Merge korg/donut into korg/master

34 files changed, 312 insertions, 84 deletions

diff --git a/WebCore/Android.mk b/WebCore/Android.mk
index 7b909e3..7487723 100644
--- a/WebCore/Android.mk
+++ b/WebCore/Android.mk
@@ -592,6 +592,7 @@ LOCAL_SRC_FILES := \
 	platform/android/SearchPopupMenuAndroid.cpp \
 	platform/android/SharedTimerAndroid.cpp \
 	platform/android/SoundAndroid.cpp \
+	platform/android/SSLKeyGeneratorAndroid.cpp \
 	platform/android/SystemTimeAndroid.cpp \
 	platform/android/TemporaryLinkStubs.cpp \
 	platform/android/TextBreakIteratorInternalICU.cpp \
diff --git a/WebCore/bindings/js/JSAudioConstructor.cpp b/WebCore/bindings/js/JSAudioConstructor.cpp
index f0bdbe8..1231271 100644
--- a/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -54,7 +54,11 @@ static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const Ar
 {
     // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, static_cast<JSAudioConstructor*>(constructor)->document());
+    Document* document = static_cast<JSAudioConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
+
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
     if (args.size() > 0) {
         audio->setSrc(args.at(exec, 0).toString(exec));
         audio->scheduleLoad();
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 6e27dc1..bb3e1b5 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -412,6 +412,8 @@ void reportException(JSC::ExecState* exec, JSValuePtr exception)
     exec->clearException();
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    if (!scriptExecutionContext)
+        return;
     scriptExecutionContext->reportException(errorMessage, lineNumber, exceptionSourceURL);
 }
 
@@ -509,19 +511,29 @@ ScriptState* scriptStateFromNode(Node* node)
     return frame->script()->globalObject()->globalExec();
 }
 
-Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
     return structures.set(classInfo, structure).first->second.get();
 }
 
+Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+{
+    return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
+}
+
+Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+{
+    return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
+}
+
 JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
 {
     JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index 71da21b..5870ecc 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -73,21 +73,27 @@ namespace WebCore {
     void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
 
+    JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
-    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
     {
-        if (JSC::Structure* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
+        if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(exec, WrapperClass::createStructure(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+    }
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    {
+        return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
-    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
-        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
     #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index 83bc202..d99abd9 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -157,8 +157,6 @@ void JSDOMWindowBase::updateDocument()
 
 JSDOMWindowBase::~JSDOMWindowBase()
 {
-    if (d()->impl->frame())
-        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
 }
 
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 562e661..f4fe1df 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -28,9 +28,13 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "History.h"
 #include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
+#include "JSHistory.h"
+#include "JSLocation.h"
 #include "JSMessagePort.h"
+#include "Location.h"
 #include "MessagePort.h"
 #include "ScriptController.h"
 #include "Settings.h"
@@ -124,6 +128,28 @@ JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& property
     return Base::lookupSetter(exec, propertyName);
 }
 
+JSValuePtr JSDOMWindow::history(ExecState* exec) const
+{
+    History* history = impl()->history();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+        return wrapper;
+
+    JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, const_cast<JSDOMWindow*>(this)), history);
+    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    return jsHistory;
+}
+
+JSValuePtr JSDOMWindow::location(ExecState* exec) const
+{
+    Location* location = impl()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, const_cast<JSDOMWindow*>(this)), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
+}
+
 void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
 {
     Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.h b/WebCore/bindings/js/JSDOMWindowCustom.h
index 838abab..351f2dd 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -185,12 +185,6 @@ ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject
     if (originWindow == targetWindow)
         return true;
 
-    // JS may be attempting to access the "window" object, which should be valid,
-    // even if the document hasn't been constructed yet.  If the document doesn't
-    // exist yet allow JS to access the window object.
-    if (!originWindow->impl()->document())
-        return true;
-
     const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
 
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index fff0ea5..596b78f 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -55,7 +55,14 @@ JSValuePtr JSDocument::location(ExecState* exec) const
     if (!frame)
         return jsNull();
 
-    return toJS(exec, frame->domWindow()->location());
+    Location* location = frame->domWindow()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(exec->lexicalGlobalObject());
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
 }
 
 void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
diff --git a/WebCore/bindings/js/JSImageConstructor.cpp b/WebCore/bindings/js/JSImageConstructor.cpp
index 0dc55b4..54e8be7 100644
--- a/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/WebCore/bindings/js/JSImageConstructor.cpp
@@ -56,7 +56,8 @@ static JSObject* constructImage(ExecState* exec, JSObject* constructor, const Ar
     }
 
     Document* document = static_cast<JSImageConstructor*>(constructor)->document();
-
+    if (!document)
+        return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
     // Calling toJS on the document causes the JS document wrapper to be
     // added to the window object. This is done to ensure that JSDocument::mark
     // will be called (which will cause the image element to be marked if necessary).
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 8da9f6d..8472250 100644
--- a/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -55,7 +55,7 @@ JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, Script
     else
         ASSERT_NOT_REACHED();
 
-    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 JSMessageChannelConstructor::~JSMessageChannelConstructor()
@@ -70,7 +70,11 @@ ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& const
 
 JSObject* JSMessageChannelConstructor::construct(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    return asObject(toJS(exec, MessageChannel::create(static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext())));
+    ScriptExecutionContext* context = static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+       return throwError(exec, ReferenceError, "MessageChannel constructor associated document is unavailable");
+
+    return asObject(toJS(exec, MessageChannel::create(context)));
 }
 
 void JSMessageChannelConstructor::mark()
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.h b/WebCore/bindings/js/JSNamedNodesCollection.h
index 19f194b..0294d23 100644
--- a/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -44,9 +44,9 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
diff --git a/WebCore/bindings/js/JSRGBColor.h b/WebCore/bindings/js/JSRGBColor.h
index d5acff3..2f51407 100644
--- a/WebCore/bindings/js/JSRGBColor.h
+++ b/WebCore/bindings/js/JSRGBColor.h
@@ -38,9 +38,9 @@ namespace WebCore {
 
         unsigned impl() const { return m_color; }
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
         static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index d7f54de..6cf021c 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -38,12 +38,15 @@ JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, Script
     ASSERT(context->isDocument());
     m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
 
-    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(static_cast<JSXMLHttpRequestConstructor*>(constructor)->document());
+    WebCore::Document* doc = static_cast<JSXMLHttpRequestConstructor*>(constructor)->document();
+    if (!doc)
+        return throwError(exec, ReferenceError, "XMLHttpRequest constructor associated document is unavailable");
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(doc);
     return CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequest, xmlHttpRequest.get());
 }
 
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index efd3a70..11d2945 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -133,7 +133,6 @@ void ScriptController::clearWindowShell()
 
     JSLock lock(false);
     m_windowShell->window()->clear();
-    m_liveFormerWindows.add(m_windowShell->window());
     m_windowShell->setWindow(m_frame->domWindow());
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -168,7 +167,7 @@ void ScriptController::initScript()
     JSLock lock(false);
 
     m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    updateDocument();
+    m_windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -265,9 +264,6 @@ void ScriptController::updateDocument()
     JSLock lock(false);
     if (m_windowShell)
         m_windowShell->window()->updateDocument();
-    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
-    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
-        (*it)->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 28fd7e9..2a9ea45 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -101,7 +101,6 @@ public:
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
     void clearWindowShell();
-    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
     void updateDocument();
 
     // Notifies the ScriptController that the securityOrigin of the current
@@ -146,7 +145,6 @@ private:
     bool isJavaScriptAnchorNavigation() const;
 
     JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
-    HashSet<JSDOMWindow*> m_liveFormerWindows;
     Frame* m_frame;
     int m_handlerLineno;
     const String* m_sourceURL;
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 2af88e2..49ad7b7 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -438,7 +438,7 @@ sub GenerateHeader
     push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document");
 
     # Prototype
-    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
+    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
     $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"};
 
@@ -665,7 +665,7 @@ sub GenerateHeader
     } elsif ($interfaceName eq "WorkerContext") {
         push(@headerContent, "    void* operator new(size_t, JSC::JSGlobalData*);\n");
     } else {
-        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*);\n");
+        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);\n");
     }
     push(@headerContent, "    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }\n");
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
@@ -907,9 +907,9 @@ sub GenerateImplementation
         push(@implContent, "    return globalData->heap.allocate(size);\n");
         push(@implContent, "}\n\n");
     } else {
-        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    return getDOMPrototype<${className}>(exec);\n");
+        push(@implContent, "    return getDOMPrototype<${className}>(exec, globalObject);\n");
         push(@implContent, "}\n\n");
     }
     if ($numConstants > 0 || $numFunctions > 0) {
@@ -1015,12 +1015,12 @@ sub GenerateImplementation
     }
 
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -1981,7 +1981,7 @@ public:
     ${className}Constructor(ExecState* exec)
         : DOMObject(${className}Constructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec), None);
+        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
diff --git a/WebCore/bridge/runtime_array.h b/WebCore/bridge/runtime_array.h
index 1ea47a4..488c3f5 100644
--- a/WebCore/bridge/runtime_array.h
+++ b/WebCore/bridge/runtime_array.h
@@ -51,9 +51,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static ArrayPrototype* createPrototype(ExecState* exec)
+    static ArrayPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->arrayPrototype();
+        return globalObject->arrayPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/WebCore/bridge/runtime_method.h b/WebCore/bridge/runtime_method.h
index bb983f9..fe1178a 100644
--- a/WebCore/bridge/runtime_method.h
+++ b/WebCore/bridge/runtime_method.h
@@ -40,9 +40,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/WebCore/bridge/runtime_object.h b/WebCore/bridge/runtime_object.h
index b8788c9..fa81aa1 100644
--- a/WebCore/bridge/runtime_object.h
+++ b/WebCore/bridge/runtime_object.h
@@ -53,9 +53,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static ObjectPrototype* createPrototype(ExecState* exec)
+    static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->objectPrototype();
+        return globalObject->objectPrototype();
     }
 
     static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index e420a5f..fc431b7 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -88,6 +88,10 @@ using namespace WTF;
 #include "CSSPropertyNames.cpp"
 #include "CSSValueKeywords.c"
 
+#ifdef ANDROID_INSTRUMENT
+#include "TimeCounter.h"
+#endif
+
 namespace WebCore {
 
 static bool equal(const CSSParserString& a, const char* b)
@@ -217,32 +221,53 @@ void CSSParser::setupParser(const char* prefix, const String& string, const char
 
 void CSSParser::parseSheet(CSSStyleSheet* sheet, const String& string)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     m_styleSheet = sheet;
     m_defaultNamespace = starAtom; // Reset the default namespace.
     
     setupParser("", string, "");
     cssyyparse(this);
     m_rule = 0;
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
 }
 
 PassRefPtr<CSSRule> CSSParser::parseRule(CSSStyleSheet* sheet, const String& string)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     m_styleSheet = sheet;
     setupParser("@-webkit-rule{", string, "} ");
     cssyyparse(this);
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return m_rule.release();
 }
 
 PassRefPtr<CSSRule> CSSParser::parseKeyframeRule(CSSStyleSheet *sheet, const String &string)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     m_styleSheet = sheet;
     setupParser("@-webkit-keyframe-rule{ ", string, "} ");
     cssyyparse(this);
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return m_keyframe.release();
 }
 
 bool CSSParser::parseValue(CSSMutableStyleDeclaration* declaration, int id, const String& string, bool important)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     ASSERT(!declaration->stylesheet() || declaration->stylesheet()->isCSSStyleSheet());
     m_styleSheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
 
@@ -264,6 +289,9 @@ bool CSSParser::parseValue(CSSMutableStyleDeclaration* declaration, int id, cons
         clearProperties();
     }
 
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return ok;
 }
 
@@ -294,6 +322,9 @@ bool CSSParser::parseColor(RGBA32& color, const String& string, bool strict)
 
 bool CSSParser::parseColor(CSSMutableStyleDeclaration* declaration, const String& string)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     ASSERT(!declaration->stylesheet() || declaration->stylesheet()->isCSSStyleSheet());
     m_styleSheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
 
@@ -301,11 +332,17 @@ bool CSSParser::parseColor(CSSMutableStyleDeclaration* declaration, const String
     cssyyparse(this);
     m_rule = 0;
 
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return (m_numParsedProperties && m_parsedProperties[0]->m_id == CSSPropertyColor);
 }
 
 void CSSParser::parseSelector(const String& string, Document* doc, CSSSelectorList& selectorList)
 {    
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     RefPtr<CSSStyleSheet> dummyStyleSheet = CSSStyleSheet::create(doc);
 
     m_styleSheet = dummyStyleSheet.get();
@@ -316,10 +353,16 @@ void CSSParser::parseSelector(const String& string, Document* doc, CSSSelectorLi
     cssyyparse(this);
 
     m_selectorListForParseSelector = 0;
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
 }
 
 bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const String& string)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     ASSERT(!declaration->stylesheet() || declaration->stylesheet()->isCSSStyleSheet());
     m_styleSheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
 
@@ -336,6 +379,9 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
         clearProperties();
     }
 
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return ok;
 }
 
@@ -344,6 +390,9 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
     if (string.isEmpty())
         return true;
 
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     m_mediaQuery = 0;
     // can't use { because tokenizer state switches from mediaquery to initial state when it sees { token.
     // instead insert one " " (which is WHITESPACE in CSSGrammar.y)
@@ -357,6 +406,9 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
         m_mediaQuery = 0;
     }
 
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return ok;
 }
 
@@ -4643,6 +4695,9 @@ void CSSParser::clearVariables()
 
 bool CSSParser::parseVariable(CSSVariablesDeclaration* declaration, const String& variableName, const String& variableValue)
 {
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
+#endif
     m_styleSheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
 
     String nameValuePair = variableName + ": ";
@@ -4660,6 +4715,9 @@ bool CSSParser::parseVariable(CSSVariablesDeclaration* declaration, const String
     
     clearVariables();
 
+#ifdef ANDROID_INSTRUMENT
+    android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
+#endif
     return ok;
 }
 
diff --git a/WebCore/css/CSSStyleSheet.cpp b/WebCore/css/CSSStyleSheet.cpp
index 2e9255b..47b2c81 100644
--- a/WebCore/css/CSSStyleSheet.cpp
+++ b/WebCore/css/CSSStyleSheet.cpp
@@ -31,10 +31,6 @@
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
-#ifdef ANDROID_INSTRUMENT
-#include "TimeCounter.h"
-#endif
-
 namespace WebCore {
 
 CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset)
@@ -163,15 +159,9 @@ const AtomicString& CSSStyleSheet::determineNamespace(const AtomicString& prefix
 
 bool CSSStyleSheet::parseString(const String &string, bool strict)
 {
-#ifdef ANDROID_INSTRUMENT
-    android::TimeCounter::start(android::TimeCounter::CSSTimeCounter);
-#endif    
     setStrictParsing(strict);
     CSSParser p(strict);
     p.parseSheet(this, string);
-#ifdef ANDROID_INSTRUMENT
-    android::TimeCounter::record(android::TimeCounter::CSSTimeCounter, __FUNCTION__);
-#endif    
     return true;
 }
 
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index 085019f..63f818e 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -176,7 +176,11 @@ void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange
 HTMLSelectElement* HTMLOptionElement::ownerSelectElement() const
 {
     Node* select = parentNode();
+#ifdef ANDROID_FIX
+    while (select && !(select->hasTagName(selectTag) || select->hasTagName(keygenTag)))
+#else
     while (select && !select->hasTagName(selectTag))
+#endif
         select = select->parentNode();
 
     if (!select)
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 0403dad..a719d7d 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -61,6 +61,13 @@ using namespace HTMLNames;
 static const unsigned cMaxRedundantTagDepth = 20;
 static const unsigned cResidualStyleMaxDepth = 200;
 
+static const int minBlockLevelTagPriority = 3;
+
+// A cap on the number of tags with priority minBlockLevelTagPriority or higher
+// allowed in blockStack. The cap is enforced by adding such new elements as
+// siblings instead of children once it is reached.
+static const size_t cMaxBlockDepth = 4096;
+
 struct HTMLStackElem : Noncopyable {
     HTMLStackElem(const AtomicString& t, int lvl, Node* n, bool r, HTMLStackElem* nx)
         : tagName(t)
@@ -117,6 +124,7 @@ HTMLParser::HTMLParser(HTMLDocument* doc, bool reportErrors)
     , current(doc)
     , didRefCurrent(false)
     , blockStack(0)
+    , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
     , head(0)
     , inBody(false)
@@ -134,6 +142,7 @@ HTMLParser::HTMLParser(DocumentFragment* frag)
     , current(frag)
     , didRefCurrent(true)
     , blockStack(0)
+    , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
     , head(0)
     , inBody(true)
@@ -320,6 +329,11 @@ bool HTMLParser::insertNode(Node* n, bool flat)
     if (inStrayTableContent && localName == tableTag)
         popBlock(tableTag);
     
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(blockStack->tagName);
+    }
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
     Node* newNode = current->addChild(n);
@@ -1306,6 +1320,8 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
 void HTMLParser::pushBlock(const AtomicString& tagName, int level)
 {
     blockStack = new HTMLStackElem(tagName, level, current, didRefCurrent, blockStack);
+    if (level >= minBlockLevelTagPriority)
+        m_blocksInStack++;
     didRefCurrent = false;
     if (tagName == pTag)
         m_hasPElementInScope = InScope;
@@ -1408,6 +1424,10 @@ inline HTMLStackElem* HTMLParser::popOneBlockCommon()
     if (current && elem->node != current)
         current->finishParsingChildren();
 
+    if (blockStack->level >= minBlockLevelTagPriority) {
+        ASSERT(m_blocksInStack > 0);
+        m_blocksInStack--;
+    }
     blockStack = elem->next;
     current = elem->node;
     didRefCurrent = elem->didRefNode;
@@ -1482,6 +1502,7 @@ void HTMLParser::freeBlock()
 {
     while (blockStack)
         popOneBlock();
+    ASSERT(!m_blocksInStack);
 }
 
 void HTMLParser::createHead()
diff --git a/WebCore/html/HTMLParser.h b/WebCore/html/HTMLParser.h
index 866835f..251b323 100644
--- a/WebCore/html/HTMLParser.h
+++ b/WebCore/html/HTMLParser.h
@@ -159,6 +159,11 @@ private:
 
     HTMLStackElem* blockStack;
 
+    // The number of tags with priority minBlockLevelTagPriority or higher
+    // currently in m_blockStack. The parser enforces a cap on this value by
+    // adding such new elements as siblings instead of children once it is reached.
+    size_t m_blocksInStack;
+
     enum ElementInScopeState { NotInScope, InScope, Unknown }; 
     ElementInScopeState m_hasPElementInScope;
 
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index b01d4e4..a3bd787 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -879,7 +879,9 @@ HTMLTokenizer::State HTMLTokenizer::parseEntity(SegmentedString& src, UChar*& de
                     }
                 } else {
                     // FIXME: We should eventually colorize entities by sending them as a special token.
-                    checkBuffer(11);
+                    // 12 bytes required: up to 10 bytes in m_cBuffer plus the
+                    // leading '&' and trailing ';'
+                    checkBuffer(12);
                     *dest++ = '&';
                     for (unsigned i = 0; i < cBufferPos; i++)
                         dest[i] = m_cBuffer[i];
@@ -890,7 +892,9 @@ HTMLTokenizer::State HTMLTokenizer::parseEntity(SegmentedString& src, UChar*& de
                     }
                 }
             } else {
-                checkBuffer(10);
+                // 11 bytes required: up to 10 bytes in m_cBuffer plus the
+                // leading '&'
+                checkBuffer(11);
                 // ignore the sequence, add it to the buffer as plaintext
                 *dest++ = '&';
                 for (unsigned i = 0; i < cBufferPos; i++)
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index 70ee79e..f28e356 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -764,9 +764,15 @@ DOMWindow* DOMWindow::top() const
 
 Document* DOMWindow::document() const
 {
+    // FIXME: This function shouldn't need a frame to work.
     if (!m_frame)
         return 0;
 
+    // The m_frame pointer is not zeroed out when the window is put into b/f cache, so it can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->domWindow() != this)
+        return 0;
+
     ASSERT(m_frame->document());
     return m_frame->document();
 }
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index 78c780f..b1797b9 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -44,7 +44,7 @@ module window {
     ] DOMWindow {
         // DOM Level 0
         readonly attribute Screen screen;
-        readonly attribute [DoNotCheckDomainSecurity] History history;
+        readonly attribute [DoNotCheckDomainSecurity, CustomGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -53,7 +53,7 @@ module window {
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
-        attribute [DoNotCheckDomainSecurity, CustomSetter] Location location;
+        attribute [DoNotCheckDomainSecurity, Custom] Location location;
 
         DOMSelection getSelection();
 
diff --git a/WebCore/platform/android/KeyGeneratorClient.h b/WebCore/platform/android/KeyGeneratorClient.h
new file mode 100644
index 0000000..614cc08
--- /dev/null
+++ b/WebCore/platform/android/KeyGeneratorClient.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef KEY_GENERATOR_CLIENT_H
+#define KEY_GENERATOR_CLIENT_H
+
+#include <wtf/Vector.h>
+#include "KURL.h"
+#include "PlatformString.h"
+
+using namespace WebCore;
+
+namespace android {
+
+    class KeyGeneratorClient {
+    public:
+        virtual ~KeyGeneratorClient() {}
+        virtual WTF::Vector<String> getSupportedKeyStrengthList() = 0;
+        virtual String getSignedPublicKeyAndChallengeString(unsigned index,
+                const String& challenge, const KURL& url) = 0;
+    };
+
+}
+#endif
+
diff --git a/WebCore/platform/android/SSLKeyGeneratorAndroid.cpp b/WebCore/platform/android/SSLKeyGeneratorAndroid.cpp
new file mode 100644
index 0000000..509d338
--- /dev/null
+++ b/WebCore/platform/android/SSLKeyGeneratorAndroid.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2009, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "JavaSharedClient.h"
+#include "KeyGeneratorClient.h"
+
+namespace WebCore {
+
+void getSupportedKeySizes(Vector<String>& keys)
+{
+    if (android::JavaSharedClient::GetKeyGeneratorClient()) {
+        keys = android::JavaSharedClient::GetKeyGeneratorClient()->
+                getSupportedKeyStrengthList();
+    }
+}
+
+String signedPublicKeyAndChallengeString(unsigned index,
+        const String& challenge, const KURL& url)
+{
+    if (android::JavaSharedClient::GetKeyGeneratorClient()) {
+        return android::JavaSharedClient::GetKeyGeneratorClient()->
+                getSignedPublicKeyAndChallengeString(index, challenge, url);
+    }
+    return String();
+}
+
+}
diff --git a/WebCore/platform/android/TemporaryLinkStubs.cpp b/WebCore/platform/android/TemporaryLinkStubs.cpp
index 5d71dd0..04f9a87 100644
--- a/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -696,17 +696,6 @@ String searchMenuClearRecentSearchesText()
     return String();
 }
 
-Vector<String> supportedKeySizes()
-{
-    notImplemented();
-    return Vector<String>();
-}
-
-String signedPublicKeyAndChallengeString(unsigned int, String const&, WebCore::KURL const&)
-{
-    return String();
-}
-
 } // namespace WebCore
 
 // added for Nov-16-07 ToT integration
@@ -776,11 +765,6 @@ void prefetchDNS(const String&)
     notImplemented();
 }
 
-void getSupportedKeySizes(Vector<String>&)
-{
-    notImplemented();
-}
-
 PassRefPtr<Icon> Icon::createIconForFile(const String&)
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/android/GraphicsContextAndroid.cpp b/WebCore/platform/graphics/android/GraphicsContextAndroid.cpp
index 40d98ec..90ce354 100644
--- a/WebCore/platform/graphics/android/GraphicsContextAndroid.cpp
+++ b/WebCore/platform/graphics/android/GraphicsContextAndroid.cpp
@@ -240,7 +240,7 @@ public:
 
     void setup_paint_fill(SkPaint* paint) const {
         this->setup_paint_common(paint);
-        paint->setColor(mState->mFillColor);
+        paint->setColor(mState->applyAlpha(mState->mFillColor));
     }
 
     /*  sets up the paint for stroking. Returns true if the style is really
@@ -248,7 +248,7 @@ public:
     */
     bool setup_paint_stroke(SkPaint* paint, SkRect* rect) {
         this->setup_paint_common(paint);
-        paint->setColor(mState->mStrokeColor);
+        paint->setColor(mState->applyAlpha(mState->mStrokeColor));
                          
         float width = mState->mStrokeThickness;
 
diff --git a/WebCore/platform/graphics/android/ImageAndroid.cpp b/WebCore/platform/graphics/android/ImageAndroid.cpp
index 6997a9e..769ac43 100644
--- a/WebCore/platform/graphics/android/ImageAndroid.cpp
+++ b/WebCore/platform/graphics/android/ImageAndroid.cpp
@@ -192,6 +192,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect,
     SkCanvas*   canvas = ctxt->platformContext()->mCanvas;
     SkPaint     paint;
 
+    ctxt->setupFillPaint(&paint);   // need global alpha among other things
     paint.setFilterBitmap(true);
     paint.setPorterDuffXfermode(android_convert_compositeOp(compositeOp));
     canvas->drawBitmapRect(bitmap, &srcR, dstR, &paint);
@@ -237,7 +238,8 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect,
     
     SkCanvas*   canvas = ctxt->platformContext()->mCanvas;
     SkPaint     paint;
-    
+    ctxt->setupFillPaint(&paint);   // need global alpha among other things
+
     SkShader* shader = SkShader::CreateBitmapShader(bitmap,
                                                     SkShader::kRepeat_TileMode,
                                                     SkShader::kRepeat_TileMode);
diff --git a/WebCore/platform/text/StringHash.h b/WebCore/platform/text/StringHash.h
index 336dce3..f33638e 100644
--- a/WebCore/platform/text/StringHash.h
+++ b/WebCore/platform/text/StringHash.h
@@ -47,6 +47,9 @@ namespace WebCore {
             if (aLength != bLength)
                 return false;
 
+#if PLATFORM(ARM)
+            return memcmp(a->characters(), b->characters(), sizeof(UChar) * aLength) == 0;
+#else
             const uint32_t* aChars = reinterpret_cast<const uint32_t*>(a->characters());
             const uint32_t* bChars = reinterpret_cast<const uint32_t*>(b->characters());
 
@@ -59,6 +62,7 @@ namespace WebCore {
                 return false;
 
             return true;
+#endif
         }
 
         static unsigned hash(const RefPtr<StringImpl>& key) { return key->hash(); }
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index f16755a..b62679b 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -934,6 +934,7 @@ void XMLHttpRequest::networkError()
         if (m_upload)
             m_upload->dispatchErrorEvent();
     }
+    internalAbort();
 }
 
 void XMLHttpRequest::abortError()
@@ -1159,7 +1160,6 @@ void XMLHttpRequest::didFail()
     if (m_error)
         return;
 
-    internalAbort();
     networkError();
 }
 
@@ -1294,7 +1294,7 @@ void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse
 
 void XMLHttpRequest::didReceiveData(const char* data, int len)
 {
-    if (m_inPreflight)
+    if (m_inPreflight || m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)