Merge WebKit r47420

43 files changed, 394 insertions, 276 deletions

diff --git a/WebCore/html/CollectionType.h b/WebCore/html/CollectionType.h
index e5973a3..9d7bb54 100644
--- a/WebCore/html/CollectionType.h
+++ b/WebCore/html/CollectionType.h
@@ -51,6 +51,7 @@ enum CollectionType {
     TSectionRows, // all row elements in this table section
     TRCells,      // all cells in this row
     SelectOptions,
+    DataListOptions,
     MapAreas,
 
     OtherCollection
diff --git a/WebCore/html/HTMLAreaElement.cpp b/WebCore/html/HTMLAreaElement.cpp
index b878a1a..b2e4129 100644
--- a/WebCore/html/HTMLAreaElement.cpp
+++ b/WebCore/html/HTMLAreaElement.cpp
@@ -36,7 +36,6 @@ using namespace HTMLNames;
 
 HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
     : HTMLAnchorElement(tagName, document)
-    , m_coords(0)
     , m_coordsLen(0)
     , m_lastSize(-1, -1)
     , m_shape(Unknown)
@@ -46,7 +45,6 @@ HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* documen
 
 HTMLAreaElement::~HTMLAreaElement()
 {
-    delete [] m_coords;
 }
 
 void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
@@ -61,8 +59,7 @@ void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
         else if (equalIgnoringCase(attr->value(), "rect"))
             m_shape = Rect;
     } else if (attr->name() == coordsAttr) {
-        delete [] m_coords;
-        m_coords = newCoordsArray(attr->value().string(), m_coordsLen);
+        m_coords.set(newCoordsArray(attr->value().string(), m_coordsLen));
     } else if (attr->name() == altAttr || attr->name() == accesskeyAttr) {
         // Do nothing.
     } else
diff --git a/WebCore/html/HTMLAreaElement.h b/WebCore/html/HTMLAreaElement.h
index fffd45e..fd308b6 100644
--- a/WebCore/html/HTMLAreaElement.h
+++ b/WebCore/html/HTMLAreaElement.h
@@ -25,6 +25,7 @@
 
 #include "HTMLAnchorElement.h"
 #include "IntSize.h"
+#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -58,7 +59,7 @@ private:
     Path getRegion(const IntSize&) const;
 
     OwnPtr<Path> m_region;
-    Length* m_coords;
+    OwnArrayPtr<Length> m_coords;
     int m_coordsLen;
     IntSize m_lastSize;
     Shape m_shape;
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index be6663f..df26d93 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -338,7 +338,7 @@ EventListener* HTMLBodyElement::onblur() const
 
 void HTMLBodyElement::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onerror() const
@@ -348,7 +348,7 @@ EventListener* HTMLBodyElement::onerror() const
 
 void HTMLBodyElement::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onfocus() const
@@ -358,7 +358,7 @@ EventListener* HTMLBodyElement::onfocus() const
 
 void HTMLBodyElement::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onload() const
@@ -368,7 +368,7 @@ EventListener* HTMLBodyElement::onload() const
 
 void HTMLBodyElement::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onbeforeunload() const
@@ -378,9 +378,19 @@ EventListener* HTMLBodyElement::onbeforeunload() const
 
 void HTMLBodyElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
+EventListener* HTMLBodyElement::onhashchange() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().hashchangeEvent);
+}
+
+void HTMLBodyElement::setOnhashchange(PassRefPtr<EventListener> eventListener)
+{
+    document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, eventListener);
+}    
+                                                                                
 EventListener* HTMLBodyElement::onmessage() const
 {
     return document()->getWindowAttributeEventListener(eventNames().messageEvent);
@@ -388,7 +398,7 @@ EventListener* HTMLBodyElement::onmessage() const
 
 void HTMLBodyElement::setOnmessage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().messageEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onoffline() const
@@ -398,7 +408,7 @@ EventListener* HTMLBodyElement::onoffline() const
 
 void HTMLBodyElement::setOnoffline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().offlineEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::ononline() const
@@ -408,7 +418,7 @@ EventListener* HTMLBodyElement::ononline() const
 
 void HTMLBodyElement::setOnonline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onresize() const
@@ -418,7 +428,7 @@ EventListener* HTMLBodyElement::onresize() const
 
 void HTMLBodyElement::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onstorage() const
@@ -428,7 +438,7 @@ EventListener* HTMLBodyElement::onstorage() const
 
 void HTMLBodyElement::setOnstorage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* HTMLBodyElement::onunload() const
@@ -438,7 +448,7 @@ EventListener* HTMLBodyElement::onunload() const
 
 void HTMLBodyElement::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index 575d562..d5efab3 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -57,6 +57,8 @@ public:
     void setOnbeforeunload(PassRefPtr<EventListener>);
     EventListener* onmessage() const;
     void setOnmessage(PassRefPtr<EventListener>);
+    EventListener* onhashchange() const;
+    void setOnhashchange(PassRefPtr<EventListener>);
     EventListener* onoffline() const;
     void setOnoffline(PassRefPtr<EventListener>);
     EventListener* ononline() const;
diff --git a/WebCore/html/HTMLBodyElement.idl b/WebCore/html/HTMLBodyElement.idl
index 097b4ac..7be6803 100644
--- a/WebCore/html/HTMLBodyElement.idl
+++ b/WebCore/html/HTMLBodyElement.idl
@@ -36,6 +36,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -43,10 +44,15 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
+        // Overrides of Element attributes (left in for completeness).
+        // attribute [DontEnum] EventListener onblur;
+        // attribute [DontEnum] EventListener onerror;
+        // attribute [DontEnum] EventListener onfocus;
+        // attribute [DontEnum] EventListener onload;
+
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/WebCore/html/HTMLCanvasElement.h b/WebCore/html/HTMLCanvasElement.h
index bba1f2d..6961957 100644
--- a/WebCore/html/HTMLCanvasElement.h
+++ b/WebCore/html/HTMLCanvasElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,7 +35,6 @@
 namespace WebCore {
 
 class CanvasRenderingContext2D;
-typedef CanvasRenderingContext2D CanvasRenderingContext;
 class FloatPoint;
 class FloatRect;
 class FloatSize;
@@ -45,9 +44,11 @@ class ImageBuffer;
 class IntPoint;
 class IntSize;
 
+typedef CanvasRenderingContext2D CanvasRenderingContext;
+
 class CanvasObserver {
 public:
-    virtual ~CanvasObserver() {};
+    virtual ~CanvasObserver() { }
 
     virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
     virtual void canvasResized(HTMLCanvasElement*) = 0;
@@ -59,11 +60,6 @@ public:
     HTMLCanvasElement(const QualifiedName&, Document*);
     virtual ~HTMLCanvasElement();
 
-#if ENABLE(DASHBOARD_SUPPORT)
-    virtual HTMLTagStatus endTagRequirement() const;
-    virtual int tagPriority() const;
-#endif
-
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
     void setWidth(int);
@@ -73,10 +69,7 @@ public:
 
     CanvasRenderingContext* getContext(const String&);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    IntSize size() const { return m_size; }
+    const IntSize& size() const { return m_size; }
     void setSize(const IntSize& size)
     { 
         if (size == m_size)
@@ -103,15 +96,26 @@ public:
     void setOriginTainted() { m_originClean = false; } 
     bool originClean() const { return m_originClean; }
 
-    static const float MaxCanvasArea;
-
-    void setObserver(CanvasObserver* o) { m_observer = o; }
+    void setObserver(CanvasObserver* observer) { m_observer = observer; }
 
     TransformationMatrix baseTransform() const;
+
+    CanvasRenderingContext2D* renderingContext2D() { return m_2DContext.get(); }
+
 private:
+#if ENABLE(DASHBOARD_SUPPORT)
+    virtual HTMLTagStatus endTagRequirement() const;
+    virtual int tagPriority() const;
+#endif
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
     void createImageBuffer() const;
     void reset();
 
+    static const float MaxCanvasArea;
+
     bool m_rendererIsCanvas;
 
     OwnPtr<CanvasRenderingContext2D> m_2DContext;
diff --git a/WebCore/html/HTMLCanvasElement.idl b/WebCore/html/HTMLCanvasElement.idl
index 13fc623..4b1b057 100644
--- a/WebCore/html/HTMLCanvasElement.idl
+++ b/WebCore/html/HTMLCanvasElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 module html {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         InterfaceUUID=a14d88c8-c6af-4e34-ad17-659700c77a10,
         ImplementationUUID=7ae731bc-c264-4ee3-a4b4-5d4540af26c3
diff --git a/WebCore/html/HTMLCollection.cpp b/WebCore/html/HTMLCollection.cpp
index de4c424..76de60a 100644
--- a/WebCore/html/HTMLCollection.cpp
+++ b/WebCore/html/HTMLCollection.cpp
@@ -27,6 +27,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "HTMLOptionElement.h"
 #include "NodeList.h"
 
 #include <utility>
@@ -104,6 +105,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
         case MapAreas:
         case OtherCollection:
         case SelectOptions:
+        case DataListOptions:
         case WindowNamedItems:
             break;
         case NodeChildren:
@@ -153,6 +155,13 @@ Element* HTMLCollection::itemAfter(Element* previous) const
                 if (e->hasLocalName(optionTag))
                     return e;
                 break;
+            case DataListOptions:
+                if (e->hasLocalName(optionTag)) {
+                    HTMLOptionElement* option = static_cast<HTMLOptionElement*>(e);
+                    if (!option->disabled() && !option->value().isEmpty())
+                        return e;
+                }
+                break;
             case MapAreas:
                 if (e->hasLocalName(areaTag))
                     return e;
diff --git a/WebCore/html/HTMLDataListElement.cpp b/WebCore/html/HTMLDataListElement.cpp
new file mode 100644
index 0000000..a6ca525
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATALIST)
+#include "HTMLDataListElement.h"
+
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+HTMLDataListElement::HTMLDataListElement(const QualifiedName& tagName, Document *doc)
+    : HTMLElement(tagName, doc)
+{
+}
+
+HTMLDataListElement::~HTMLDataListElement()
+{
+}
+
+bool HTMLDataListElement::checkDTD(const Node* newChild)
+{
+    return newChild->hasTagName(HTMLNames::optionTag) || HTMLElement::inInlineTagList(newChild);
+}
+
+PassRefPtr<HTMLCollection> HTMLDataListElement::options()
+{
+    return HTMLCollection::create(this, DataListOptions);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
diff --git a/WebCore/html/HTMLDataListElement.h b/WebCore/html/HTMLDataListElement.h
new file mode 100644
index 0000000..8c4cfbc
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLDataListElement_h
+#define HTMLDataListElement_h
+
+#if ENABLE(DATALIST)
+
+#include "HTMLCollection.h"
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+    class HTMLDataListElement : public HTMLElement {
+    public:
+        HTMLDataListElement(const QualifiedName&, Document*);
+        virtual ~HTMLDataListElement();
+        PassRefPtr<HTMLCollection> options();
+
+    private:
+        virtual bool checkDTD(const Node*);
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
+
+#endif  // HTMLDataListElement_h
diff --git a/WebCore/html/HTMLDataListElement.idl b/WebCore/html/HTMLDataListElement.idl
new file mode 100644
index 0000000..916c0a1
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        GenerateConstructor,
+        Conditional=DATALIST
+    ] HTMLDataListElement : HTMLElement {
+        readonly attribute HTMLCollection options;
+    };
+}
diff --git a/WebCore/html/HTMLDocument.cpp b/WebCore/html/HTMLDocument.cpp
index 2457c4f..c995bbb 100644
--- a/WebCore/html/HTMLDocument.cpp
+++ b/WebCore/html/HTMLDocument.cpp
@@ -114,14 +114,14 @@ String HTMLDocument::dir()
     HTMLElement* b = body();
     if (!b)
         return String();
-    return b->dir();
+    return b->getAttribute(dirAttr);
 }
 
 void HTMLDocument::setDir(const String& value)
 {
     HTMLElement* b = body();
     if (b)
-        b->setDir(value);
+        b->setAttribute(dirAttr, value);
 }
 
 String HTMLDocument::designMode() const
diff --git a/WebCore/html/HTMLDocument.h b/WebCore/html/HTMLDocument.h
index eda7593..4b14d0c 100644
--- a/WebCore/html/HTMLDocument.h
+++ b/WebCore/html/HTMLDocument.h
@@ -37,7 +37,7 @@ class HTMLDocument : public Document, public CachedResourceClient {
 public:
     static PassRefPtr<HTMLDocument> create(Frame* frame)
     {
-        return new HTMLDocument(frame);
+        return adoptRef(new HTMLDocument(frame));
     }
     virtual ~HTMLDocument();
 
@@ -71,10 +71,6 @@ public:
     void captureEvents();
     void releaseEvents();
 
-    virtual bool childAllowed(Node*);
-
-    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
-
     void addNamedItem(const AtomicString& name);
     void removeNamedItem(const AtomicString& name);
     bool hasNamedItem(AtomicStringImpl* name);
@@ -87,6 +83,10 @@ protected:
     HTMLDocument(Frame*);
 
 private:
+    virtual bool childAllowed(Node*);
+
+    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
+
     virtual bool isHTMLDocument() const { return true; }
     virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index b310cad..7a23d94 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -257,7 +257,7 @@ PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String
         hasLocalName(headTag) || hasLocalName(styleTag) || hasLocalName(titleTag))
         return 0;
 
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     
     if (document()->isHTMLDocument())
          parseHTMLDocumentFragment(html, fragment.get());
@@ -319,7 +319,7 @@ static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<Documen
     }
 
     if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->string(), ec);
+        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->data(), ec);
         return;
     }
 
@@ -339,7 +339,7 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
         return;
     }
 
-    RefPtr<Text> textNode = new Text(element->document(), text);
+    RefPtr<Text> textNode = Text::create(element->document(), text);
 
     if (hasOneChild(element)) {
         element->replaceChild(textNode.release(), element->firstChild(), ec);
@@ -425,7 +425,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
 
     // Add text nodes and <br> elements.
     ec = 0;
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     int lineStart = 0;
     UChar prev = 0;
     int length = text.length();
@@ -433,7 +433,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         UChar c = text[i];
         if (c == '\n' || c == '\r') {
             if (i > lineStart) {
-                fragment->appendChild(new Text(document(), text.substring(lineStart, i - lineStart)), ec);
+                fragment->appendChild(Text::create(document(), text.substring(lineStart, i - lineStart)), ec);
                 if (ec)
                     return;
             }
@@ -447,7 +447,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         prev = c;
     }
     if (length > lineStart)
-        fragment->appendChild(new Text(document(), text.substring(lineStart, length - lineStart)), ec);
+        fragment->appendChild(Text::create(document(), text.substring(lineStart, length - lineStart)), ec);
     replaceChildrenWithFragment(this, fragment.release(), ec);
 }
 
@@ -475,7 +475,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
     // FIXME: This creates a new text node even when the text is empty.
     // FIXME: This creates a single text node even when the text has CR and LF
     // characters in it. Instead it should create <br> elements.
-    RefPtr<Text> t = new Text(document(), text);
+    RefPtr<Text> t = Text::create(document(), text);
     ec = 0;
     parent->replaceChild(t, this, ec);
     if (ec)
@@ -737,56 +737,11 @@ void HTMLElement::accessKeyAction(bool sendToAnyElement)
         dispatchSimulatedClick(0, true);
 }
 
-String HTMLElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void HTMLElement::setId(const String& value)
-{
-    setAttribute(idAttr, value);
-}
-
 String HTMLElement::title() const
 {
     return getAttribute(titleAttr);
 }
 
-void HTMLElement::setTitle(const String& value)
-{
-    setAttribute(titleAttr, value);
-}
-
-String HTMLElement::lang() const
-{
-    return getAttribute(langAttr);
-}
-
-void HTMLElement::setLang(const String& value)
-{
-    setAttribute(langAttr, value);
-}
-
-String HTMLElement::dir() const
-{
-    return getAttribute(dirAttr);
-}
-
-void HTMLElement::setDir(const String &value)
-{
-    setAttribute(dirAttr, value);
-}
-
-String HTMLElement::className() const
-{
-    return getAttribute(classAttr);
-}
-
-void HTMLElement::setClassName(const String &value)
-{
-    setAttribute(classAttr, value);
-}
-
 short HTMLElement::tabIndex() const
 {
     if (supportsFocus())
@@ -894,6 +849,7 @@ static HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(textareaTag.localName().impl());
         tagList.add(labelTag.localName().impl());
         tagList.add(buttonTag.localName().impl());
+        tagList.add(datalistTag.localName().impl());
         tagList.add(insTag.localName().impl());
         tagList.add(delTag.localName().impl());
         tagList.add(nobrTag.localName().impl());
diff --git a/WebCore/html/HTMLElement.h b/WebCore/html/HTMLElement.h
index 21b3bb5..d7485e8 100644
--- a/WebCore/html/HTMLElement.h
+++ b/WebCore/html/HTMLElement.h
@@ -47,16 +47,7 @@ public:
 
     PassRefPtr<HTMLCollection> children();
     
-    String id() const;
-    void setId(const String&);
     virtual String title() const;
-    void setTitle(const String&);
-    String lang() const;
-    void setLang(const String&);
-    String dir() const;
-    void setDir(const String&);
-    String className() const;
-    void setClassName(const String&);
     virtual short tabIndex() const;
     void setTabIndex(int);
 
diff --git a/WebCore/html/HTMLEmbedElement.idl b/WebCore/html/HTMLEmbedElement.idl
index a38402c..05c10db 100644
--- a/WebCore/html/HTMLEmbedElement.idl
+++ b/WebCore/html/HTMLEmbedElement.idl
@@ -29,17 +29,17 @@ module html {
         InterfaceUUID=18f9bd58-6bb3-4b5c-aa30-6da13adfc91e,
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
-                 attribute [ConvertNullToNullString] DOMString align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString align;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
 #endif
-                 attribute [ConvertNullToNullString] DOMString name;
-                 attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type;
+                 attribute [ConvertNullToNullString, Reflect] DOMString name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString type;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 09d91df..3d8bc78 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -294,6 +294,11 @@ HTMLFormElement* HTMLFormControlElement::virtualForm() const
     return m_form;
 }
 
+bool HTMLFormControlElement::isDefaultButtonForForm() const
+{
+    return isSuccessfulSubmitButton() && m_form && m_form->defaultButton() == this;
+}
+
 void HTMLFormControlElement::removeFromForm()
 {
     if (!m_form)
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index a30f46c..902bbf3 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -117,6 +117,7 @@ protected:
 
 private:
     virtual HTMLFormElement* virtualForm() const;
+    virtual bool isDefaultButtonForForm() const;
 
     HTMLFormElement* m_form;
     RefPtr<ValidityState> m_validityState;
diff --git a/WebCore/html/HTMLFormElement.cpp b/WebCore/html/HTMLFormElement.cpp
index 54986b0..51fb35f 100644
--- a/WebCore/html/HTMLFormElement.cpp
+++ b/WebCore/html/HTMLFormElement.cpp
@@ -577,6 +577,17 @@ void HTMLFormElement::setTarget(const String &value)
     setAttribute(targetAttr, value);
 }
 
+HTMLFormControlElement* HTMLFormElement::defaultButton() const
+{
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (control->isSuccessfulSubmitButton())
+            return control;
+    }
+
+    return 0;
+}
+
 PassRefPtr<HTMLFormControlElement> HTMLFormElement::elementForAlias(const AtomicString& alias)
 {
     if (alias.isEmpty() || !m_elementAliases)
diff --git a/WebCore/html/HTMLFormElement.h b/WebCore/html/HTMLFormElement.h
index 6b7812a..afe1ff0 100644
--- a/WebCore/html/HTMLFormElement.h
+++ b/WebCore/html/HTMLFormElement.h
@@ -107,6 +107,8 @@ public:
 
     virtual String target() const;
     void setTarget(const String&);
+
+    HTMLFormControlElement* defaultButton() const;
     
     PassRefPtr<HTMLFormControlElement> elementForAlias(const AtomicString&);
     void addElementAlias(HTMLFormControlElement*, const AtomicString& alias);
diff --git a/WebCore/html/HTMLFrameElement.cpp b/WebCore/html/HTMLFrameElement.cpp
index adc3ff1..d87386f 100644
--- a/WebCore/html/HTMLFrameElement.cpp
+++ b/WebCore/html/HTMLFrameElement.cpp
@@ -1,9 +1,9 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,6 +38,7 @@ HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* docum
     : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
+    , m_noResize(false)
 {
     ASSERT(hasTagName(frameTag));
 }
@@ -45,7 +46,7 @@ HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* docum
 bool HTMLFrameElement::rendererIsNeeded(RenderStyle*)
 {
     // For compatibility, frames render even when display: none is set.
-    return isURLAllowed(m_URL);
+    return isURLAllowed();
 }
 
 RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -79,8 +80,20 @@ void HTMLFrameElement::parseMappedAttribute(MappedAttribute *attr)
         m_frameBorder = attr->value().toInt();
         m_frameBorderSet = !attr->isNull();
         // FIXME: If we are already attached, this has no effect.
+    } else if (attr->name() == noresizeAttr) {
+        m_noResize = true;
+        // FIXME: If we are already attached, this has no effect.
+        // FIXME: Since this does not check attr->isNull(), it can
+        // never reset m_noResize to false if the attribute is removed.
+        // FIXME: There seems to be no code that looks at this
+        // value and prevents resizing.
     } else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
+void HTMLFrameElement::setNoResize(bool noResize)
+{
+    setAttribute(noresizeAttr, noResize ? "" : 0);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.h b/WebCore/html/HTMLFrameElement.h
index ab602ee..23b5acb 100644
--- a/WebCore/html/HTMLFrameElement.h
+++ b/WebCore/html/HTMLFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -49,9 +49,14 @@ public:
 
     bool hasFrameBorder() const { return m_frameBorder; }
 
+    bool noResize() const { return m_noResize; }
+    void setNoResize(bool);
+
 private:
     bool m_frameBorder;
     bool m_frameBorderSet;
+
+    bool m_noResize;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.idl b/WebCore/html/HTMLFrameElement.idl
index 106e57e..d0076eb 100644
--- a/WebCore/html/HTMLFrameElement.idl
+++ b/WebCore/html/HTMLFrameElement.idl
@@ -26,14 +26,14 @@ module html {
         ImplementationUUID=38c9e3c8-3384-40b6-a484-cb845c48b67d
     ] HTMLFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
                  attribute boolean         noResize;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, ReflectURL] DOMString       src;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index a4f0a5e..282dee3 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -50,18 +50,17 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
-    , m_noResize(false)
     , m_viewSource(false)
     , m_shouldOpenURLAfterAttach(false)
 {
 }
 
-bool HTMLFrameElementBase::isURLAllowed(const AtomicString& URLString) const
+bool HTMLFrameElementBase::isURLAllowed() const
 {
-    if (URLString.isEmpty())
+    if (m_URL.isEmpty())
         return true;
 
-    const KURL& completeURL = document()->completeURL(URLString);
+    const KURL& completeURL = document()->completeURL(m_URL);
 
     // Don't allow more than 200 total frames in a set. This seems
     // like a reasonable upper bound, and otherwise mutually recursive
@@ -93,7 +92,7 @@ void HTMLFrameElementBase::openURL()
 {
     ASSERT(!m_frameName.isEmpty());
 
-    if (!isURLAllowed(m_URL))
+    if (!isURLAllowed())
         return;
 
     if (m_URL.isEmpty())
@@ -127,9 +126,6 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == marginheightAttr) {
         m_marginHeight = attr->value().toInt();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == noresizeAttr) {
-        m_noResize = true;
-        // FIXME: If we are already attached, this has no effect.
     } else if (attr->name() == scrollingAttr) {
         // Auto and yes both simply mean "allow scrolling." No means "don't allow scrolling."
         if (equalIgnoringCase(attr->value(), "auto") || equalIgnoringCase(attr->value(), "yes"))
@@ -283,11 +279,6 @@ void HTMLFrameElementBase::setName(const String &value)
     setAttribute(nameAttr, value);
 }
 
-void HTMLFrameElementBase::setNoResize(bool noResize)
-{
-    setAttribute(noresizeAttr, noResize ? "" : 0);
-}
-
 String HTMLFrameElementBase::scrolling() const
 {
     return getAttribute(scrollingAttr);
diff --git a/WebCore/html/HTMLFrameElementBase.h b/WebCore/html/HTMLFrameElementBase.h
index 4a24451..ad55ee1 100644
--- a/WebCore/html/HTMLFrameElementBase.h
+++ b/WebCore/html/HTMLFrameElementBase.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -67,9 +67,6 @@ public:
     String name() const;
     void setName(const String&);
 
-    bool noResize() const { return m_noResize; }
-    void setNoResize(bool);
-
     String scrolling() const;
     void setScrolling(const String&);
 
@@ -84,7 +81,7 @@ public:
 protected:
     HTMLFrameElementBase(const QualifiedName&, Document*);
 
-    bool isURLAllowed(const AtomicString&) const;
+    bool isURLAllowed() const;
     void setNameAndOpenURL();
     void openURL();
 
@@ -98,7 +95,6 @@ protected:
     int m_marginWidth;
     int m_marginHeight;
 
-    bool m_noResize;
     bool m_viewSource;
 
     bool m_shouldOpenURLAfterAttach;
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index a8f544b..235bb9f 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -240,7 +240,7 @@ EventListener* HTMLFrameSetElement::onblur() const
 
 void HTMLFrameSetElement::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onerror() const
@@ -250,7 +250,7 @@ EventListener* HTMLFrameSetElement::onerror() const
 
 void HTMLFrameSetElement::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onfocus() const
@@ -260,9 +260,19 @@ EventListener* HTMLFrameSetElement::onfocus() const
 
 void HTMLFrameSetElement::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
+EventListener* HTMLFrameSetElement::onhashchange() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().hashchangeEvent);
+}
+
+void HTMLFrameSetElement::setOnhashchange(PassRefPtr<EventListener> eventListener)
+{
+    document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, eventListener);
+}   
+
 EventListener* HTMLFrameSetElement::onload() const
 {
     return document()->getWindowAttributeEventListener(eventNames().loadEvent);
@@ -270,7 +280,7 @@ EventListener* HTMLFrameSetElement::onload() const
 
 void HTMLFrameSetElement::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onbeforeunload() const
@@ -280,7 +290,7 @@ EventListener* HTMLFrameSetElement::onbeforeunload() const
 
 void HTMLFrameSetElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onmessage() const
@@ -290,7 +300,7 @@ EventListener* HTMLFrameSetElement::onmessage() const
 
 void HTMLFrameSetElement::setOnmessage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().messageEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onoffline() const
@@ -300,7 +310,7 @@ EventListener* HTMLFrameSetElement::onoffline() const
 
 void HTMLFrameSetElement::setOnoffline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().offlineEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::ononline() const
@@ -310,7 +320,7 @@ EventListener* HTMLFrameSetElement::ononline() const
 
 void HTMLFrameSetElement::setOnonline(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onresize() const
@@ -320,7 +330,7 @@ EventListener* HTMLFrameSetElement::onresize() const
 
 void HTMLFrameSetElement::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onstorage() const
@@ -330,7 +340,7 @@ EventListener* HTMLFrameSetElement::onstorage() const
 
 void HTMLFrameSetElement::setOnstorage(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* HTMLFrameSetElement::onunload() const
@@ -340,7 +350,7 @@ EventListener* HTMLFrameSetElement::onunload() const
 
 void HTMLFrameSetElement::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+    document()->setWindowAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.h b/WebCore/html/HTMLFrameSetElement.h
index 4319c7a..b51e702 100644
--- a/WebCore/html/HTMLFrameSetElement.h
+++ b/WebCore/html/HTMLFrameSetElement.h
@@ -79,6 +79,8 @@ public:
 
     EventListener* onbeforeunload() const;
     void setOnbeforeunload(PassRefPtr<EventListener>);
+    EventListener* onhashchange() const;
+    void setOnhashchange(PassRefPtr<EventListener>);
     EventListener* onmessage() const;
     void setOnmessage(PassRefPtr<EventListener>);
     EventListener* onoffline() const;
diff --git a/WebCore/html/HTMLFrameSetElement.idl b/WebCore/html/HTMLFrameSetElement.idl
index 4050f2c..0375c0a 100644
--- a/WebCore/html/HTMLFrameSetElement.idl
+++ b/WebCore/html/HTMLFrameSetElement.idl
@@ -33,6 +33,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -40,7 +41,7 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
-        // Overrides of Element attributes.
+        // Overrides of Element attributes (left in for completeness).
         // attribute [DontEnum] EventListener onblur;
         // attribute [DontEnum] EventListener onerror;
         // attribute [DontEnum] EventListener onfocus;
@@ -49,7 +50,6 @@ module html {
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index 478925a..123b134 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -89,7 +89,7 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool HTMLIFrameElement::rendererIsNeeded(RenderStyle* style)
 {
-    return isURLAllowed(m_URL) && style->display() != NONE;
+    return isURLAllowed() && style->display() != NONE;
 }
 
 RenderObject* HTMLIFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index b5684ca..e288b54 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,16 +26,16 @@ module html {
         ImplementationUUID=370c6318-f804-49f9-bc8a-46b99cd87399
     ] HTMLIFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       height;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index 5173964..932e718 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -279,46 +279,11 @@ bool HTMLImageElement::isURLAttribute(Attribute* attr) const
         || (attr->name() == usemapAttr && attr->value().string()[0] != '#');
 }
 
-String HTMLImageElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLImageElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
-String HTMLImageElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLImageElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLImageElement::alt() const
+const AtomicString& HTMLImageElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLImageElement::setAlt(const String& value)
-{
-    setAttribute(altAttr, value);
-}
-
-String HTMLImageElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLImageElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
 bool HTMLImageElement::draggable() const
 {
     // Image elements are draggable by default.
@@ -381,16 +346,6 @@ void HTMLImageElement::setSrc(const String& value)
     setAttribute(srcAttr, value);
 }
 
-String HTMLImageElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLImageElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLImageElement::vspace() const
 {
     // ### return actual vspace
@@ -439,7 +394,8 @@ void HTMLImageElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
     HTMLElement::addSubresourceAttributeURLs(urls);
 
     addSubresourceURL(urls, src());
-    addSubresourceURL(urls, document()->completeURL(useMap()));
+    // FIXME: What about when the usemap attribute begins with "#"?
+    addSubresourceURL(urls, document()->completeURL(getAttribute(usemapAttr)));
 }
 
 }
diff --git a/WebCore/html/HTMLImageElement.h b/WebCore/html/HTMLImageElement.h
index 5e82186..f58574d 100644
--- a/WebCore/html/HTMLImageElement.h
+++ b/WebCore/html/HTMLImageElement.h
@@ -69,17 +69,7 @@ public:
 
     void setLoadManually(bool loadManually) { m_imageLoader.setLoadManually(loadManually); }
 
-    String name() const;
-    void setName(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-
-    String alt() const;
-    void setAlt(const String&);
-
-    String border() const;
-    void setBorder(const String&);
+    const AtomicString& alt() const;
 
     virtual bool draggable() const;
 
@@ -100,9 +90,6 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
-    String useMap() const;
-    void setUseMap(const String&);
-
     int vspace() const;
     void setVspace(int);
 
diff --git a/WebCore/html/HTMLKeygenElement.cpp b/WebCore/html/HTMLKeygenElement.cpp
index b1b6238..6af088f 100644
--- a/WebCore/html/HTMLKeygenElement.cpp
+++ b/WebCore/html/HTMLKeygenElement.cpp
@@ -51,7 +51,7 @@ HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* doc
     for (Vector<String>::const_iterator it = keys.begin(); it != end; ++it) {
         HTMLOptionElement* o = new HTMLOptionElement(optionTag, doc, form());
         addChild(o);
-        o->addChild(new Text(doc, *it));
+        o->addChild(Text::create(doc, *it));
     }
 }
 
diff --git a/WebCore/html/HTMLObjectElement.idl b/WebCore/html/HTMLObjectElement.idl
index 1880836..d3fb5c0 100644
--- a/WebCore/html/HTMLObjectElement.idl
+++ b/WebCore/html/HTMLObjectElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,22 +30,22 @@ module html {
         ImplementationUUID=2dd24554-6784-4ef9-9713-179f3d37b2f9
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-                 attribute [ConvertNullToNullString] DOMString       code;
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       archive;
-                 attribute [ConvertNullToNullString] DOMString       border;
-                 attribute [ConvertNullToNullString] DOMString       codeBase;
-                 attribute [ConvertNullToNullString] DOMString       codeType;
-                 attribute [ConvertNullToNullString] DOMString       data;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       code;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       archive;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       border;
+                 attribute [ConvertNullToNullString, Reflect=codebase] DOMString       codeBase;
+                 attribute [ConvertNullToNullString, Reflect=codetype] DOMString       codeType;
+                 attribute [ConvertNullToNullString, ReflectURL] DOMString       data;
                  attribute boolean         declare;
-                 attribute [ConvertNullToNullString] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
                  attribute long            hspace;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       standby;
-                 attribute [ConvertNullToNullString] DOMString       type;
-                 attribute [ConvertNullToNullString] DOMString       useMap;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       standby;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       type;
+                 attribute [ConvertNullToNullString, Reflect=usemap] DOMString       useMap;
                  attribute long            vspace;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index 009db47..091b1a5 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -92,7 +92,7 @@ void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
     }
 
     removeChildren();
-    appendChild(new Text(document(), text), ec);
+    appendChild(Text::create(document(), text), ec);
 }
 
 void HTMLOptionElement::accessKeyAction(bool)
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 722f4e2..b12c09b 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -692,13 +692,13 @@ typedef HashMap<AtomicStringImpl*, CreateErrorCheckFunc> FunctionMap;
 
 bool HTMLParser::textCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Text(m_document, t->text.get());
+    result = Text::create(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::commentCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Comment(m_document, t->text.get());
+    result = Comment::create(m_document, t->text.get());
     return false;
 }
 
@@ -1093,6 +1093,7 @@ bool HTMLParser::isAffectedByResidualStyle(const AtomicString& tagName)
         unaffectedTags.add(selectTag.localName().impl());
         unaffectedTags.add(objectTag.localName().impl());
         unaffectedTags.add(datagridTag.localName().impl());
+        unaffectedTags.add(datalistTag.localName().impl());
     }
     
     return !unaffectedTags.contains(tagName.impl());
@@ -1598,7 +1599,7 @@ PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
     }
 
     n->addChild(new HTMLHRElement(hrTag, m_document));
-    n->addChild(new Text(m_document, text));
+    n->addChild(Text::create(m_document, text));
     n->addChild(isIndex.release());
     n->addChild(new HTMLHRElement(hrTag, m_document));
 
diff --git a/WebCore/html/HTMLTagNames.in b/WebCore/html/HTMLTagNames.in
index c066e3c..ed75652 100644
--- a/WebCore/html/HTMLTagNames.in
+++ b/WebCore/html/HTMLTagNames.in
@@ -26,6 +26,7 @@ code interfaceName=HTMLElement
 col interfaceName=HTMLTableColElement
 colgroup interfaceName=HTMLTableColElement
 datagrid interfaceName=HTMLDataGridElement,conditional=DATAGRID
+datalist interfaceName=HTMLDataListElement,conditional=DATALIST
 dcell interfaceName=HTMLDataGridCellElement,conditional=DATAGRID
 dcol interfaceName=HTMLDataGridColElement,conditional=DATAGRID
 drow interfaceName=HTMLDataGridRowElement,conditional=DATAGRID
diff --git a/WebCore/html/HTMLViewSourceDocument.cpp b/WebCore/html/HTMLViewSourceDocument.cpp
index 13404cc..55c6df7 100644
--- a/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/WebCore/html/HTMLViewSourceDocument.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,9 +47,6 @@ using namespace HTMLNames;
 HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeType)
     : HTMLDocument(frame)
     , m_type(mimeType)
-    , m_current(0)
-    , m_tbody(0)
-    , m_td(0)
 {
     setUsesBeforeAfterRules(true);
 }
@@ -70,23 +67,23 @@ Tokenizer* HTMLViewSourceDocument::createTokenizer()
 
 void HTMLViewSourceDocument::createContainingTable()
 {
-    RefPtr<Element> html = new HTMLHtmlElement(htmlTag, this);
+    RefPtr<HTMLHtmlElement> html = new HTMLHtmlElement(htmlTag, this);
     addChild(html);
     html->attach();
-    RefPtr<Element> body = new HTMLBodyElement(bodyTag, this);
+    RefPtr<HTMLBodyElement> body = new HTMLBodyElement(bodyTag, this);
     html->addChild(body);
     body->attach();
     
     // Create a line gutter div that can be used to make sure the gutter extends down the height of the whole
     // document.
-    RefPtr<Element> div = new HTMLDivElement(divTag, this);
+    RefPtr<HTMLDivElement> div = new HTMLDivElement(divTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
     body->addChild(div);
     div->attach();
 
-    RefPtr<Element> table = new HTMLTableElement(tableTag, this);
+    RefPtr<HTMLTableElement> table = new HTMLTableElement(tableTag, this);
     body->addChild(table);
     table->attach();
     m_tbody = new HTMLTableSectionElement(tbodyTag, this);
@@ -205,31 +202,31 @@ void HTMLViewSourceDocument::addViewSourceDoctypeToken(DoctypeToken* doctypeToke
     addText(text, "webkit-html-doctype");
 }
 
-Element* HTMLViewSourceDocument::addSpanWithClassName(const String& className)
+PassRefPtr<Element> HTMLViewSourceDocument::addSpanWithClassName(const String& className)
 {
     if (m_current == m_tbody) {
         addLine(className);
         return m_current;
     }
 
-    Element* span = new HTMLElement(spanTag, this);
+    RefPtr<HTMLElement> span = new HTMLElement(spanTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, className));
     span->setAttributeMap(attrs.release());
     m_current->addChild(span);
     span->attach();
-    return span;
+    return span.release();
 }
 
 void HTMLViewSourceDocument::addLine(const String& className)
 {
     // Create a table row.
-    RefPtr<Element> trow = new HTMLTableRowElement(trTag, this);
+    RefPtr<HTMLTableRowElement> trow = new HTMLTableRowElement(trTag, this);
     m_tbody->addChild(trow);
     trow->attach();
     
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
-    Element* td = new HTMLTableCellElement(tdTag, this);
+    RefPtr<HTMLTableCellElement> td = new HTMLTableCellElement(tdTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
@@ -246,7 +243,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     m_current = m_td = td;
 
 #ifdef DEBUG_LINE_NUMBERS
-    RefPtr<Text> lineNumberText = new Text(this, String::number(tokenizer()->lineNumber() + 1) + " ");
+    RefPtr<Text> lineNumberText = Text::create(this, String::number(tokenizer()->lineNumber() + 1) + " ");
     td->addChild(lineNumberText);
     lineNumberText->attach();
 #endif
@@ -277,7 +274,7 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         }
         if (m_current == m_tbody)
             addLine(className);
-        RefPtr<Text> t = new Text(this, substring);
+        RefPtr<Text> t = Text::create(this, substring);
         m_current->addChild(t);
         t->attach();
         if (i < size - 1)
@@ -289,13 +286,13 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         m_current = m_tbody;
 }
 
-Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
+PassRefPtr<Element> HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
 {
     if (m_current == m_tbody)
         addLine("webkit-html-tag");
     
     // Now create a link for the attribute value instead of a span.
-    Element* anchor = new HTMLAnchorElement(aTag, this);
+    RefPtr<HTMLAnchorElement> anchor = new HTMLAnchorElement(this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     const char* classValue;
     if (isAnchor)
@@ -308,7 +305,7 @@ Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
     anchor->setAttributeMap(attrs.release());
     m_current->addChild(anchor);
     anchor->attach();
-    return anchor;
+    return anchor.release();
 }
 
 }
diff --git a/WebCore/html/HTMLViewSourceDocument.h b/WebCore/html/HTMLViewSourceDocument.h
index 57a8f21..e4eadb0 100644
--- a/WebCore/html/HTMLViewSourceDocument.h
+++ b/WebCore/html/HTMLViewSourceDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,18 +30,18 @@
 namespace WebCore {
 
 class DoctypeToken;
+class HTMLTableCellElement;
+class HTMLTableSectionElement;
+
 struct Token;
 
 class HTMLViewSourceDocument : public HTMLDocument {
 public:
     static PassRefPtr<HTMLViewSourceDocument> create(Frame* frame, const String& mimeType)
     {
-        return new HTMLViewSourceDocument(frame, mimeType);
+        return adoptRef(new HTMLViewSourceDocument(frame, mimeType));
     }
 
-    // Returns HTMLTokenizer or TextTokenizer based on m_type.
-    virtual Tokenizer* createTokenizer();
-
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
@@ -49,16 +49,19 @@ public:
 private:
     HTMLViewSourceDocument(Frame*, const String& mimeType);
 
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
+    virtual Tokenizer* createTokenizer();
+
     void createContainingTable();
-    Element* addSpanWithClassName(const String&);
+    PassRefPtr<Element> addSpanWithClassName(const String&);
     void addLine(const String& className);
     void addText(const String& text, const String& className);
-    Element* addLink(const String& url, bool isAnchor);
+    PassRefPtr<Element> addLink(const String& url, bool isAnchor);
 
     String m_type;
-    Element* m_current;
-    Element* m_tbody;
-    Element* m_td;
+    RefPtr<Element> m_current;
+    RefPtr<HTMLTableSectionElement> m_tbody;
+    RefPtr<HTMLTableCellElement> m_td;
 };
 
 }
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 20718e9..7203e12 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1278,8 +1278,13 @@ static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
     return data.get();
 }
 
-PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh) const
+PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionCode& ec) const
 {
+    ec = 0;
+    if (!isfinite(sw) || !isfinite(sh)) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
     FloatSize unscaledSize(sw, sh);
     IntSize scaledSize = m_canvas->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
@@ -1306,7 +1311,7 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy,
     ImageBuffer* buffer = m_canvas ? m_canvas->buffer() : 0;
     if (!buffer)
         return createEmptyImageData(scaledRect.size());
-    return buffer->getImageData(scaledRect);
+    return buffer->getUnmultipliedImageData(scaledRect);
 }
 
 void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy, ExceptionCode& ec)
@@ -1357,7 +1362,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     sourceRect.move(-destOffset);
     IntPoint destPoint(destOffset.width(), destOffset.height());
     
-    buffer->putImageData(data, sourceRect, destPoint);
+    buffer->putUnmultipliedImageData(data, sourceRect, destPoint);
 }
 
 String CanvasRenderingContext2D::font() const
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.h b/WebCore/html/canvas/CanvasRenderingContext2D.h
index 9648ffc..7c47e55 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -178,7 +178,7 @@ namespace WebCore {
         PassRefPtr<CanvasPattern> createPattern(HTMLImageElement*, const String& repetitionType, ExceptionCode&);
         PassRefPtr<CanvasPattern> createPattern(HTMLCanvasElement*, const String& repetitionType, ExceptionCode&);
         
-        PassRefPtr<ImageData> createImageData(float width, float height) const;
+        PassRefPtr<ImageData> createImageData(float width, float height, ExceptionCode&) const;
         PassRefPtr<ImageData> getImageData(float sx, float sy, float sw, float sh, ExceptionCode&) const;
         void putImageData(ImageData*, float dx, float dy, ExceptionCode&);
         void putImageData(ImageData*, float dx, float dy, float dirtyX, float dirtyY, float dirtyWidth, float dirtyHeight, ExceptionCode&);
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.idl b/WebCore/html/canvas/CanvasRenderingContext2D.idl
index a86b47d..0428054 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -113,7 +113,8 @@ module html {
         attribute [Custom] custom fillStyle;
         
         // pixel manipulation
-        ImageData createImageData(in float sw, in float sh);
+        ImageData createImageData(in float sw, in float sh)
+            raises (DOMException);
         ImageData getImageData(in float sx, in float sy, in float sw, in float sh)
             raises(DOMException);
         [Custom] void putImageData(/* in ImageData imagedata, in float dx, in float dy [, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight] */);