Merge commit 'goog/master-webkit-merge' into webkit-merge-44544

16 files changed, 209 insertions, 102 deletions

diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index e59ddaf..53bccbe 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -367,6 +367,12 @@ void Database::enableAuthorizer()
     m_databaseAuthorizer->enable();
 }
 
+void Database::setAuthorizerReadOnly()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->setReadOnly();
+}
+
 static int guidForOriginAndName(const String& origin, const String& name)
 {
     String stringID;
@@ -431,18 +437,23 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
         }
     }
 
-
     String currentVersion;
     {
         MutexLocker locker(guidMutex());
-        currentVersion = guidToVersionMap().get(m_guid);
 
-        if (currentVersion.isNull())
-            LOG(StorageAPI, "Current cached version for guid %i is null", m_guid);
-        else
-            LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
+        // Note: It is not safe to put an empty string into the guidToVersionMap() map.
+        // That's because the map is cross-thread, but empty strings are per-thread.
+        // The copy() function makes a version of the string you can use on the current
+        // thread, but we need a string we can keep in a cross-thread data structure.
+        // FIXME: This is a quite-awkward restriction to have to program with.
 
-        if (currentVersion.isNull()) {
+        GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
+        if (entry != guidToVersionMap().end()) {
+            // Map null string to empty string (see comment above).
+            currentVersion = entry->second.isNull() ? String("") : entry->second;
+            LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
+        } else {
+            LOG(StorageAPI, "No cached version for guid %i", m_guid);
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
@@ -457,11 +468,11 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
                     e = INVALID_STATE_ERR;
                     return false;
                 }
-
                 currentVersion = m_expectedVersion;
             }
 
-            guidToVersionMap().set(m_guid, currentVersion.copy());
+            // Map empty string to null string (see comment above).
+            guidToVersionMap().set(m_guid, currentVersion.isEmpty() ? String() : currentVersion.copy());
         }
     }
 
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index 3eb303c..385485a 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -83,6 +83,7 @@ public:
 
     void disableAuthorizer();
     void enableAuthorizer();
+    void setAuthorizerReadOnly();
 
     Vector<String> tableNames();
 
diff --git a/WebCore/storage/DatabaseAuthorizer.cpp b/WebCore/storage/DatabaseAuthorizer.cpp
index ca0a7f2..2d182ce 100644
--- a/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/WebCore/storage/DatabaseAuthorizer.cpp
@@ -44,10 +44,14 @@ void DatabaseAuthorizer::reset()
 {
     m_lastActionWasInsert = false;
     m_lastActionChangedDatabase = false;
+    m_readOnly = false;
 }
 
 int DatabaseAuthorizer::createTable(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -59,6 +63,9 @@ int DatabaseAuthorizer::createTempTable(const String& tableName)
 
 int DatabaseAuthorizer::dropTable(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -69,12 +76,18 @@ int DatabaseAuthorizer::dropTempTable(const String& tableName)
 
 int DatabaseAuthorizer::allowAlterTable(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -86,6 +99,9 @@ int DatabaseAuthorizer::createTempIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -96,6 +112,9 @@ int DatabaseAuthorizer::dropTempIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -107,6 +126,9 @@ int DatabaseAuthorizer::createTempTrigger(const String&, const String& tableName
 
 int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -117,22 +139,34 @@ int DatabaseAuthorizer::dropTempTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createVTable(const String&, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
 int DatabaseAuthorizer::dropVTable(const String&, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return m_securityEnabled ? SQLAuthDeny : SQLAuthAllow;
 }
 
 int DatabaseAuthorizer::allowDelete(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
 int DatabaseAuthorizer::allowInsert(const String& tableName)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     m_lastActionWasInsert = true;
     return denyBasedOnTableName(tableName);
@@ -140,6 +174,9 @@ int DatabaseAuthorizer::allowInsert(const String& tableName)
 
 int DatabaseAuthorizer::allowUpdate(const String& tableName, const String&)
 {
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     m_lastActionChangedDatabase = true;
     return denyBasedOnTableName(tableName);
 }
@@ -192,6 +229,11 @@ void DatabaseAuthorizer::enable()
     m_securityEnabled = true;
 }
 
+void DatabaseAuthorizer::setReadOnly()
+{
+    m_readOnly = true;
+}
+
 int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName)
 {
     if (!m_securityEnabled)
diff --git a/WebCore/storage/DatabaseAuthorizer.h b/WebCore/storage/DatabaseAuthorizer.h
index 685bb97..e53ea50 100644
--- a/WebCore/storage/DatabaseAuthorizer.h
+++ b/WebCore/storage/DatabaseAuthorizer.h
@@ -85,6 +85,7 @@ public:
 
     void disable();
     void enable();
+    void setReadOnly();
 
     void reset();
 
@@ -95,9 +96,10 @@ private:
     DatabaseAuthorizer();
     int denyBasedOnTableName(const String&);
 
-    bool m_securityEnabled;
-    bool m_lastActionWasInsert;
-    bool m_lastActionChangedDatabase;
+    bool m_securityEnabled : 1;
+    bool m_lastActionWasInsert : 1;
+    bool m_lastActionChangedDatabase : 1;
+    bool m_readOnly : 1;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageArea.cpp b/WebCore/storage/LocalStorageArea.cpp
index bcc261c..27701c7 100644
--- a/WebCore/storage/LocalStorageArea.cpp
+++ b/WebCore/storage/LocalStorageArea.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,17 +29,16 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "CString.h"
+#include "DOMWindow.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "FrameTree.h"
+#include "HTMLElement.h"
 #include "LocalStorage.h"
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "PlatformString.h"
-#include "SecurityOrigin.h"
 #include "SQLiteStatement.h"
+#include "StorageEvent.h"
+#include "SuddenTermination.h"
 
 namespace WebCore {
 
@@ -70,7 +69,13 @@ LocalStorageArea::~LocalStorageArea()
 
 void LocalStorageArea::scheduleFinalSync()
 {
-    m_syncTimer.stop();
+    if (m_syncTimer.isActive())
+        m_syncTimer.stop();
+    else {
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
     syncTimerFired(&m_syncTimer);
     m_finalSyncScheduled = true;
 }
@@ -226,10 +231,8 @@ void LocalStorageArea::dispatchStorageEvent(const String& key, const String& old
         }
     }
 
-    for (unsigned i = 0; i < frames.size(); ++i) {
-        if (HTMLElement* body = frames[i]->document()->body())
-            body->dispatchStorageEvent(eventNames().storageEvent, key, oldValue, newValue, sourceFrame);        
-    }
+    for (unsigned i = 0; i < frames.size(); ++i)
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
 }
 
 void LocalStorageArea::scheduleItemForSync(const String& key, const String& value)
@@ -238,8 +241,13 @@ void LocalStorageArea::scheduleItemForSync(const String& key, const String& valu
     ASSERT(!m_finalSyncScheduled);
 
     m_changedItems.set(key, value);
-    if (!m_syncTimer.isActive())
+    if (!m_syncTimer.isActive()) {
         m_syncTimer.startOneShot(LocalStorageSyncInterval);
+
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
 }
 
 void LocalStorageArea::scheduleClear()
@@ -249,8 +257,13 @@ void LocalStorageArea::scheduleClear()
 
     m_changedItems.clear();
     m_itemsCleared = true;
-    if (!m_syncTimer.isActive())
+    if (!m_syncTimer.isActive()) {
         m_syncTimer.startOneShot(LocalStorageSyncInterval);
+
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
 }
 
 void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
@@ -274,10 +287,19 @@ void LocalStorageArea::syncTimerFired(Timer<LocalStorageArea>*)
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
+
+            // The following is balanced by the call to enableSuddenTermination in the
+            // performSync function.
+            disableSuddenTermination();
+
             m_localStorage->scheduleSync(this);
         }
     }
 
+    // The following is balanced by the calls to disableSuddenTermination in the
+    // scheduleItemForSync, scheduleClear, and scheduleFinalSync functions.
+    enableSuddenTermination();
+
     m_changedItems.clear();
 }
 
@@ -348,25 +370,15 @@ void LocalStorageArea::markImported()
     m_importCondition.signal();
 }
 
-void LocalStorageArea::performSync()
+void LocalStorageArea::sync(bool clearItems, const HashMap<String, String>& items)
 {
     ASSERT(!isMainThread());
 
     if (!m_database.isOpen())
         return;
 
-    HashMap<String, String> items;
-    bool clearFirst = false;
-    {
-        MutexLocker locker(m_syncLock);
-        m_itemsPendingSync.swap(items);
-        clearFirst = m_clearItemsWhileSyncing;
-        m_clearItemsWhileSyncing = false;
-        m_syncScheduled = false;
-    }
-
-    // If the clear flag is marked, then we clear all items out before we write any new ones in
-    if (clearFirst) {
+    // If the clear flag is set, then we clear all items out before we write any new ones in.
+    if (clearItems) {
         SQLiteStatement clear(m_database, "DELETE FROM ItemTable");
         if (clear.prepare() != SQLResultOk) {
             LOG_ERROR("Failed to prepare clear statement - cannot write to local storage database");
@@ -392,10 +404,10 @@ void LocalStorageArea::performSync()
         return;
     }
 
-    HashMap<String, String>::iterator end = items.end();
+    HashMap<String, String>::const_iterator end = items.end();
 
-    for (HashMap<String, String>::iterator it = items.begin(); it != end; ++it) {
-        // Based on the null-ness of the second argument, decide whether this is an insert or a delete
+    for (HashMap<String, String>::const_iterator it = items.begin(); it != end; ++it) {
+        // Based on the null-ness of the second argument, decide whether this is an insert or a delete.
         SQLiteStatement& query = it->second.isNull() ? remove : insert;        
 
         query.bindText(1, it->first);
@@ -414,6 +426,31 @@ void LocalStorageArea::performSync()
     }
 }
 
+void LocalStorageArea::performSync()
+{
+    ASSERT(!isMainThread());
+
+    bool clearItems;
+    HashMap<String, String> items;
+    {
+        MutexLocker locker(m_syncLock);
+
+        ASSERT(m_syncScheduled);
+
+        clearItems = m_clearItemsWhileSyncing;
+        m_itemsPendingSync.swap(items);
+
+        m_clearItemsWhileSyncing = false;
+        m_syncScheduled = false;
+    }
+
+    sync(clearItems, items);
+
+    // The following is balanced by the call to disableSuddenTermination in the
+    // syncTimerFired function.
+    enableSuddenTermination();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/WebCore/storage/LocalStorageArea.h b/WebCore/storage/LocalStorageArea.h
index 0ca5ab8..26d9ccf 100644
--- a/WebCore/storage/LocalStorageArea.h
+++ b/WebCore/storage/LocalStorageArea.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,17 +28,11 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "LocalStorageTask.h"
-#include "LocalStorageThread.h"
-
 #include "SQLiteDatabase.h"
 #include "StorageArea.h"
 #include "StringHash.h"
 #include "Timer.h"
-
 #include <wtf/HashMap.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
     
@@ -90,6 +84,7 @@ namespace WebCore {
 
     private:
         void syncTimerFired(Timer<LocalStorageArea>*);
+        void sync(bool clearItems, const HashMap<String, String>& items);
 
         Mutex m_syncLock;
         HashMap<String, String> m_itemsPendingSync;
diff --git a/WebCore/storage/SQLStatement.cpp b/WebCore/storage/SQLStatement.cpp
index 9160c4e..38ca75d 100644
--- a/WebCore/storage/SQLStatement.cpp
+++ b/WebCore/storage/SQLStatement.cpp
@@ -44,16 +44,17 @@
 
 namespace WebCore {
 
-PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback)
+PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
 {
-    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback));
+    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback, readOnly));
 }
 
-SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback)
+SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
     : m_statement(statement.copy())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
+    , m_readOnly(readOnly)
 {
 }
    
@@ -69,6 +70,9 @@ bool SQLStatement::execute(Database* db)
     if (m_error)
         return false;
         
+    if (m_readOnly)
+        db->setAuthorizerReadOnly();
+    
     SQLiteDatabase* database = &db->m_sqliteDatabase;
     
     SQLiteStatement statement(*database, m_statement);
diff --git a/WebCore/storage/SQLStatement.h b/WebCore/storage/SQLStatement.h
index c299156..831aecc 100644
--- a/WebCore/storage/SQLStatement.h
+++ b/WebCore/storage/SQLStatement.h
@@ -51,7 +51,7 @@ class String;
 
 class SQLStatement : public ThreadSafeShared<SQLStatement> {
 public:
-    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>);
+    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, bool readOnly);
     
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
@@ -66,7 +66,7 @@ public:
     
     SQLError* sqlError() const { return m_error.get(); }
 private:
-    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback);
+    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
@@ -78,6 +78,8 @@ private:
     
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
+    
+    bool m_readOnly;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/SQLTransaction.cpp b/WebCore/storage/SQLTransaction.cpp
index aa22d11..3331e6e 100644
--- a/WebCore/storage/SQLTransaction.cpp
+++ b/WebCore/storage/SQLTransaction.cpp
@@ -43,6 +43,7 @@
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
+#include "Settings.h"
 #include "SQLError.h"
 #include "SQLiteTransaction.h"
 #include "SQLResultSet.h"
@@ -74,7 +75,6 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_successCallback(successCallback)
     , m_errorCallback(errorCallback)
     , m_shouldRetryCurrentStatement(false)
-    , m_shouldCommitAfterErrorCallback(true)
     , m_modifiedDatabase(false)
 {
     ASSERT(m_database);
@@ -90,15 +90,20 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
         e = INVALID_STATE_ERR;
         return;
     }
+
+    bool readOnlyMode = false;
+    Page* page = m_database->document()->page();
+    if (!page || page->settings()->privateBrowsingEnabled())
+        readOnlyMode = true;
     
-    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement.copy(), arguments, callback, callbackError);
+    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, readOnlyMode);
 
     if (m_database->deleted())
         statement->setDatabaseDeletedError();
 
     if (!m_database->versionMatchesExpected())
         statement->setVersionMismatchedError();
-        
+
     enqueueStatement(statement);
 }
 
@@ -424,7 +429,6 @@ void SQLTransaction::postflightAndCommit()
 
     // If the commit failed, the transaction will still be marked as "in progress"
     if (m_sqliteTransaction->inProgress()) {
-        m_shouldCommitAfterErrorCallback = false;
         m_transactionError = SQLError::create(0, "failed to commit the transaction");
         handleTransactionError(false);
         return;
@@ -485,8 +489,8 @@ void SQLTransaction::handleTransactionError(bool inCallback)
         return;
     }
     
-    // Transaction Step 12 - If the callback couldn't be called, then rollback the transaction.
-    m_shouldCommitAfterErrorCallback = false;
+    // No error callback, so fast-forward to:
+    // Transaction Step 12 - Rollback the transaction.
     if (inCallback) {
         m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
         LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
@@ -500,10 +504,10 @@ void SQLTransaction::deliverTransactionErrorCallback()
 {
     ASSERT(m_transactionError);
     
-    // Transaction Step 12 - If the callback didn't return false, then rollback the transaction.
-    // This includes the callback not existing, returning true, or throwing an exception
-    if (!m_errorCallback || m_errorCallback->handleEvent(m_transactionError.get()))
-        m_shouldCommitAfterErrorCallback = false;
+    // Transaction Step 12 - If exists, invoke error callback with the last
+    // error to have occurred in this transaction.
+    if (m_errorCallback)
+        m_errorCallback->handleEvent(m_transactionError.get());
 
     m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
     LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
@@ -514,19 +518,8 @@ void SQLTransaction::cleanupAfterTransactionErrorCallback()
 {
     m_database->m_databaseAuthorizer->disable();
     if (m_sqliteTransaction) {
-        // Transaction Step 12 -If the error callback returned false, and the last error wasn't itself a 
-        // failure when committing the transaction, then try to commit the transaction
-        if (m_shouldCommitAfterErrorCallback)
-            m_sqliteTransaction->commit();
-        
-        if (m_sqliteTransaction->inProgress()) {
-            // Transaction Step 12 - If that fails, or if the callback couldn't be called 
-            // or if it didn't return false, then rollback the transaction.
-            m_sqliteTransaction->rollback();
-        } else if (m_modifiedDatabase) {
-            // But if the commit was successful, notify the delegates if the transaction modified this database
-            DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(m_database->m_securityOrigin.get(), m_database->m_name);
-        }
+        // Transaction Step 12 - Rollback the transaction.
+        m_sqliteTransaction->rollback();
         
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
         m_sqliteTransaction.clear();
diff --git a/WebCore/storage/SQLTransaction.h b/WebCore/storage/SQLTransaction.h
index e269495..e77c183 100644
--- a/WebCore/storage/SQLTransaction.h
+++ b/WebCore/storage/SQLTransaction.h
@@ -119,7 +119,6 @@ private:
     RefPtr<SQLTransactionErrorCallback> m_errorCallback;
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
-    bool m_shouldCommitAfterErrorCallback;
     bool m_modifiedDatabase;
     
     Mutex m_statementMutex;
diff --git a/WebCore/storage/SQLTransactionErrorCallback.h b/WebCore/storage/SQLTransactionErrorCallback.h
index b44255f..9dd3fd3 100644
--- a/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/WebCore/storage/SQLTransactionErrorCallback.h
@@ -40,7 +40,7 @@ namespace WebCore {
     class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
     public:
         virtual ~SQLTransactionErrorCallback() { }
-        virtual bool handleEvent(SQLError*) = 0;
+        virtual void handleEvent(SQLError*) = 0;
     };
     
 }
diff --git a/WebCore/storage/SessionStorageArea.cpp b/WebCore/storage/SessionStorageArea.cpp
index 884208e..168c493 100644
--- a/WebCore/storage/SessionStorageArea.cpp
+++ b/WebCore/storage/SessionStorageArea.cpp
@@ -31,9 +31,11 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "HTMLElement.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
+#include "StorageEvent.h"
 #include "StorageMap.h"
 
 namespace WebCore {
@@ -80,11 +82,9 @@ void SessionStorageArea::dispatchStorageEvent(const String& key, const String& o
         if (frame->document()->securityOrigin()->equal(securityOrigin()))
             frames.append(frame);
     }
-        
-    for (unsigned i = 0; i < frames.size(); ++i) {
-        if (HTMLElement* body = frames[i]->document()->body())
-            body->dispatchStorageEvent(eventNames().storageEvent, key, oldValue, newValue, sourceFrame);        
-    }
+
+    for (unsigned i = 0; i < frames.size(); ++i)
+        frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageArea.cpp b/WebCore/storage/StorageArea.cpp
index a98576d..ebd0279 100644
--- a/WebCore/storage/StorageArea.cpp
+++ b/WebCore/storage/StorageArea.cpp
@@ -30,7 +30,10 @@
 
 #include "CString.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
+#include "Page.h"
 #include "SecurityOrigin.h"
+#include "Settings.h"
 #include "StorageMap.h"
 
 namespace WebCore {
@@ -73,14 +76,19 @@ String StorageArea::internalGetItem(const String& key) const
     return m_storageMap->getItem(key);
 }
 
-void StorageArea::internalSetItem(const String& key, const String& value, ExceptionCode&, Frame* frame)
+void StorageArea::internalSetItem(const String& key, const String& value, ExceptionCode& ec, Frame* frame)
 {
     ASSERT(!value.isNull());
     
+    if (frame->page()->settings()->privateBrowsingEnabled()) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
+
     // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
     //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
     // if (<over quota>) {
-    //     ec = INVALID_ACCESS_ERR;
+    //     ec = QUOTA_EXCEEDED_ERR;
     //     return;
     // }
     
@@ -96,7 +104,10 @@ void StorageArea::internalSetItem(const String& key, const String& value, Except
 }
 
 void StorageArea::internalRemoveItem(const String& key, Frame* frame)
-{   
+{
+    if (frame->page()->settings()->privateBrowsingEnabled())
+        return;
+
     String oldValue;
     RefPtr<StorageMap> newMap = m_storageMap->removeItem(key, oldValue);
     if (newMap)
@@ -109,6 +120,9 @@ void StorageArea::internalRemoveItem(const String& key, Frame* frame)
 
 void StorageArea::internalClear(Frame* frame)
 {
+    if (frame->page()->settings()->privateBrowsingEnabled())
+        return;
+    
     m_storageMap = StorageMap::create();
     
     areaCleared(frame);
diff --git a/WebCore/storage/StorageEvent.cpp b/WebCore/storage/StorageEvent.cpp
index 8600d3c..f2945a9 100644
--- a/WebCore/storage/StorageEvent.cpp
+++ b/WebCore/storage/StorageEvent.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,20 +29,22 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "DOMWindow.h"
+#include "Storage.h"
 
 namespace WebCore {
 
-StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+StorageEvent::StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
     : Event(type, false, true)
     , m_key(key)
     , m_oldValue(oldValue)
     , m_newValue(newValue)
     , m_uri(uri)
     , m_source(source)
+    , m_storageArea(storageArea)
 {
 }
 
-void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
 {
     if (dispatched())
         return;
@@ -54,9 +56,10 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
     m_newValue = newValue;
     m_uri = uri;
     m_source = source;
+    m_storageArea = storageArea;
 }
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
 
diff --git a/WebCore/storage/StorageEvent.h b/WebCore/storage/StorageEvent.h
index f523442..ee3d5ad 100644
--- a/WebCore/storage/StorageEvent.h
+++ b/WebCore/storage/StorageEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +29,7 @@
 #if ENABLE(DOM_STORAGE)
 
 #include "Event.h"
+#include "Storage.h"
 
 namespace WebCore {
 
@@ -40,9 +41,9 @@ namespace WebCore {
         {
             return adoptRef(new StorageEvent);
         }
-        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source)
+        static PassRefPtr<StorageEvent> create(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea)
         {
-            return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source));
+            return adoptRef(new StorageEvent(type, key, oldValue, newValue, uri, source, storageArea));
         }
 
         const String& key() const { return m_key; }
@@ -50,23 +51,25 @@ namespace WebCore {
         const String& newValue() const { return m_newValue; }
         const String& uri() const { return m_uri; }
         DOMWindow* source() const { return m_source.get(); }
-        
-        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source);
-        
+        Storage* storageArea() const { return m_storageArea.get(); }
+
+        void initStorageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
+
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg,  Storage storageAreaArg);
 
         virtual bool isStorageEvent() const { return true; }
-        
+
     private:    
         StorageEvent() { }
-        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source);
+        StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
         
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
         RefPtr<DOMWindow> m_source;
+        RefPtr<Storage> m_storageArea;        
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageEvent.idl b/WebCore/storage/StorageEvent.idl
index b5b3be5..5a3f993 100644
--- a/WebCore/storage/StorageEvent.idl
+++ b/WebCore/storage/StorageEvent.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,10 +34,11 @@ module storage {
         readonly attribute [ConvertNullStringTo=Null] DOMString newValue;
         readonly attribute DOMString uri;
         readonly attribute DOMWindow source;
-        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg);
+        readonly attribute Storage storageArea;
+        void initStorageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in [ConvertNullToNullString] DOMString oldValueArg, in [ConvertNullToNullString] DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
 
         // Needed once we support init<blank>EventNS
-        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in Window sourceArg);
+        // void initStorageEventNS(in DOMString namespaceURI, in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString keyArg, in DOMString oldValueArg, in DOMString newValueArg, in DOMString uriArg, in DOMWindow sourceArg, in Storage storageAreaArg);
     };
 
 }