCallback::~JSTestCallback()
 {
-    m_scriptExecutionContext->postTask(DeleteCallbackDataTask::create(m_data));
+    if (m_scriptExecutionContext->isContextThread())
+        delete m_data;
+    else
+        m_scriptExecutionContext->postTask(DeleteCallbackDataTask::create(m_data));
 #ifndef NDEBUG
     m_data = 0;
 #endif
diff --git a/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 5aa54da..9c11bde 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -21,10 +21,12 @@
 #include "config.h"
 #include "JSTestObj.h"
 
+#include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "IDBBindingUtilities.h"
 #include "IDBKey.h"
 #include "JSEventListener.h"
+#include "JSTestCallback.h"
 #include "JSTestObj.h"
 #include "JSlog.h"
 #include "KURL.h"
@@ -49,7 +51,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSTestObj);
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSTestObjTableValues[32] =
+static const HashTableValue JSTestObjTableValues[34] =
 {
     { "readOnlyIntAttr", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReadOnlyIntAttr), (intptr_t)0 THUNK_GENERATOR(0) },
     { "readOnlyStringAttr", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReadOnlyStringAttr), (intptr_t)0 THUNK_GENERATOR(0) },
@@ -59,6 +61,8 @@ static const HashTableValue JSTestObjTableValues[32] =
     { "unsignedLongLongAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjUnsignedLongLongAttr), (intptr_t)setJSTestObjUnsignedLongLongAttr THUNK_GENERATOR(0) },
     { "stringAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjStringAttr), (intptr_t)setJSTestObjStringAttr THUNK_GENERATOR(0) },
     { "testObjAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjTestObjAttr), (intptr_t)setJSTestObjTestObjAttr THUNK_GENERATOR(0) },
+    { "XMLObjAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjXMLObjAttr), (intptr_t)setJSTestObjXMLObjAttr THUNK_GENERATOR(0) },
+    { "CREATE", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCreate), (intptr_t)setJSTestObjCreate THUNK_GENERATOR(0) },
     { "reflectedStringAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReflectedStringAttr), (intptr_t)setJSTestObjReflectedStringAttr THUNK_GENERATOR(0) },
     { "reflectedIntegralAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReflectedIntegralAttr), (intptr_t)setJSTestObjReflectedIntegralAttr THUNK_GENERATOR(0) },
     { "reflectedBooleanAttr", DontDelete, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjReflectedBooleanAttr), (intptr_t)setJSTestObjReflectedBooleanAttr THUNK_GENERATOR(0) },
@@ -92,7 +96,7 @@ static const HashTableValue JSTestObjTableValues[32] =
 };
 
 #undef THUNK_GENERATOR
-static JSC_CONST_HASHTABLE HashTable JSTestObjTable = { 68, 63, JSTestObjTableValues, 0 };
+static JSC_CONST_HASHTABLE HashTable JSTestObjTable = { 132, 127, JSTestObjTableValues, 0 };
 /* Hash table for constructor */
 #if ENABLE(JIT)
 #define THUNK_GENERATOR(generator) , generator
@@ -172,7 +176,7 @@ bool JSTestObjConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSTestObjPrototypeTableValues[42] =
+static const HashTableValue JSTestObjPrototypeTableValues[45] =
 {
     { "CONST_VALUE_0", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCONST_VALUE_0), (intptr_t)0 THUNK_GENERATOR(0) },
     { "CONST_VALUE_1", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCONST_VALUE_1), (intptr_t)0 THUNK_GENERATOR(0) },
@@ -214,12 +218,15 @@ static const HashTableValue JSTestObjPrototypeTableValues[42] =
     { "methodWithOptionalArg", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithOptionalArg), (intptr_t)1 THUNK_GENERATOR(0) },
     { "methodWithNonOptionalArgAndOptionalArg", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg), (intptr_t)2 THUNK_GENERATOR(0) },
     { "methodWithNonOptionalArgAndTwoOptionalArgs", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs), (intptr_t)3 THUNK_GENERATOR(0) },
+    { "methodWithCallbackArg", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithCallbackArg), (intptr_t)1 THUNK_GENERATOR(0) },
+    { "methodWithNonCallbackArgAndCallbackArg", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg), (intptr_t)2 THUNK_GENERATOR(0) },
+    { "methodWithCallbackAndOptionalArg", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg), (intptr_t)1 THUNK_GENERATOR(0) },
     { "overloadedMethod", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionOverloadedMethod), (intptr_t)2 THUNK_GENERATOR(0) },
     { 0, 0, 0, 0 THUNK_GENERATOR(0) }
 };
 
 #undef THUNK_GENERATOR
-static JSC_CONST_HASHTABLE HashTable JSTestObjPrototypeTable = { 134, 127, JSTestObjPrototypeTableValues, 0 };
+static JSC_CONST_HASHTABLE HashTable JSTestObjPrototypeTable = { 135, 127, JSTestObjPrototypeTableValues, 0 };
 const ClassInfo JSTestObjPrototype::s_info = { "TestObjPrototype", 0, &JSTestObjPrototypeTable, 0 };
 
 JSObject* JSTestObjPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
@@ -337,6 +344,24 @@ JSValue jsTestObjTestObjAttr(ExecState* exec, JSValue slotBase, const Identifier
     return result;
 }
 
+JSValue jsTestObjXMLObjAttr(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = toJS(exec, castedThis->globalObject(), WTF::getPtr(imp->xmlObjAttr()));
+    return result;
+}
+
+JSValue jsTestObjCreate(ExecState* exec, JSValue slotBase, const Identifier&)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
+    UNUSED_PARAM(exec);
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    JSValue result = jsBoolean(imp->isCreate());
+    return result;
+}
+
 JSValue jsTestObjReflectedStringAttr(ExecState* exec, JSValue slotBase, const Identifier&)
 {
     JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(slotBase));
@@ -585,6 +610,20 @@ void setJSTestObjTestObjAttr(ExecState* exec, JSObject* thisObject, JSValue valu
     imp->setTestObjAttr(toTestObj(value));
 }
 
+void setJSTestObjXMLObjAttr(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    imp->setXMLObjAttr(toTestObj(value));
+}
+
+void setJSTestObjCreate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    imp->setCreate(value.toBoolean(exec));
+}
+
 void setJSTestObjReflectedStringAttr(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     JSTestObj* castedThis = static_cast<JSTestObj*>(thisObject);
@@ -1189,6 +1228,65 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgA
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() <= 0 || !exec->argument(0).isObject()) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+    RefPtr<TestCallback> callback = JSTestCallback::create(asObject(exec->argument(0)), castedThis->globalObject());
+
+    imp->methodWithCallbackArg(callback);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    int nonCallback = exec->argument(0).toInt32(exec);
+    if (exec->argumentCount() <= 1 || !exec->argument(1).isObject()) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+    RefPtr<TestCallback> callback = JSTestCallback::create(asObject(exec->argument(1)), castedThis->globalObject());
+
+    imp->methodWithNonCallbackArgAndCallbackArg(nonCallback, callback);
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+
+    int argsCount = exec->argumentCount();
+    if (argsCount < 1) {
+        imp->methodWithCallbackAndOptionalArg();
+        return JSValue::encode(jsUndefined());
+    }
+
+    if (exec->argumentCount() <= 0 || !exec->argument(0).isObject()) {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+        return jsUndefined();
+    }
+    RefPtr<TestCallback> callback = JSTestCallback::create(asObject(exec->argument(0)), castedThis->globalObject());
+
+    imp->methodWithCallbackAndOptionalArg(callback);
+    return JSValue::encode(jsUndefined());
+}
+
 static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod1(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
diff --git a/WebCore/bindings/scripts/test/JS/JSTestObj.h b/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 0648526..993df8c 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -115,6 +115,9 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionC
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(JSC::ExecState*);
 // Attributes
 
@@ -131,6 +134,10 @@ JSC::JSValue jsTestObjStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Ident
 void setJSTestObjStringAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjTestObjAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjTestObjAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjXMLObjAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjXMLObjAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTestObjCreate(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+void setJSTestObjCreate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjReflectedStringAttr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjReflectedIntegralAttr(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index a96b499..4a0f065 100644
--- a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -62,6 +62,10 @@ enum {
 - (void)setStringAttr:(NSString *)newStringAttr;
 - (DOMTestObj *)testObjAttr;
 - (void)setTestObjAttr:(DOMTestObj *)newTestObjAttr;
+- (DOMTestObj *)XMLObjAttr;
+- (void)setXMLObjAttr:(DOMTestObj *)newXMLObjAttr;
+- (BOOL)CREATE;
+- (void)setCREATE:(BOOL)newCREATE;
 - (NSString *)reflectedStringAttr;
 - (void)setReflectedStringAttr:(NSString *)newReflectedStringAttr;
 - (int)reflectedIntegralAttr;
diff --git a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index 99c3cc6..71d3508 100644
--- a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -154,6 +154,32 @@
     IMPL->setTestObjAttr(core(newTestObjAttr));
 }
 
+- (DOMTestObj *)XMLObjAttr
+{
+    WebCore::JSMainThreadNullState state;
+    return kit(WTF::getPtr(IMPL->xmlObjAttr()));
+}
+
+- (void)setXMLObjAttr:(DOMTestObj *)newXMLObjAttr
+{
+    WebCore::JSMainThreadNullState state;
+    ASSERT(newXMLObjAttr);
+
+    IMPL->setXMLObjAttr(core(newXMLObjAttr));
+}
+
+- (BOOL)CREATE
+{
+    WebCore::JSMainThreadNullState state;
+    return IMPL->isCreate();
+}
+
+- (void)setCREATE:(BOOL)newCREATE
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->setCreate(newCREATE);
+}
+
 - (NSString *)reflectedStringAttr
 {
     WebCore::JSMainThreadNullState state;
diff --git a/WebCore/bindings/scripts/test/TestObj.idl b/WebCore/bindings/scripts/test/TestObj.idl
index a5daa24..a2bc89d 100644
--- a/WebCore/bindings/scripts/test/TestObj.idl
+++ b/WebCore/bindings/scripts/test/TestObj.idl
@@ -41,6 +41,11 @@ module test {
         attribute DOMString                stringAttr;
         attribute TestObj                  testObjAttr;
 
+        JS, V8
+        // WK_ucfirst, WK_lcfirst exceptional cases.
+        attribute TestObj                  XMLObjAttr;
+        attribute boolean                  CREATE;
+
         // Reflected DOM attributes
         attribute [Reflect] DOMString reflectedStringAttr;
         attribute [Reflect] long reflectedIntegralAttr;
@@ -109,6 +114,13 @@ module test {
         void    methodWithNonOptionalArgAndOptionalArg(in long nonOpt, in [Optional] long opt);
         void    methodWithNonOptionalArgAndTwoOptionalArgs(in long nonOpt, in [Optional] long opt1, in long opt2);
 
+#if defined(TESTING_V8) || defined(TESTING_JS)
+        // 'Callback' extended attribute
+        void    methodWithCallbackArg(in [Callback] TestCallback callback);
+        void    methodWithNonCallbackArgAndCallbackArg(in long nonCallback, in [Callback] TestCallback callback);
+        void    methodWithCallbackAndOptionalArg(in [Callback, Optional] TestCallback callback);
+#endif
+
         // 'ConvertScriptString' extended attribute
         readonly attribute [ConvertScriptString] DOMString scriptStringAttr;
 
diff --git a/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 09d99f8..5584eaf 100644
--- a/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -33,6 +33,7 @@
 #include "V8DOMWrapper.h"
 #include "V8IsolatedContext.h"
 #include "V8Proxy.h"
+#include "V8TestCallback.h"
 #include "V8log.h"
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
@@ -154,6 +155,38 @@ static void testObjAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Valu
     return;
 }
 
+static v8::Handle<v8::Value> XMLObjAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.XMLObjAttr._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    return toV8(imp->xmlObjAttr());
+}
+
+static void XMLObjAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.XMLObjAttr._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    TestObj* v = V8TestObj::HasInstance(value) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(value)) : 0;
+    imp->setXMLObjAttr(WTF::getPtr(v));
+    return;
+}
+
+static v8::Handle<v8::Value> CREATEAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.CREATE._get");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    return v8Boolean(imp->isCreate());
+}
+
+static void CREATEAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.TestObj.CREATE._set");
+    TestObj* imp = V8TestObj::toNative(info.Holder());
+    bool v = value->BooleanValue();
+    imp->setCreate(v);
+    return;
+}
+
 static v8::Handle<v8::Value> reflectedStringAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.reflectedStringAttr._get");
@@ -862,6 +895,44 @@ static v8::Handle<v8::Value> methodWithNonOptionalArgAndTwoOptionalArgsCallback(
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> methodWithCallbackArgCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithCallbackArg");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    if (args.Length() <= 0 || !args[0]->IsObject())
+        return throwError(TYPE_MISMATCH_ERR);
+    RefPtr<TestCallback> callback = V8TestCallback::create(args[0]);
+    imp->methodWithCallbackArg(callback);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> methodWithNonCallbackArgAndCallbackArgCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithNonCallbackArgAndCallbackArg");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    int nonCallback = toInt32(args[0]);
+    if (args.Length() <= 1 || !args[1]->IsObject())
+        return throwError(TYPE_MISMATCH_ERR);
+    RefPtr<TestCallback> callback = V8TestCallback::create(args[1]);
+    imp->methodWithNonCallbackArgAndCallbackArg(nonCallback, callback);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> methodWithCallbackAndOptionalArgCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.methodWithCallbackAndOptionalArg");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    if (args.Length() <= 0) {
+        imp->methodWithCallbackAndOptionalArg();
+        return v8::Handle<v8::Value>();
+    }
+    if (args.Length() <= 0 || !args[0]->IsObject())
+        return throwError(TYPE_MISMATCH_ERR);
+    RefPtr<TestCallback> callback = V8TestCallback::create(args[0]);
+    imp->methodWithCallbackAndOptionalArg(callback);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> overloadedMethod1Callback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.overloadedMethod1");
@@ -938,6 +1009,10 @@ static const BatchedAttribute TestObjAttrs[] = {
     {"stringAttr", TestObjInternal::stringAttrAttrGetter, TestObjInternal::stringAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'testObjAttr' (Type: 'attribute' ExtAttr: '')
     {"testObjAttr", TestObjInternal::testObjAttrAttrGetter, TestObjInternal::testObjAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'XMLObjAttr' (Type: 'attribute' ExtAttr: '')
+    {"XMLObjAttr", TestObjInternal::XMLObjAttrAttrGetter, TestObjInternal::XMLObjAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
+    // Attribute 'CREATE' (Type: 'attribute' ExtAttr: '')
+    {"CREATE", TestObjInternal::CREATEAttrGetter, TestObjInternal::CREATEAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'reflectedStringAttr' (Type: 'attribute' ExtAttr: 'Reflect')
     {"reflectedStringAttr", TestObjInternal::reflectedStringAttrAttrGetter, TestObjInternal::reflectedStringAttrAttrSetter, 0 /* no data */, static_cast<v8::AccessControl>(v8::DEFAULT), static_cast<v8::PropertyAttribute>(v8::None), 0 /* on instance */},
     // Attribute 'reflectedIntegralAttr' (Type: 'attribute' ExtAttr: 'Reflect')
@@ -1013,6 +1088,7 @@ static const BatchedCallback TestObjCallbacks[] = {
     {"methodWithOptionalArg", TestObjInternal::methodWithOptionalArgCallback},
     {"methodWithNonOptionalArgAndOptionalArg", TestObjInternal::methodWithNonOptionalArgAndOptionalArgCallback},
     {"methodWithNonOptionalArgAndTwoOptionalArgs", TestObjInternal::methodWithNonOptionalArgAndTwoOptionalArgsCallback},
+    {"methodWithCallbackAndOptionalArg", TestObjInternal::methodWithCallbackAndOptionalArgCallback},
     {"overloadedMethod", TestObjInternal::overloadedMethodCallback},
 };
 static const BatchedConstant TestObjConsts[] = {
@@ -1085,6 +1161,18 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     v8::Handle<v8::FunctionTemplate> customArgsAndExceptionArgv[customArgsAndExceptionArgc] = { V8log::GetRawTemplate() };
     v8::Handle<v8::Signature> customArgsAndExceptionSignature = v8::Signature::New(desc, customArgsAndExceptionArgc, customArgsAndExceptionArgv);
     proto->Set(v8::String::New("customArgsAndException"), v8::FunctionTemplate::New(TestObjInternal::customArgsAndExceptionCallback, v8::Handle<v8::Value>(), customArgsAndExceptionSignature));
+
+    // Custom Signature 'methodWithCallbackArg'
+    const int methodWithCallbackArgArgc = 1;
+    v8::Handle<v8::FunctionTemplate> methodWithCallbackArgArgv[methodWithCallbackArgArgc] = { V8TestCallback::GetRawTemplate() };
+    v8::Handle<v8::Signature> methodWithCallbackArgSignature = v8::Signature::New(desc, methodWithCallbackArgArgc, methodWithCallbackArgArgv);
+    proto->Set(v8::String::New("methodWithCallbackArg"), v8::FunctionTemplate::New(TestObjInternal::methodWithCallbackArgCallback, v8::Handle<v8::Value>(), methodWithCallbackArgSignature));
+
+    // Custom Signature 'methodWithNonCallbackArgAndCallbackArg'
+    const int methodWithNonCallbackArgAndCallbackArgArgc = 2;
+    v8::Handle<v8::FunctionTemplate> methodWithNonCallbackArgAndCallbackArgArgv[methodWithNonCallbackArgAndCallbackArgArgc] = { v8::Handle<v8::FunctionTemplate>(), V8TestCallback::GetRawTemplate() };
+    v8::Handle<v8::Signature> methodWithNonCallbackArgAndCallbackArgSignature = v8::Signature::New(desc, methodWithNonCallbackArgAndCallbackArgArgc, methodWithNonCallbackArgAndCallbackArgArgv);
+    proto->Set(v8::String::New("methodWithNonCallbackArgAndCallbackArg"), v8::FunctionTemplate::New(TestObjInternal::methodWithNonCallbackArgAndCallbackArgCallback, v8::Handle<v8::Value>(), methodWithNonCallbackArgAndCallbackArgSignature));
     batchConfigureConstants(desc, proto, TestObjConsts, sizeof(TestObjConsts) / sizeof(*TestObjConsts));
 
     // Custom toString template
diff --git a/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp b/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
index def1120..2ec3dcd 100644
--- a/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
@@ -33,10 +33,10 @@
 
 #include "SerializedScriptValue.h"
 #include "V8IDBDatabaseRequest.h"
-#include "V8IDBIndexRequest.h"
+#include "V8IDBFactory.h"
+#include "V8IDBIndex.h"
 #include "V8IDBKey.h"
 #include "V8IDBObjectStoreRequest.h"
-#include "V8IndexedDatabaseRequest.h"
 
 namespace WebCore {
 
@@ -52,14 +52,14 @@ v8::Handle<v8::Value> toV8(IDBAny* impl)
         return v8::Null();
     case IDBAny::IDBDatabaseRequestType:
         return toV8(impl->idbDatabaseRequest());
-    case IDBAny::IDBIndexRequestType:
-        return toV8(impl->idbIndexRequest());
+    case IDBAny::IDBIndexType:
+        return toV8(impl->idbIndex());
     case IDBAny::IDBKeyType:
         return toV8(impl->idbKey());
     case IDBAny::IDBObjectStoreRequestType:
         return toV8(impl->idbObjectStoreRequest());
-    case IDBAny::IndexedDatabaseRequestType:
-        return toV8(impl->indexedDatabaseRequest());
+    case IDBAny::IDBFactoryType:
+        return toV8(impl->idbFactory());
     case IDBAny::SerializedScriptValueType:
         return impl->serializedScriptValue()->deserialize();
     }